24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 3a:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4b0,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Dacic.12727.Generic Sample be06aab9e611… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample be06aab9e611…. Malware family: Dacic.12727.Generic. Threat score 100/100. 5/27 AV engines flagged this file. 4 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb","keywords":["Malicious","Dacic.12727.Generic","malware analysis","sandbox report","threat intelligence","be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb"],"about":{"@type":"SoftwareApplication","name":"Payment_Advise00383567.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Dacic.12727.Generic","antivirusDetections":{"malicious":5,"total":27},"behavioralIndicators":{"malicious":4,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T773,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAlloc"; File: "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAllocEx"; File: "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; File: "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; File: "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin") Found reference to API "NtWriteVirtualMemory" (Indicator: "NtWriteVirtualMemory"; File: "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00007268.00000000.276016.8734D000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00007268.00000000.276016.8734D000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007268.00000000.276016.8734D000.00000002.mdmp") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAlloc"; Source: "00000000-00007268.00000000.276016.8734D000.00000002.mdmp") Found reference to API "VirtualAllocExNuma" (Indicator: "VirtualAllocEx"; Source: "00000000-00007268.00000000.276016.8734D000.00000002.mdmp")26:T5bc,Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin") Found reference to API "Wow64GetThreadContext" (Indicator: "GetThreadContext"; File: "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin") Found reference to API "w64GetThreadContext" (Indicator: "GetThreadContext"; File: "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00007268.00000000.276016.8734D000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00007268.00000000.276016.8734D000.00000002.mdmp") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00007268.00000000.276016.8734D000.00000002.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00007268.00000000.276016.8734D000.00000002.mdmp")27:Tc2a,Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00007268.00000000.276016.8734D000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007268.00000000.276016.8734D000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00007268.00000000.276016.8734D000.00000002.mdmp") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00007268.00000000.276016.8734D000.00000002.mdmp") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00007268.00000000.276016.8734D000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00007268.00000000.276016.8734D000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00007268.00000000.276016.8734D000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007268.00000000.276016.8734D000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007268.00000000.276016.8734D000.00000002.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00007268.00000000.276016.8734D000.00000002.mdmp")28:T49b,Found reference to "TripleDES" (Indicator: "TripleDES"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found reference to "CryptographicException" (Indicator: "CryptographicException"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "DESCryptoServiceProvider"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDES"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDESCryptoServiceProvider"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp")29:T110d,Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; File: "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; File: "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin") Found api reference "Crypt.BCryptDecrypt() (get size) failed with status code: {0}" (Indicator: "BCryptDecrypt"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found api reference "Crypt.BCryptDecrypt() (get size) failed with status code: {0}" (Indicator: "CryptDecrypt"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found api reference "Crypt.BCryptDecrypt(): authentication tag mismatch" (Indicator: "BCryptDecrypt"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found api reference "Crypt.BCryptDecrypt(): authentication tag mismatch" (Indicator: "CryptDecrypt"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found api reference "Crypt.BCryptDecrypt() failed with status code:{0}" (Indicator: "BCryptDecrypt"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found api reference "Crypt.BCryptDecrypt() failed with status code:{0}" (Indicator: "CryptDecrypt"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found api reference "Crypt.BCryptOpenAlgorithmProvider() failed with status code:{0}" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found api reference "Crypt.BCryptImportKey() failed with status code:{0}" (Indicator: "BCryptImportKey"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found api reference "Crypt.BCryptImportKey() failed with status code:{0}" (Indicator: "CryptImportKey"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found api reference "Crypt.BCryptGetProperty() (get size) failed with status code:{0}" (Indicator: "BCryptGetProperty"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found api reference "Crypt.BCryptGetProperty() failed with status code:{0}" (Indicator: "BCryptGetProperty"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found api reference "CryptUnprotectData" (Indicator: "CryptUnprotectData"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found api reference "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found api reference "BCryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found api reference "BCryptEncrypt" (Indicator: "BCryptEncrypt"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found api reference "BCryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found api reference "BCryptImportKey" (Indicator: "BCryptImportKey"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found api reference "BCryptImportKey" (Indicator: "CryptImportKey"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found api reference "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found api reference "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found api reference "BCryptGetProperty" (Indicator: "BCryptGetProperty"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found api reference "BCryptSetProperty" (Indicator: "BCryptSetProperty"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; Source: "00000000-00007268.00000000.276016.8734D000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00007268.00000000.276016.8734D000.00000002.mdmp")2a:T706,Found reference to API "Crypt.BCryptDecrypt() (get size) failed with status code: {0}" (Indicator: "BCryptDecrypt"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found reference to API "Crypt.BCryptDecrypt(): authentication tag mismatch" (Indicator: "BCryptDecrypt"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found reference to API "Crypt.BCryptDecrypt() failed with status code:{0}" (Indicator: "BCryptDecrypt"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found reference to API "Crypt.BCryptOpenAlgorithmProvider() failed with status code:{0}" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found reference to API "Crypt.BCryptImportKey() failed with status code:{0}" (Indicator: "BCryptImportKey"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found reference to API "BCryptEncrypt" (Indicator: "BCryptEncrypt"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found reference to API "BCryptImportKey" (Indicator: "BCryptImportKey"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp")2b:Tf7e,Assembly shows XOR instruction xor rax rsp in Stream UID: 55907-2143-0000000140048690 Assembly shows XOR instruction xor eax esp in Stream UID: 55907-2143-0000000140048690 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55907-2143-0000000140048690 Assembly shows XOR instruction xor ecx esp in Stream UID: 55907-2143-0000000140048690 Assembly shows XOR instruction xor rax rsp in Stream UID: 55907-2262-0000000140058BC0 Assembly shows XOR instruction xor eax esp in Stream UID: 55907-2262-0000000140058BC0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55907-2262-0000000140058BC0 Assembly shows XOR instruction xor ecx esp in Stream UID: 55907-2262-0000000140058BC0 Assembly shows XOR instruction xor rax rsp in Stream UID: 55907-2264-00000001400585A0 Assembly shows XOR instruction xor eax esp in Stream UID: 55907-2264-00000001400585A0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55907-2264-00000001400585A0 Assembly shows XOR instruction xor ecx esp in Stream UID: 55907-2264-00000001400585A0 Assembly shows XOR instruction xor rax rsp in Stream UID: 55907-2265-00000001400583C0 Assembly shows XOR instruction xor eax esp in Stream UID: 55907-2265-00000001400583C0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55907-2265-00000001400583C0 Assembly shows XOR instruction xor ecx esp in Stream UID: 55907-2265-00000001400583C0 Assembly shows XOR instruction xor rax rsp in Stream UID: 55907-2266-00000001400581D0 Assembly shows XOR instruction xor eax esp in Stream UID: 55907-2266-00000001400581D0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55907-2266-00000001400581D0 Assembly shows XOR instruction xor ecx esp in Stream UID: 55907-2266-00000001400581D0 Assembly shows XOR instruction xor rax rsp in Stream UID: 55907-2319-00000001400503D0 Assembly shows XOR instruction xor eax esp in Stream UID: 55907-2319-00000001400503D0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55907-2319-00000001400503D0 Assembly shows XOR instruction xor ecx esp in Stream UID: 55907-2319-00000001400503D0 Assembly shows XOR instruction xor rax rsp in Stream UID: 55907-2321-00000001400501B0 Assembly shows XOR instruction xor eax esp in Stream UID: 55907-2321-00000001400501B0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55907-2321-00000001400501B0 Assembly shows XOR instruction xor ecx esp in Stream UID: 55907-2321-00000001400501B0 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55907-3242-000000014005157B Assembly shows XOR instruction xor ecx esp in Stream UID: 55907-3242-000000014005157B Assembly shows XOR instruction xor rcx rsp in Stream UID: 55907-4181-00000001400A8638 Assembly shows XOR instruction xor ecx esp in Stream UID: 55907-4181-00000001400A8638 Assembly shows XOR instruction xor rax rsp in Stream UID: 55907-4200-00000001400A997A Assembly shows XOR instruction xor eax esp in Stream UID: 55907-4200-00000001400A997A Assembly shows XOR instruction xor rcx rsp in Stream UID: 55907-4200-00000001400A997A Assembly shows XOR instruction xor ecx esp in Stream UID: 55907-4200-00000001400A997A Assembly shows XOR instruction xor qword ptr [rbp-10h] rax in Stream UID: 55907-5863-00000001400A7BDD Assembly shows XOR instruction xor dword ptr [rbp-10h] eax in Stream UID: 55907-5863-00000001400A7BDD Assembly shows XOR instruction xor rax qword ptr [rbp+18h] in Stream UID: 55907-5863-00000001400A7BDD Assembly shows XOR instruction xor eax dword ptr [rbp+18h] in Stream UID: 55907-5863-00000001400A7BDD Assembly shows XOR instruction xor rax qword ptr [rbp-10h] in Stream UID: 55907-5863-00000001400A7BDD Assembly shows XOR instruction xor eax dword ptr [rbp-10h] in Stream UID: 55907-5863-00000001400A7BDD Assembly shows XOR instruction xor rax rcx in Stream UID: 55907-5863-00000001400A7BDD Assembly shows XOR instruction xor eax ecx in Stream UID: 55907-5863-00000001400A7BDD2c:T5c7,Found reference to API "Crypt.BCryptDecrypt() (get size) failed with status code: {0}" (Indicator: "BCryptDecrypt"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found reference to API "Crypt.BCryptDecrypt() (get size) failed with status code: {0}" (Indicator: "CryptDecrypt"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found reference to API "Crypt.BCryptDecrypt(): authentication tag mismatch" (Indicator: "BCryptDecrypt"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found reference to API "Crypt.BCryptDecrypt(): authentication tag mismatch" (Indicator: "CryptDecrypt"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found reference to API "Crypt.BCryptDecrypt() failed with status code:{0}" (Indicator: "BCryptDecrypt"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found reference to API "Crypt.BCryptDecrypt() failed with status code:{0}" (Indicator: "CryptDecrypt"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found reference to API "CryptUnprotectData" (Indicator: "CryptUnprotectData"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp") Found reference to API "BCryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00007268.00000000.276016.78400000.00000004.mdmp")2d:T705,Contains base64 string in header "MSIE" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "CLR1" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "3705" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "Host" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "Keep" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" Contains base64 string in header "MSIE" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org" Contains base64 string in header "CLR1" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org" Contains base64 string in header "3705" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org" Contains base64 string in header "Host" in header "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org" Contains base64 string in header "Keep" in header "GET /xml/64.124.12.162 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive"2e:T2b58,Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe" at offset 987700; code bytes = 30d0 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe" at offset 1079503; code bytes = 30d0 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe" at offset 17804; code bytes = 33c1 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe" at offset 17950; code bytes = 33c1 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe" at offset 41733; code bytes = 33c1 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe" at offset 65462; code bytes = 33c1 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe" at offset 66794; code bytes = 33c1 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe" at offset 67801; code bytes = 33c1 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe" at offset 67935; code bytes = 33c1 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe" at offset 68005; code bytes = 33c1 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe" at offset 151837; code bytes = 33c1 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe" at offset 205872; code bytes = 33c1 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe" at offset 213875; code bytes = 33c1 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe" at offset 342183; code bytes = 33c1 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe" at offset 684079; code bytes = 33c1 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe" at offset 999366; code bytes = 33c1 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe" at offset 1052445; code bytes = 33c1 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe" at offset 1103973; code bytes = 33c1 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe" at offset 18558; code bytes = 8030 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe" at offset 384927; code bytes = 8030 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe" at offset 385014; code bytes = 8030 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe" at offset 385079; code bytes = 8030 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe" at offset 416447; code bytes = 8030 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe" at offset 464287; code bytes = 8030 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe" at offset 464370; code bytes = 8030 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe" at offset 464431; code bytes = 8030 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe" at offset 820927; code bytes = 8030 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe" at offset 852324; code bytes = 8030 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe" at offset 1001392; code bytes = 8030 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe" at offset 1002402; code bytes = 8030 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe" at offset 1064189; code bytes = 8030 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe" at offset 1089706; code bytes = 8030 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe.bin" at offset 987700; code bytes = 30d0 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe.bin" at offset 1079503; code bytes = 30d0 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe.bin" at offset 17804; code bytes = 33c1 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe.bin" at offset 17950; code bytes = 33c1 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe.bin" at offset 41733; code bytes = 33c1 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe.bin" at offset 65462; code bytes = 33c1 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe.bin" at offset 66794; code bytes = 33c1 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe.bin" at offset 67801; code bytes = 33c1 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe.bin" at offset 67935; code bytes = 33c1 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe.bin" at offset 68005; code bytes = 33c1 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe.bin" at offset 151837; code bytes = 33c1 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe.bin" at offset 205872; code bytes = 33c1 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe.bin" at offset 213875; code bytes = 33c1 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe.bin" at offset 342183; code bytes = 33c1 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe.bin" at offset 684079; code bytes = 33c1 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe.bin" at offset 999366; code bytes = 33c1 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe.bin" at offset 1052445; code bytes = 33c1 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe.bin" at offset 1103973; code bytes = 33c1 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe.bin" at offset 18558; code bytes = 8030 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe.bin" at offset 384927; code bytes = 8030 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe.bin" at offset 385014; code bytes = 8030 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe.bin" at offset 385079; code bytes = 8030 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe.bin" at offset 416447; code bytes = 8030 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe.bin" at offset 464287; code bytes = 8030 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe.bin" at offset 464370; code bytes = 8030 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe.bin" at offset 464431; code bytes = 8030 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe.bin" at offset 820927; code bytes = 8030 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe.bin" at offset 852324; code bytes = 8030 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe.bin" at offset 1001392; code bytes = 8030 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe.bin" at offset 1002402; code bytes = 8030 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe.bin" at offset 1064189; code bytes = 8030 Found XOR loop in file "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe.bin" at offset 1089706; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 987700; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1079503; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 17804; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 17950; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 41733; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 65462; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 66794; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 67801; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 67935; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 68005; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 151837; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 205872; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 213875; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 342183; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 684079; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 999366; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1052445; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1103973; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 18558; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 384927; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 385014; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 385079; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 416447; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 464287; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 464370; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 464431; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 820927; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 852324; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1001392; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1002402; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1064189; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1089706; code bytes = 80302f:T16ae," HTTP/1.1 200 OK Date: Mon 04 May 2026 01:36:28 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org" Response ==> HTTP/1.1 200 OK Date: Mon 04 May 2026 01:36:28 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420....... "GET /xml/64.124.12.162 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive" Response ==> HTTP/1.1 200 OK Date: Mon 04 May 2026 01:36:29 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Server: cloudflare Accept-Ranges: bytes last-modified: Mon 04 May 2026 01:36:29 GMT Cache-Control: max-age=31536000 cf-cache-status: MISS Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=8JiKiXF7CiZR5Zy0JTwXQ8Ihd9Eif1acnaY%2FHzrOQ5%2FKm0vZ4cEO3YGXasIAT%2FjY7FKe3QGd%2B3SDD0YwMfgdE0Tjbdd9A8td5yw16ejHWmcX5PGXxNM2kCNR7LeraBrQAoHnpdKd"}]} CF-RAY: 9f63c659196bdf82-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C526573706F6E73653E0A093C49503E36342E3132342E31322E3136323C2F49503E0A093C436F756E747279436F64653E55533C2F436F756E747279436F6465....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org" Response ==> HTTP/1.1 200 OK Date: Mon 04 May 2026 01:36:29 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420....... "GET /xml/64.124.12.162 HTTP/1.1" Response ==> HTTP/1.1 200 OK Date: Mon 04 May 2026 01:36:30 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Server: cloudflare Age: 0 Accept-Ranges: bytes last-modified: Mon 04 May 2026 01:36:29 GMT Cache-Control: max-age=31536000 cf-cache-status: HIT Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=6gbKlRwrbg5U48sRBJpynPoJUYmUSMJg7OwlBM%2BztEYHOzxdFeQoCv1x37FpmJzoYFcVSu4EplmxvAq4FYeFG8QXMHEsUO0YWf0%2Fas5Pvz1lyE8iBC5Hns8%2FyXYHSBdi3JPy6Ogv"}]} CF-RAY: 9f63c65c181edf82-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C526573706F6E73653E0A093C49503E36342E3132342E31322E3136323C2F49503E0A093C436F756E747279436F64653E55533C2F436F756E747279436F6465....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org" Response ==> HTTP/1.1 200 OK Date: Mon 04 May 2026 01:36:30 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420....... "GET /xml/64.124.12.162 HTTP/1.1" Response ==> HTTP/1.1 200 OK Date: Mon 04 May 2026 01:36:30 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Server: cloudflare Age: 0 Accept-Ranges: bytes last-modified: Mon 04 May 2026 01:36:29 GMT Cache-Control: max-age=31536000 cf-cache-status: HIT Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=kVcYJFBd4ph83YfjY%2FfM0iyp%2BEyg8jNO2qyctmodCm%2Ba6xUxEoPhmMZr3wcH1YuT5KxhV4ScgZf%2BWOnzvw3S71azVX545mY6KGUuWmPDZV2ZUMmXfBFGaEMUuanL%2BvYP1wb%2BhDY3"}]} CF-RAY: 9f63c65e6db4df82-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C526573706F6E73653E0A093C49503E36342E3132342E31322E3136323C2F49503E0A093C436F756E747279436F64653E55533C2F436F756E747279436F6465....... "GET /xml/64.124.12.162 HTTP/1.1" Response ==> HTTP/1.1 200 OK Date: Mon 04 May 2026 01:36:30 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Server: cloudflare Age: 1 Accept-Ranges: bytes last-modified: Mon 04 May 2026 01:36:29 GMT Cache-Control: max-age=31536000 cf-cache-status: HIT Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=bpLRqIqnpmqhQf00U8a9%2BwSdzlAp1PQgVmHYgTfGlvM2LMayi82KMoI%2FcEEAzzEXxBl3qA9iRsHjKfqX6QKrdnJ9LI4McA86wTlb%2BfPLGKKJ%2FvA8n2EJVNJBGxbCUhYY%2FGj%2BTAYp"}]} CF-RAY: 9f63c6607a1cdf82-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C526573706F6E73653E0A093C49503E36342E3132342E31322E3136323C2F49503E0A093C436F756E747279436F64653E55533C2F436F756E747279436F6465....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org" Response ==> HTTP/1.1 200 OK Date: Mon 04 May 2026 01:36:32 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420....... "GET /xml/64.124.12.162 HTTP/1.1" Response ==> HTTP/1.1 200 OK Date: Mon 04 May 2026 01:36:32 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Server: cloudflare Age: 2 Accept-Ranges: bytes last-modified: Mon 04 May 2026 01:36:29 GMT Cache-Control: max-age=31536000 cf-cache-status: HIT Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=%2FjirADcbOWB3Awiie1cq17CYVJzrBm1WiCzoQ1nX6P%2FRzDioHpjMl6GLamQxK5P5AwIIDqOxS3o4jjBtNkxBJ591nlo9uNOKvd1jSVC90POyTXj9FrggFLJozE%2FPxAosY8LlAe5B"}]} CF-RAY: 9f63c6691cb1df82-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C526573706F6E73653E0A093C49503E36342E3132342E31322E3136323C2F49503E0A093C436F756E747279436F64653E55533C2F436F756E747279436F6465....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org" Response ==> HTTP/1.1 200 OK Date: Mon 04 May 2026 01:36:33 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420....... "GET /xml/64.124.12.162 HTTP/1.1" Response ==> HTTP/1.1 200 OK Date: Mon 04 May 2026 01:36:33 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Server: cloudflare Age: 3 Accept-Ranges: bytes last-modified: Mon 04 May 2026 01:36:29 GMT Cache-Control: max-age=31536000 cf-cache-status: HIT Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=dU5H9PDdDFkobi4VuKGmXKWYrNFw6M22aTrrkDqnc3SwqF6o%2BWDDen9dcQxPUuhARc49dxY78Du3GR9r1apw3nLeS4TSH9hVkFzUpuCS8A9wBxK4saWEXO8cy%2BXW6oPLZuK281dK"}]} CF-RAY: 9f63c671afbbdf82-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C526573706F6E73653E0A093C49503E36342E3132342E31322E3136323C2F49503E0A093C436F756E747279436F64653E55533C2F436F756E747279436F6465....... "GET /xml/64.124.12.162 HTTP/1.1" Response ==> HTTP/1.1 200 OK Date: Mon 04 May 2026 01:36:33 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Server: cloudflare Age: 4 Accept-Ranges: bytes last-modified: Mon 04 May 2026 01:36:29 GMT Cache-Control: max-age=31536000 cf-cache-status: HIT Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=iN%2Fh667xFrLaOQn9FZdHewAeNJiOxPce4vK8pLlFuqe71OQ%2Blb8qlzRmkuZQk%2FhgDKu%2B1yxaWwFxrpUkRrT0LeJ%2BJJkYApLbUWcH6CILpCY6cvdi%2BNyAviAu0rAyqGh2%2Bve5bJ9t"}]} CF-RAY: 9f63c673dc90df82-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C526573706F6E73653E0A093C49503E36342E3132342E31322E3136323C2F49503E0A093C436F756E747279436F64653E55533C2F436F756E747279436F6465....... "GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org" Response ==> HTTP/1.1 200 OK Date: Mon 04 May 2026 01:36:34 GMT Content-Type: text/html Content-Length: 105 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Access-Control-Allow-Origin: * with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420....... "GET /xml/64.124.12.162 HTTP/1.1" Response ==> HTTP/1.1 200 OK Date: Mon 04 May 2026 01:36:34 GMT Content-Type: text/xml Content-Length: 360 Connection: keep-alive Server: cloudflare Age: 4 Accept-Ranges: bytes last-modified: Mon 04 May 2026 01:36:29 GMT Cache-Control: max-age=31536000 cf-cache-status: HIT Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=cmgqGGyRmwGjcgXWYygozNpWAdsPqxNGVNOivtRMzGICEoEsoXPVTwkpGaxI5aXaUXNODRnVVKuAxmz9PbxXYtzzFfJ459%2Fu1tDYYl5tiEJTQ2X4MICQ0cSfgU2uBC448Ow6X2DK"}]} CF-RAY: 9f63c67619bcdf82-SJC alt-svc: h3=":443"; ma=86400 with response body ==>3C526573706F6E73653E0A093C49503E36342E3132342E31322E3136323C2F49503E0A093C436F756E747279436F64653E55533C2F436F756E747279436F6465.......33:T46a,"be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin" file has an entrypoint instructions - "sub rsp, 0x28,call 0x1400a7bbc,add rsp, 0x28,jmp 0x1400a737c,int3 ,int3 ,cmp edx, 2,jne 0x1400a7571,mov qword ptr [rsp + 8], rbx,push rdi,sub rsp, 0x20,mov ecx, dword ptr [rip + 0x45f4b],mov rax, qword ptr gs:[0x58],mov r8d, 0x120,mov rdx, qword ptr [rax + rcx*8],cmp byte ptr [rdx + r8], 1,je 0x1400a7567,mov byte ptr [rdx + r8], 1,lea rbx, [rip + 0x6019],lea rdi, [rip + 0x601a],jmp 0x1400a7562,mov rax, qword ptr [rbx],test rax, rax,je 0x1400a755e," "be06aab9e611d76a76f37a89cdef1df2ea59e591ff2654c8c679bfed0f7710bb.bin.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x1400a7bbc,add rsp, 0x28,jmp 0x1400a737c,int3 ,int3 ,cmp edx, 2,jne 0x1400a7571,mov qword ptr [rsp + 8], rbx,push rdi,sub rsp, 0x20,mov ecx, dword ptr [rip + 0x45f4b],mov rax, qword ptr gs:[0x58],mov r8d, 0x120,mov rdx, qword ptr [rax + rcx*8],cmp byte ptr [rdx + r8], 1,je 0x1400a7567,mov byte ptr [rdx + r8], 1,lea rbx, [rip + 0x6019],lea rdi, [rip + 0x601a],jmp 0x1400a7562,mov rax, qword ptr [rbx],test rax, rax,je 0x1400a755e,"34:T621,"