Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1559712
MD5:	64fae8982e9943f1f140dd0656989812
SHA1:	1b140805481dbef455b41d174e11766e23670185
SHA256:	4e32b7750d935b1eb8acdeaeb9c701e7a9b390be3c37db6769d520c000b66d42
Tags:	exeuser-Bitsight
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

AI detected suspicious sample

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Hides threads from debuggers

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to detect virtual machines (SIDT)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Enables debug privileges

Entry point lies outside standard sections

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6604 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 64FAE8982E9943F1F140DD0656989812)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00C0E30B CryptVerifySignatureA,

0_2_00C0E30B

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: file.exe, 00000000.00000003.2106625814.0000000004D60000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2239923237.0000000000A32000.00000040.00000001.01000000.00000003.sdmp

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3DDD2		0_2_00A3DDD2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A45E2E		0_2_00A45E2E

Source: file.exe, 00000000.00000000.2093200071.0000000000A36000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000002.2240770546.0000000000EEE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: classification engine

Classification label: mal100.evad.winEXE@1/1@0/0

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior

Source: file.exe

Static file information: File size 2768384 > 1048576

Source: file.exe

Static PE information: Raw size of fysdnnem is bigger than: 0x100000 < 0x29dc00

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.a30000.0.unpack :EW;.rsrc:W;.idata :W;fysdnnem:EW;nvcnsgcm:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x2b146b should be: 0x2acfe4

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: fysdnnem
Source: file.exe	Static PE information: section name: nvcnsgcm
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB22D7 push 40805B78h; mov dword ptr [esp], esi	0_2_00BB233C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB22D7 push 419A464Ah; mov dword ptr [esp], ebx	0_2_00BB2376
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB22D7 push eax; mov dword ptr [esp], esi	0_2_00BB2396
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB2442 push ebp; mov dword ptr [esp], edi	0_2_00BB245D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB2442 push 498688E8h; mov dword ptr [esp], eax	0_2_00BB24DB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C6C0C4 push edi; mov dword ptr [esp], eax	0_2_00C6C0F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C6C0C4 push eax; mov dword ptr [esp], 4EBF5F86h	0_2_00C6C0F5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BBE0BD push 777973E5h; mov dword ptr [esp], eax	0_2_00BBE0C3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BBE0BD push ecx; mov dword ptr [esp], ebx	0_2_00BC1525
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BBC0AF push ecx; mov dword ptr [esp], edx	0_2_00BBC0BF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB30A0 push ecx; mov dword ptr [esp], 632F1000h	0_2_00BB30D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB30A0 push 38458B6Bh; mov dword ptr [esp], edx	0_2_00BB3100
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB30A0 push 7B8C4F49h; mov dword ptr [esp], eax	0_2_00BB3155
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB80A6 push edi; mov dword ptr [esp], ebp	0_2_00BB8118
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB80A6 push 3C35B5A7h; mov dword ptr [esp], ecx	0_2_00BB8151
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB80A6 push eax; mov dword ptr [esp], 7FEF320Bh	0_2_00BB817B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB80A6 push edx; mov dword ptr [esp], 6D5C8DFAh	0_2_00BB819F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB80A6 push 5408CA80h; mov dword ptr [esp], esi	0_2_00BB81C3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB80A6 push 02EBE593h; mov dword ptr [esp], ebp	0_2_00BB81E1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB80A6 push eax; mov dword ptr [esp], ecx	0_2_00BB8208
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C780EF push 34C5E444h; mov dword ptr [esp], ecx	0_2_00C78136
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BAF092 push 3276B800h; mov dword ptr [esp], ebp	0_2_00BAF3D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB3090 push ecx; mov dword ptr [esp], 632F1000h	0_2_00BB30D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB3090 push 38458B6Bh; mov dword ptr [esp], edx	0_2_00BB3100
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB3090 push 7B8C4F49h; mov dword ptr [esp], eax	0_2_00BB3155
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BBE08B push esi; mov dword ptr [esp], 08DEAB75h	0_2_00BC2792
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB40F8 push ebp; mov dword ptr [esp], 2CFDDE64h	0_2_00CB4117
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB80F6 push edi; mov dword ptr [esp], ebp	0_2_00BB8118
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB80F6 push 3C35B5A7h; mov dword ptr [esp], ecx	0_2_00BB8151
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB80F6 push eax; mov dword ptr [esp], 7FEF320Bh	0_2_00BB817B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BB80F6 push edx; mov dword ptr [esp], 6D5C8DFAh	0_2_00BB819F

Source: file.exe

Static PE information: section name: entropy: 7.800415560775893

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB30B6 second address: BB30BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB30BE second address: BB30C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA8170 second address: BA8188 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F5C74B78B0Eh 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB216F second address: BB2181 instructions: 0x00000000 rdtsc 0x00000002 js 00007F5C74F50626h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007F5C74F50632h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB2181 second address: BB218E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F5C74B78B06h 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB22E2 second address: BB2307 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jc 00007F5C74F5064Bh 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F5C74F50635h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB5780 second address: BB57A4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F5C74B78B15h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB57A4 second address: BB57F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov ecx, dword ptr [ebp+122D2DD8h] 0x00000011 ja 00007F5C74F5062Ch 0x00000017 push 00000000h 0x00000019 mov ecx, dword ptr [ebp+122D2B74h] 0x0000001f push A48E2B3Dh 0x00000024 pushad 0x00000025 push eax 0x00000026 je 00007F5C74F50626h 0x0000002c pop eax 0x0000002d pushad 0x0000002e jmp 00007F5C74F50636h 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB57F0 second address: BB584F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 add dword ptr [esp], 5B71D543h 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007F5C74B78B08h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 00000015h 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 mov dword ptr [ebp+122D250Fh], esi 0x0000002d push 00000003h 0x0000002f xor dword ptr [ebp+122D36CFh], ecx 0x00000035 push 00000000h 0x00000037 jo 00007F5C74B78B0Bh 0x0000003d mov ecx, 62F0CF1Fh 0x00000042 push 00000003h 0x00000044 mov dword ptr [ebp+122D250Fh], eax 0x0000004a call 00007F5C74B78B09h 0x0000004f pushad 0x00000050 jl 00007F5C74B78B0Ch 0x00000056 push eax 0x00000057 push edx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB584F second address: BB5856 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB5856 second address: BB5895 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 jne 00007F5C74B78B1Bh 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 jmp 00007F5C74B78B15h 0x00000019 pop esi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB59C4 second address: BB59C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB59C8 second address: BB5A81 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a or cx, 4143h 0x0000000f push 00000000h 0x00000011 jmp 00007F5C74B78B13h 0x00000016 push 99BA7508h 0x0000001b jmp 00007F5C74B78B0Ch 0x00000020 add dword ptr [esp], 66458B78h 0x00000027 jmp 00007F5C74B78B0Fh 0x0000002c mov ecx, dword ptr [ebp+122D2D24h] 0x00000032 push 00000003h 0x00000034 jns 00007F5C74B78B0Ch 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push ecx 0x0000003f call 00007F5C74B78B08h 0x00000044 pop ecx 0x00000045 mov dword ptr [esp+04h], ecx 0x00000049 add dword ptr [esp+04h], 00000018h 0x00000051 inc ecx 0x00000052 push ecx 0x00000053 ret 0x00000054 pop ecx 0x00000055 ret 0x00000056 push 00000003h 0x00000058 jmp 00007F5C74B78B0Ch 0x0000005d call 00007F5C74B78B09h 0x00000062 pushad 0x00000063 je 00007F5C74B78B0Ch 0x00000069 ja 00007F5C74B78B06h 0x0000006f push edi 0x00000070 jnl 00007F5C74B78B06h 0x00000076 pop edi 0x00000077 popad 0x00000078 push eax 0x00000079 push eax 0x0000007a push edx 0x0000007b push eax 0x0000007c push edx 0x0000007d js 00007F5C74B78B06h 0x00000083 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB5A81 second address: BB5A85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB5A85 second address: BB5A8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB5A8B second address: BB5A91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB5A91 second address: BB5AA7 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5C74B78B06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push ebx 0x00000011 pushad 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB5AA7 second address: BB5AB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB5AB5 second address: BB5ABF instructions: 0x00000000 rdtsc 0x00000002 jo 00007F5C74B78B06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB5ABF second address: BB5AF3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C74F50633h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F5C74F50635h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB5AF3 second address: BB5AF9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB5AF9 second address: BB5AFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB5AFF second address: BB5B45 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5C74B78B06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d movzx esi, si 0x00000010 lea ebx, dword ptr [ebp+1244B69Ch] 0x00000016 push 00000000h 0x00000018 push ebp 0x00000019 call 00007F5C74B78B08h 0x0000001e pop ebp 0x0000001f mov dword ptr [esp+04h], ebp 0x00000023 add dword ptr [esp+04h], 0000001Dh 0x0000002b inc ebp 0x0000002c push ebp 0x0000002d ret 0x0000002e pop ebp 0x0000002f ret 0x00000030 push eax 0x00000031 push eax 0x00000032 push edx 0x00000033 jnc 00007F5C74B78B08h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB5B90 second address: BB5B94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB5B94 second address: BB5B9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB5B9A second address: BB5BE1 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5C74F5062Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007F5C74F50628h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 0000001Bh 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 adc si, 3E72h 0x0000002a push 00000000h 0x0000002c mov dl, al 0x0000002e push D2A08F73h 0x00000033 push ebx 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB5BE1 second address: BB5BE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB5BE5 second address: BB5C80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 add dword ptr [esp], 2D5F710Dh 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007F5C74F50628h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 00000015h 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 call 00007F5C74F50637h 0x0000002d mov dword ptr [ebp+122D36CFh], edi 0x00000033 pop ecx 0x00000034 ja 00007F5C74F5062Ch 0x0000003a push 00000003h 0x0000003c mov dh, B1h 0x0000003e push 00000000h 0x00000040 movsx ecx, si 0x00000043 push 00000003h 0x00000045 xor dword ptr [ebp+122D36CFh], ecx 0x0000004b push A6456CBCh 0x00000050 pushad 0x00000051 push edi 0x00000052 push ebx 0x00000053 pop ebx 0x00000054 pop edi 0x00000055 jmp 00007F5C74F50631h 0x0000005a popad 0x0000005b add dword ptr [esp], 19BA9344h 0x00000062 mov esi, dword ptr [ebp+122D2DC8h] 0x00000068 lea ebx, dword ptr [ebp+1244B6A7h] 0x0000006e xchg eax, ebx 0x0000006f push edi 0x00000070 push eax 0x00000071 push edx 0x00000072 pushad 0x00000073 popad 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD3168 second address: BD3199 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5C74B78B15h 0x00000009 popad 0x0000000a push ecx 0x0000000b jmp 00007F5C74B78B14h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD3432 second address: BD343D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F5C74F50626h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD343D second address: BD3449 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F5C74B78B06h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD3449 second address: BD3457 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F5C74F5062Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD35D7 second address: BD35F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C74B78B15h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD3749 second address: BD374D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD374D second address: BD3775 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5C74B78B18h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e jp 00007F5C74B78B06h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD3A36 second address: BD3A5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5C74F5062Eh 0x00000009 popad 0x0000000a push ecx 0x0000000b jmp 00007F5C74F5062Eh 0x00000010 pop ecx 0x00000011 push edi 0x00000012 pushad 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD3A5F second address: BD3A67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD3CE4 second address: BD3CE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD3CE8 second address: BD3CF2 instructions: 0x00000000 rdtsc 0x00000002 js 00007F5C74B78B06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD3CF2 second address: BD3D34 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C74F5062Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jnl 00007F5C74F5062Eh 0x00000010 pushad 0x00000011 popad 0x00000012 jno 00007F5C74F50626h 0x00000018 pushad 0x00000019 push esi 0x0000001a pop esi 0x0000001b pushad 0x0000001c popad 0x0000001d jnp 00007F5C74F50626h 0x00000023 popad 0x00000024 pushad 0x00000025 jng 00007F5C74F50626h 0x0000002b jmp 00007F5C74F50630h 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD3E6B second address: BD3E91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F5C74B78B0Ch 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d je 00007F5C74B78B12h 0x00000013 jg 00007F5C74B78B06h 0x00000019 jo 00007F5C74B78B06h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD414C second address: BD4150 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD4150 second address: BD4154 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD4154 second address: BD4164 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F5C74F50632h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD42C0 second address: BD42D0 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5C74B78B06h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD43EE second address: BD43F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD43F2 second address: BD43FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD4B08 second address: BD4B0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD4B0C second address: BD4B12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD4B12 second address: BD4B22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jns 00007F5C74F50626h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD4CA5 second address: BD4CAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD4DC4 second address: BD4DC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD4DC8 second address: BD4DCE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDC261 second address: BDC26E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDC26E second address: BDC284 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jng 00007F5C74B78B06h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDC284 second address: BDC2B8 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5C74F50628h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c jmp 00007F5C74F5062Dh 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F5C74F50633h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDB40F second address: BDB413 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA303E second address: BA3044 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA3044 second address: BA3048 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA3048 second address: BA304C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDFF92 second address: BDFFA0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jg 00007F5C74B78B06h 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDFFA0 second address: BDFFC7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jp 00007F5C74F50626h 0x00000009 jmp 00007F5C74F50631h 0x0000000e pop edx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 je 00007F5C74F5063Dh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDFFC7 second address: BDFFDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5C74B78B11h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDFFDC second address: BDFFE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F5C74F50626h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BDFFE8 second address: BDFFEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE0132 second address: BE013C instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5C74F50626h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE013C second address: BE0145 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE0668 second address: BE066C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE066C second address: BE0672 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE3771 second address: BE3775 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE3775 second address: BE3779 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE37E0 second address: BE37FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C74F50634h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE37FB second address: BE382E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F5C74B78B06h 0x0000000a popad 0x0000000b popad 0x0000000c xor dword ptr [esp], 3CEA60C7h 0x00000013 jmp 00007F5C74B78B0Ch 0x00000018 sub dword ptr [ebp+1244BD27h], edi 0x0000001e call 00007F5C74B78B09h 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 push ebx 0x00000027 pop ebx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE382E second address: BE3875 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 jmp 00007F5C74F50639h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 jmp 00007F5C74F5062Dh 0x00000016 mov eax, dword ptr [eax] 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push esi 0x0000001e push eax 0x0000001f pop eax 0x00000020 pop esi 0x00000021 popad 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 push esi 0x00000027 push eax 0x00000028 push edx 0x00000029 push esi 0x0000002a pop esi 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE3A7D second address: BE3A8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007F5C74B78B06h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE3A8A second address: BE3AA6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C74F50631h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE3AA6 second address: BE3AAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE3AAB second address: BE3AB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F5C74F50626h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE3C01 second address: BE3C06 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE4271 second address: BE4277 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE44A6 second address: BE44AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE44AA second address: BE44BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a jl 00007F5C74F50626h 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE44BB second address: BE44C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F5C74B78B06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE4778 second address: BE4782 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F5C74F50626h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE4782 second address: BE4786 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE491B second address: BE491F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE4E78 second address: BE4EEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5C74B78B0Dh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push edi 0x00000015 call 00007F5C74B78B08h 0x0000001a pop edi 0x0000001b mov dword ptr [esp+04h], edi 0x0000001f add dword ptr [esp+04h], 00000018h 0x00000027 inc edi 0x00000028 push edi 0x00000029 ret 0x0000002a pop edi 0x0000002b ret 0x0000002c and esi, 70C6D0F5h 0x00000032 push 00000000h 0x00000034 jbe 00007F5C74B78B07h 0x0000003a xchg eax, ebx 0x0000003b jmp 00007F5C74B78B0Ch 0x00000040 push eax 0x00000041 push eax 0x00000042 push edx 0x00000043 push ecx 0x00000044 jmp 00007F5C74B78B19h 0x00000049 pop ecx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE5846 second address: BE584A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE584A second address: BE584E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE7F4B second address: BE7F50 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE7F50 second address: BE7FA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007F5C74B78B08h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 00000017h 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 or dword ptr [ebp+122D27ADh], ecx 0x00000028 mov esi, dword ptr [ebp+122D3704h] 0x0000002e push 00000000h 0x00000030 jng 00007F5C74B78B0Ch 0x00000036 sub esi, 3A1C78C5h 0x0000003c push 00000000h 0x0000003e push eax 0x0000003f clc 0x00000040 pop edi 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 jne 00007F5C74B78B08h 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE7FA1 second address: BE7FA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEAD60 second address: BEAD65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEAD65 second address: BEAD7D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5C74F50634h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEAD7D second address: BEAD8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEAD8D second address: BEAD92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEB7F8 second address: BEB7FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEF56A second address: BEF580 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C74F50632h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEE7AF second address: BEE7B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF04A5 second address: BF04A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEF6FB second address: BEF700 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF04A9 second address: BF04AF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF04AF second address: BF04B4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEF7A1 second address: BEF7A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF1443 second address: BF1447 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF1447 second address: BF144D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF23F5 second address: BF23FB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF23FB second address: BF2459 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F5C74F5063Ch 0x00000008 jmp 00007F5C74F50636h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp], eax 0x00000012 mov edi, dword ptr [ebp+122D1FB6h] 0x00000018 push 00000000h 0x0000001a mov dword ptr [ebp+122D38A1h], edi 0x00000020 push 00000000h 0x00000022 push 00000000h 0x00000024 push ebx 0x00000025 call 00007F5C74F50628h 0x0000002a pop ebx 0x0000002b mov dword ptr [esp+04h], ebx 0x0000002f add dword ptr [esp+04h], 00000018h 0x00000037 inc ebx 0x00000038 push ebx 0x00000039 ret 0x0000003a pop ebx 0x0000003b ret 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 jp 00007F5C74F50626h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF2459 second address: BF245F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF6576 second address: BF6617 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F5C74F50636h 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007F5C74F50638h 0x00000012 jp 00007F5C74F50628h 0x00000018 popad 0x00000019 nop 0x0000001a mov dword ptr [ebp+122D2691h], edi 0x00000020 push 00000000h 0x00000022 push 00000000h 0x00000024 push eax 0x00000025 call 00007F5C74F50628h 0x0000002a pop eax 0x0000002b mov dword ptr [esp+04h], eax 0x0000002f add dword ptr [esp+04h], 0000001Bh 0x00000037 inc eax 0x00000038 push eax 0x00000039 ret 0x0000003a pop eax 0x0000003b ret 0x0000003c push ecx 0x0000003d sub dword ptr [ebp+122D2726h], ebx 0x00000043 pop ebx 0x00000044 push 00000000h 0x00000046 push 00000000h 0x00000048 push ebp 0x00000049 call 00007F5C74F50628h 0x0000004e pop ebp 0x0000004f mov dword ptr [esp+04h], ebp 0x00000053 add dword ptr [esp+04h], 0000001Dh 0x0000005b inc ebp 0x0000005c push ebp 0x0000005d ret 0x0000005e pop ebp 0x0000005f ret 0x00000060 mov bh, 52h 0x00000062 xchg eax, esi 0x00000063 pushad 0x00000064 pushad 0x00000065 push eax 0x00000066 push edx 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF6617 second address: BF664E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F5C74B78B06h 0x0000000a popad 0x0000000b pushad 0x0000000c jg 00007F5C74B78B06h 0x00000012 jmp 00007F5C74B78B14h 0x00000017 popad 0x00000018 popad 0x00000019 push eax 0x0000001a jo 00007F5C74B78B12h 0x00000020 jp 00007F5C74B78B0Ch 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF76C6 second address: BF772D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007F5C74F50628h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 0000001Bh 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 mov ebx, ecx 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push edi 0x0000002b call 00007F5C74F50628h 0x00000030 pop edi 0x00000031 mov dword ptr [esp+04h], edi 0x00000035 add dword ptr [esp+04h], 0000001Ah 0x0000003d inc edi 0x0000003e push edi 0x0000003f ret 0x00000040 pop edi 0x00000041 ret 0x00000042 push 00000000h 0x00000044 jns 00007F5C74F5062Ch 0x0000004a push eax 0x0000004b push edi 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF772D second address: BF7731 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF7731 second address: BF7735 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFA6B5 second address: BFA6E4 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5C74B78B0Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c jmp 00007F5C74B78B17h 0x00000011 push esi 0x00000012 pop esi 0x00000013 push edx 0x00000014 pop edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF78FA second address: BF78FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF6782 second address: BF6788 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF6788 second address: BF678D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF678D second address: BF67A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5C74B78B13h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BF688A second address: BF68AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C74F50635h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007F5C74F50626h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFC582 second address: BFC588 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFE313 second address: BFE39E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F5C74F50626h 0x00000009 jmp 00007F5C74F5062Dh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push eax 0x00000015 call 00007F5C74F50628h 0x0000001a pop eax 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f add dword ptr [esp+04h], 0000001Dh 0x00000027 inc eax 0x00000028 push eax 0x00000029 ret 0x0000002a pop eax 0x0000002b ret 0x0000002c mov bx, 62B2h 0x00000030 push 00000000h 0x00000032 pushad 0x00000033 mov dword ptr [ebp+124455B2h], edx 0x00000039 mov dword ptr [ebp+122D2720h], edi 0x0000003f popad 0x00000040 push 00000000h 0x00000042 jnc 00007F5C74F5062Ah 0x00000048 xchg eax, esi 0x00000049 jmp 00007F5C74F50637h 0x0000004e push eax 0x0000004f pushad 0x00000050 push ebx 0x00000051 jmp 00007F5C74F5062Dh 0x00000056 pop ebx 0x00000057 pushad 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFC588 second address: BFC59F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F5C74B78B0Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD606 second address: BFD60A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD60A second address: BFD60E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFF337 second address: BFF33C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFE54D second address: BFE551 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFE551 second address: BFE557 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C001D5 second address: C001D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C001D9 second address: C0026D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push ebx 0x00000009 jc 00007F5C74F50628h 0x0000000f pop ebx 0x00000010 nop 0x00000011 mov bx, BDA5h 0x00000015 xor dword ptr [ebp+122D268Ch], ebx 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push eax 0x00000020 call 00007F5C74F50628h 0x00000025 pop eax 0x00000026 mov dword ptr [esp+04h], eax 0x0000002a add dword ptr [esp+04h], 0000001Ch 0x00000032 inc eax 0x00000033 push eax 0x00000034 ret 0x00000035 pop eax 0x00000036 ret 0x00000037 jmp 00007F5C74F50637h 0x0000003c push 00000000h 0x0000003e push 00000000h 0x00000040 push eax 0x00000041 call 00007F5C74F50628h 0x00000046 pop eax 0x00000047 mov dword ptr [esp+04h], eax 0x0000004b add dword ptr [esp+04h], 00000016h 0x00000053 inc eax 0x00000054 push eax 0x00000055 ret 0x00000056 pop eax 0x00000057 ret 0x00000058 mov ebx, edx 0x0000005a push eax 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e push edx 0x0000005f jmp 00007F5C74F50633h 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0026D second address: C00273 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0238C second address: C023A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5C74F50635h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C023A5 second address: C023A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C07F06 second address: C07F13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAD0AF second address: BAD0CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5C74B78B16h 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAD0CA second address: BAD0EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C74F50638h 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C07654 second address: C0765C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0765C second address: C07660 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C07660 second address: C07675 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C74B78B11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C15B26 second address: C15B68 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C74F50636h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edi 0x0000000b js 00007F5C74F5062Ch 0x00000011 pop edi 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F5C74F50633h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C15B68 second address: C15B7A instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5C74B78B08h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push edx 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C15B7A second address: C15B96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d jmp 00007F5C74F5062Eh 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1C9D6 second address: C1C9ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 js 00007F5C74B78B06h 0x0000000d push edx 0x0000000e pop edx 0x0000000f pop edi 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push edi 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1C9ED second address: C1C9F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jno 00007F5C74F50626h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA14F5 second address: BA14F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA14F9 second address: BA153D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5C74F50638h 0x00000008 jmp 00007F5C74F5062Eh 0x0000000d push eax 0x0000000e pop eax 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F5C74F50636h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1B6BB second address: C1B6C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1B6C0 second address: C1B6C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1BDD7 second address: C1BE01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jnp 00007F5C74B78B06h 0x0000000c jmp 00007F5C74B78B17h 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1BF40 second address: C1BF52 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F5C74F5062Ch 0x00000008 jns 00007F5C74F50626h 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1BF52 second address: C1BF56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1C2B0 second address: C1C2B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1C2B4 second address: C1C2EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jns 00007F5C74B78B06h 0x0000000d jng 00007F5C74B78B06h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 pushad 0x0000001a popad 0x0000001b jmp 00007F5C74B78B19h 0x00000020 jo 00007F5C74B78B06h 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1C2EF second address: C1C2F6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1C42A second address: C1C430 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1C6FA second address: C1C721 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F5C74F50626h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F5C74F50639h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1C721 second address: C1C725 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C21F09 second address: C21F2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F5C74F50626h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push edx 0x0000000e jmp 00007F5C74F50630h 0x00000013 push eax 0x00000014 pop eax 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C21F2A second address: C21F51 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5C74B78B0Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F5C74B78B17h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C21F51 second address: C21F55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE1F6F second address: BE1F7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE1F7D second address: BE1F82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE1F82 second address: BE1F88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE1F88 second address: BE1FA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov ecx, 0E8622D6h 0x0000000e lea eax, dword ptr [ebp+12477CBCh] 0x00000014 xor di, 9E5Dh 0x00000019 nop 0x0000001a push eax 0x0000001b push edx 0x0000001c push ebx 0x0000001d pushad 0x0000001e popad 0x0000001f pop ebx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE1FA8 second address: BC895C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C74B78B12h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jc 00007F5C74B78B1Ah 0x00000010 pushad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 jmp 00007F5C74B78B10h 0x00000018 popad 0x00000019 nop 0x0000001a call dword ptr [ebp+122D362Dh] 0x00000020 jmp 00007F5C74B78B17h 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F5C74B78B11h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE2048 second address: BE204C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE204C second address: BE2052 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE250A second address: A3DC94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007F5C74F50628h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 00000015h 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 push dword ptr [ebp+122D0FB5h] 0x00000029 mov ecx, dword ptr [ebp+122D1D9Ah] 0x0000002f call dword ptr [ebp+122D36D4h] 0x00000035 pushad 0x00000036 clc 0x00000037 xor eax, eax 0x00000039 mov dword ptr [ebp+122D35E0h], ebx 0x0000003f mov edx, dword ptr [esp+28h] 0x00000043 mov dword ptr [ebp+122D35E0h], ebx 0x00000049 mov dword ptr [ebp+122D2C74h], eax 0x0000004f jbe 00007F5C74F5062Dh 0x00000055 mov esi, 0000003Ch 0x0000005a stc 0x0000005b add esi, dword ptr [esp+24h] 0x0000005f mov dword ptr [ebp+122D266Ch], eax 0x00000065 lodsw 0x00000067 pushad 0x00000068 pushad 0x00000069 mov ch, dl 0x0000006b mov ebx, ecx 0x0000006d popad 0x0000006e sub dword ptr [ebp+122D266Ch], ecx 0x00000074 popad 0x00000075 add eax, dword ptr [esp+24h] 0x00000079 jmp 00007F5C74F5062Dh 0x0000007e mov ebx, dword ptr [esp+24h] 0x00000082 sub dword ptr [ebp+122D35E0h], eax 0x00000088 push eax 0x00000089 push eax 0x0000008a push eax 0x0000008b push eax 0x0000008c push edx 0x0000008d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE2733 second address: BE2739 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE2739 second address: BE273E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE28D8 second address: BE28DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE28DE second address: BE2918 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5C74F50626h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F5C74F50636h 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 jng 00007F5C74F5063Dh 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F5C74F5062Bh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE2918 second address: BE291C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE291C second address: BE292C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push edx 0x0000000e pop edx 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE2BA7 second address: BE2BCB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C74B78B15h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d jnl 00007F5C74B78B06h 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE30A2 second address: BE30A8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE329F second address: BE32A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE32A5 second address: BE32CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jg 00007F5C74F50632h 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE32CC second address: BE32D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE32D0 second address: BE32D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE32D4 second address: BE32DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE32DA second address: BE32DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE32DF second address: BE32FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c jmp 00007F5C74B78B0Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 jc 00007F5C74B78B06h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2223D second address: C22242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C22242 second address: C2224D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnp 00007F5C74B78B06h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C22567 second address: C2257D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C74F50632h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2284C second address: C22850 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C22850 second address: C22860 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jc 00007F5C74F5062Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C22860 second address: C22867 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C22867 second address: C2288C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F5C74F50626h 0x0000000a popad 0x0000000b push ebx 0x0000000c jns 00007F5C74F50626h 0x00000012 pop ebx 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 jng 00007F5C74F50626h 0x0000001d je 00007F5C74F50626h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2288C second address: C22891 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C279DA second address: C279E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C27150 second address: C27176 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C74B78B0Ch 0x00000007 jmp 00007F5C74B78B0Ah 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 jc 00007F5C74B78B06h 0x00000017 push eax 0x00000018 pop eax 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C27176 second address: C2717C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2717C second address: C27180 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C27180 second address: C27198 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F5C74F5062Ah 0x0000000d je 00007F5C74F50626h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C27198 second address: C2719C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C27E0D second address: C27E11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C27E11 second address: C27E24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5C74B78B0Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C27E24 second address: C27E6F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C74F50630h 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jnl 00007F5C74F50626h 0x00000010 pop edx 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push edi 0x00000016 pushad 0x00000017 popad 0x00000018 pop edi 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F5C74F5062Eh 0x00000020 jmp 00007F5C74F50637h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C27E6F second address: C27E77 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C27E77 second address: C27E7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C27E7F second address: C27E8F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F5C74B78B24h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9E0B0 second address: B9E0B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9E0B4 second address: B9E0CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5C74B78B11h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9E0CB second address: B9E0D8 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F5C74F50628h 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9E0D8 second address: B9E0DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9E0DE second address: B9E0FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jl 00007F5C74F50626h 0x00000013 popad 0x00000014 je 00007F5C74F5062Eh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2CF18 second address: C2CF20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2CF20 second address: C2CF24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2CF24 second address: C2CF32 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2CF32 second address: C2CF36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C32377 second address: C3237E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3237E second address: C3238A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3238A second address: C32390 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C32625 second address: C3262F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 pop eax 0x00000007 push edi 0x00000008 pop edi 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3262F second address: C32657 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C74B78B19h 0x00000007 push ecx 0x00000008 jmp 00007F5C74B78B0Ah 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3290F second address: C32915 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C32915 second address: C3293E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 ja 00007F5C74B78B06h 0x0000000c push edi 0x0000000d pop edi 0x0000000e jmp 00007F5C74B78B0Bh 0x00000013 push edx 0x00000014 pop edx 0x00000015 popad 0x00000016 pushad 0x00000017 jnp 00007F5C74B78B06h 0x0000001d push ecx 0x0000001e pop ecx 0x0000001f push eax 0x00000020 pop eax 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C32A63 second address: C32AAE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F5C74F50632h 0x0000000c pop eax 0x0000000d jmp 00007F5C74F50634h 0x00000012 popad 0x00000013 pushad 0x00000014 jmp 00007F5C74F50635h 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C32AAE second address: C32AB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C32AB2 second address: C32AD8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C74F5062Ah 0x00000007 jg 00007F5C74F50626h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F5C74F50630h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C32C4F second address: C32C55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C32D8D second address: C32DA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F5C74F5062Ah 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C32DA5 second address: C32DC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F5C74B78B14h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C34FED second address: C34FF8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jl 00007F5C74F50626h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3AADF second address: C3AAE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3AAE5 second address: C3AAF9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C74F50630h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3A4FE second address: C3A502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3A837 second address: C3A847 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5C74F50626h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c pop eax 0x0000000d push edx 0x0000000e pop edx 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C41D08 second address: C41D22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jns 00007F5C74B78B06h 0x0000000d ja 00007F5C74B78B06h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C41D22 second address: C41D28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C41D28 second address: C41D2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C41D2C second address: C41D49 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5C74F50626h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jns 00007F5C74F5062Eh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C41D49 second address: C41D4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C41F98 second address: C41F9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C41F9E second address: C41FA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4213F second address: C4214B instructions: 0x00000000 rdtsc 0x00000002 jl 00007F5C74F50626h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4214B second address: C42158 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F5C74B78B06h 0x00000009 push edi 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C422A3 second address: C422A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C463CF second address: C463D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C463D5 second address: C463E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 jne 00007F5C74F50626h 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C463E8 second address: C463EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C463EE second address: C463F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4680E second address: C46818 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F5C74B78B06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4696A second address: C46989 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jl 00007F5C74F50626h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F5C74F5062Eh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C49EB2 second address: C49EBE instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5C74B78B06h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C506E5 second address: C506FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C74F50631h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C50C97 second address: C50CA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jo 00007F5C74B78B06h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C50CA3 second address: C50CBA instructions: 0x00000000 rdtsc 0x00000002 jp 00007F5C74F50626h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F5C74F5062Bh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C50CBA second address: C50CBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C50F83 second address: C50F87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C50F87 second address: C50F8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C50F8B second address: C50FAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007F5C74F50628h 0x0000000e pushad 0x0000000f jne 00007F5C74F50626h 0x00000015 pushad 0x00000016 popad 0x00000017 jno 00007F5C74F50626h 0x0000001d push edi 0x0000001e pop edi 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C51810 second address: C5181F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jbe 00007F5C74B78B06h 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5181F second address: C51830 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5C74F50626h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C51830 second address: C51836 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C51DAC second address: C51DD2 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5C74F5063Fh 0x00000008 jmp 00007F5C74F50637h 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C51DD2 second address: C51DFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jno 00007F5C74B78B1Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C51DFA second address: C51E00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C51E00 second address: C51E04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C56C51 second address: C56C60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5C74F5062Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C56C60 second address: C56C6D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C56C6D second address: C56CEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F5C74F50632h 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pop edx 0x0000000f popad 0x00000010 pushad 0x00000011 push esi 0x00000012 jmp 00007F5C74F50631h 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 pop esi 0x0000001a jnl 00007F5C74F50637h 0x00000020 pushad 0x00000021 jmp 00007F5C74F50639h 0x00000026 jnp 00007F5C74F50626h 0x0000002c jmp 00007F5C74F5062Fh 0x00000031 popad 0x00000032 push eax 0x00000033 push edx 0x00000034 jne 00007F5C74F50626h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C55F7C second address: C55F86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F5C74B78B06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C560E5 second address: C560F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5C74F5062Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C560F5 second address: C560F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C56255 second address: C56259 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C563B8 second address: C563BD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5669F second address: C566B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C74F5062Fh 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C566B4 second address: C566BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F5C74B78B06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C566BE second address: C566C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C566C2 second address: C566EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F5C74B78B06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ecx 0x0000000f jmp 00007F5C74B78B17h 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C566EC second address: C566F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C566F2 second address: C566F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5685E second address: C56870 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5C74F5062Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C64AD3 second address: C64AD9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C62CD9 second address: C62CDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C62CDD second address: C62CFD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F5C74B78B18h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C62CFD second address: C62D15 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F5C74F50626h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F5C74F5062Ah 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C62D15 second address: C62D19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C63132 second address: C63160 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5C74F50636h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F5C74F5062Ch 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C632ED second address: C632F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C632F4 second address: C6331E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F5C74F50639h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007F5C74F50628h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C63462 second address: C6347E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F5C74B78B15h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6389F second address: C638AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C63B1A second address: C63B37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5C74B78B19h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C63B37 second address: C63B52 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C74F50637h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C64931 second address: C6493B instructions: 0x00000000 rdtsc 0x00000002 jo 00007F5C74B78B06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6493B second address: C64941 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6282E second address: C6285B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F5C74B78B11h 0x0000000a pop ecx 0x0000000b jmp 00007F5C74B78B0Fh 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push esi 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6285B second address: C62861 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C62861 second address: C62865 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6A519 second address: C6A586 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F5C74F50630h 0x00000008 pop esi 0x00000009 jno 00007F5C74F5062Ah 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 jno 00007F5C74F50636h 0x00000018 pushad 0x00000019 jmp 00007F5C74F50639h 0x0000001e pushad 0x0000001f popad 0x00000020 jmp 00007F5C74F50638h 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6A586 second address: C6A591 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6A591 second address: C6A595 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6A595 second address: C6A599 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6A599 second address: C6A59F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C78479 second address: C7847D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7847D second address: C784BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F5C74F50626h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c ja 00007F5C74F50628h 0x00000012 pop edi 0x00000013 push ecx 0x00000014 jne 00007F5C74F50632h 0x0000001a pushad 0x0000001b jmp 00007F5C74F50637h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C77E81 second address: C77E85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C77E85 second address: C77EA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jmp 00007F5C74F50637h 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7B603 second address: C7B62E instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5C74B78B06h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F5C74B78B13h 0x00000011 pop esi 0x00000012 jg 00007F5C74B78B36h 0x00000018 pushad 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7B62E second address: C7B634 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7B77B second address: C7B78F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5C74B78B0Eh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7B78F second address: C7B79F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F5C74F5062Bh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C832F2 second address: C8330F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 ja 00007F5C74B78B06h 0x0000000c popad 0x0000000d jne 00007F5C74B78B10h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8330F second address: C83314 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C87F10 second address: C87F1A instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5C74B78B06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8F4E7 second address: C8F51B instructions: 0x00000000 rdtsc 0x00000002 js 00007F5C74F50632h 0x00000008 jns 00007F5C74F50626h 0x0000000e jg 00007F5C74F50626h 0x00000014 jmp 00007F5C74F50637h 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push ebx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 push ebx 0x00000021 pop ebx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8F51B second address: C8F51F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C95C83 second address: C95C89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C95C89 second address: C95C99 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jo 00007F5C74B78B06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C946F7 second address: C94709 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5C74F5062Ch 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9487F second address: C94883 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C94883 second address: C94891 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C74F5062Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C94A00 second address: C94A0A instructions: 0x00000000 rdtsc 0x00000002 je 00007F5C74B78B06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C94A0A second address: C94A10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C94A10 second address: C94A2E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F5C74B78B0Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007F5C74B78B0Ah 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C94E34 second address: C94E47 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C74F5062Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C959BF second address: C959C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C993A5 second address: C993D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5C74F5062Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F5C74F50634h 0x0000000f push eax 0x00000010 pushad 0x00000011 popad 0x00000012 push edx 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9FF8E second address: C9FFA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F5C74B78B12h 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9FFA8 second address: C9FFAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9FFAE second address: C9FFB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9FFB2 second address: C9FFD4 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5C74F50626h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F5C74F50635h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB3F7C second address: CB3F88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F5C74B78B06h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB3F88 second address: CB3F8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB73B3 second address: CB73B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBDDA4 second address: CBDDAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBDDAA second address: CBDDAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBDDAE second address: CBDDD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c jo 00007F5C74F50626h 0x00000012 jng 00007F5C74F50626h 0x00000018 push esi 0x00000019 pop esi 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d jng 00007F5C74F50626h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBDDD1 second address: CBDDD7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBE4B4 second address: CBE4C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5C74F5062Dh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBE4C6 second address: CBE4F1 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5C74B78B12h 0x00000008 jmp 00007F5C74B78B10h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBE4F1 second address: CBE4F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBE4F7 second address: CBE505 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F5C74B78B0Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBE636 second address: CBE63A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CBE63A second address: CBE640 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1804 second address: CC180A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC5AD5 second address: CC5AE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jnl 00007F5C74B78B06h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC5AE2 second address: CC5AE7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC87E1 second address: CC87F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5C74B78B0Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC87F4 second address: CC87FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC87FC second address: CC880E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F5C74B78B0Ah 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCCF95 second address: CCCF99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCCF99 second address: CCCF9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCCB8F second address: CCCB95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCCB95 second address: CCCBA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007F5C74B78B06h 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCE9DF second address: CCE9E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCE9E3 second address: CCE9EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007F5C74B78B06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC2DFB second address: CC2E18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5C74F50639h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC2E18 second address: CC2E1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC2E1C second address: CC2E22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC2E22 second address: CC2E40 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 ja 00007F5C74B78B06h 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F5C74B78B10h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC2E40 second address: CC2E44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC2E44 second address: CC2E5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 ja 00007F5C74B78B06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push esi 0x00000010 push edi 0x00000011 pop edi 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC2E5B second address: CC2E5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC19B2 second address: CC19C6 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5C74B78B0Ah 0x00000008 pushad 0x00000009 popad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e ja 00007F5C74B78B06h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1CA3 second address: CC1CA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE6368 second address: BE636C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE636C second address: BE6372 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE6372 second address: BE6377 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A3DCAA instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A3DC37 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 4F40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 5190000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 4F40000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BB22D7 rdtsc

0_2_00BB22D7

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BC647B sidt fword ptr [esp-02h]

0_2_00BC647B

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 4612

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2240136708.0000000000BBC000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2240136708.0000000000BBC000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00BB22D7 rdtsc

0_2_00BB22D7

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A3B842 LdrInitializeThunk,

0_2_00A3B842

Source: C:\Users\user\Desktop\file.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: file.exe, 00000000.00000002.2240274267.0000000000C01000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: wProgram Manager

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\Desktop\file.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\Desktop\file.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	641 Security Software Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	41 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Bypass User Account Control	271 Virtualization/Sandbox Evasion	Security Account Manager	271 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	22 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Bypass User Account Control	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Joe Sandbox ML

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559712
Start date and time:	2024-11-20 21:04:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@1/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, ctldl.windowsupdate.com
Report size getting too big, too many NtProtectVirtualMemory calls found.
VT rate limit hit for: file.exe

Process:	C:\Users\user\Desktop\file.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.494575779602164
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'768'384 bytes
MD5:	64fae8982e9943f1f140dd0656989812
SHA1:	1b140805481dbef455b41d174e11766e23670185
SHA256:	4e32b7750d935b1eb8acdeaeb9c701e7a9b390be3c37db6769d520c000b66d42
SHA512:	0a84271da4550930f5b75a0331d9c7cdc74bfda37e6e6efe2b1dde2b9d41fe990b9d3d87e583089e5c07cc88457a7668a50bd9c26101f19347472170f61b5c79
SSDEEP:	49152:t4ti6sIgjJXr0oeCrWyPjaoVtOQ94mn+GeG:t4t3sLjJXwoxSyPjaoVtP99+GZ
TLSH:	D3D54BA2B50D76CFD48A177A8967DD4669BE43B9472008C7AC1C6CBE7DE3CC112B5C28
File Content Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$.............. ...`....@.. .............................k.+...`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x6aa000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE
Time Stamp:	0x652C2850 [Sun Oct 15 17:58:40 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F5C7522CAEAh
hint_nop dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00000000h], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8055	0x69	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6000	0x59c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x81f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x2000	0x4000	0x1200	9300cf8bcb6178f5a23b236abaf25dde	False	0.9338107638888888	data	7.800415560775893	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x6000	0x59c	0x600	aae15e30898a02f09cc86ed48aa06b09	False	0.4140625	data	4.036947054771808	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x8000	0x2000	0x200	ec9cb51e8cb4ea49a56ee3cf434fb69e	False	0.1484375	data	0.9342685949460681	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
fysdnnem	0xa000	0x29e000	0x29dc00	2975577ecbc24ef95ed7be4d7561f743	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
nvcnsgcm	0x2a8000	0x2000	0x600	cf5eaedea97752cd5cf43c480f0c486a	False	0.5735677083333334	data	5.050765145280857	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x2aa000	0x4000	0x2200	fdf4cb4fa80a02a369c1778eb02a6499	False	0.07215073529411764	DOS executable (COM)	0.8093270438749536	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x6090	0x30c	data			0.42948717948717946
RT_MANIFEST	0x63ac	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
kernel32.dll	lstrcpy

Target ID:	0
Start time:	15:05:01
Start date:	20/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xa30000
File size:	2'768'384 bytes
MD5 hash:	64FAE8982E9943F1F140DD0656989812
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3%
Dynamic/Decrypted Code Coverage:	12%
Signature Coverage:	5.4%
Total number of Nodes:	92
Total number of Limit Nodes:	5

Executed Functions

Function 00BB22D7 Relevance: 1.6, APIs: 1, Instructions: 109
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00BB22D7

Memory Dump Source

Source File: 00000000.00000002.2240119163.0000000000BAF000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2239906821.0000000000A30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239923237.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239939022.0000000000A36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239955712.0000000000A3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239972899.0000000000A46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240082754.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240100293.0000000000B9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240136708.0000000000BBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240156400.0000000000BCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240174158.0000000000BD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240188865.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240204985.0000000000BD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240226204.0000000000BF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240242651.0000000000BFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240258237.0000000000BFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240274267.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240290779.0000000000C0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240306521.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240327525.0000000000C25000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240344306.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240360120.0000000000C35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240376060.0000000000C38000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240390748.0000000000C39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240406530.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240423113.0000000000C44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240439583.0000000000C47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240454912.0000000000C48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240469864.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240485899.0000000000C52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240501109.0000000000C53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240518440.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240534839.0000000000C5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240551228.0000000000C64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240567434.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240601609.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240618165.0000000000CBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240667087.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240688612.0000000000CDA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 35c292a28322622a396f5d15e4a7fb19f0b5d21149eaa25727a8439ed77f531a
Instruction ID: 846c643593d00dab290c9dc1dc2d62df9ae6e71fe2ff503b9fcf48ef6933cb81
Opcode Fuzzy Hash: 35c292a28322622a396f5d15e4a7fb19f0b5d21149eaa25727a8439ed77f531a
Instruction Fuzzy Hash: F53148F250C210AFE705AF18D9817BEBBE4EF84720F16492DE6D583640E7791840CB97

Function 00A3B842 Relevance: 1.3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

Strings

!!iH, xrefs: 00A3B9B2

Memory Dump Source

Source File: 00000000.00000002.2239955712.0000000000A3A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2239906821.0000000000A30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239923237.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239939022.0000000000A36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239972899.0000000000A46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240082754.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240100293.0000000000B9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240119163.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240136708.0000000000BBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240156400.0000000000BCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240174158.0000000000BD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240188865.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240204985.0000000000BD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240226204.0000000000BF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240242651.0000000000BFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240258237.0000000000BFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240274267.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240290779.0000000000C0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240306521.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240327525.0000000000C25000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240344306.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240360120.0000000000C35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240376060.0000000000C38000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240390748.0000000000C39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240406530.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240423113.0000000000C44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240439583.0000000000C47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240454912.0000000000C48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240469864.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240485899.0000000000C52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240501109.0000000000C53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240518440.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240534839.0000000000C5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240551228.0000000000C64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240567434.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240601609.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240618165.0000000000CBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240667087.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240688612.0000000000CDA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID:
String ID: !!iH
API String ID: 0-3430752988
Opcode ID: d775848c6c3c063205820a04bd799b7b6fe53eb4404a2e6bcbb2f0da5aaf5294
Instruction ID: e183cdfb872053412f58cc41e3bf96454fc6014e18b7b2d0a269e72afbacb10f
Opcode Fuzzy Hash: d775848c6c3c063205820a04bd799b7b6fe53eb4404a2e6bcbb2f0da5aaf5294
Instruction Fuzzy Hash: 32E0C2316385898ECF26EF64C9017A93B2BDB80700F100115BB418EE49CB2D0D118776

Function 00BBF702 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 96
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 00BC188C
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 00BC18B3
GetNativeSystemInfo.KERNELBASE(?), ref: 00BC190A

Strings

ew, xrefs: 00BC2EBE

Memory Dump Source

Source File: 00000000.00000002.2240136708.0000000000BBC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2239906821.0000000000A30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239923237.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239939022.0000000000A36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239955712.0000000000A3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239972899.0000000000A46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240082754.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240100293.0000000000B9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240119163.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240156400.0000000000BCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240174158.0000000000BD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240188865.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240204985.0000000000BD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240226204.0000000000BF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240242651.0000000000BFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240258237.0000000000BFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240274267.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240290779.0000000000C0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240306521.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240327525.0000000000C25000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240344306.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240360120.0000000000C35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240376060.0000000000C38000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240390748.0000000000C39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240406530.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240423113.0000000000C44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240439583.0000000000C47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240454912.0000000000C48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240469864.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240485899.0000000000C52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240501109.0000000000C53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240518440.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240534839.0000000000C5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240551228.0000000000C64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240567434.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240601609.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240618165.0000000000CBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240667087.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240688612.0000000000CDA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID: ew
API String ID: 1247124224-3558741604
Opcode ID: f487d53969097cfd5ad99b9f303e1174bc9d6208510c3364ca991653fc317861
Instruction ID: e03412f583a6efb509c330607de804663b520baf01dfb71b445f73ab57a87df4
Opcode Fuzzy Hash: f487d53969097cfd5ad99b9f303e1174bc9d6208510c3364ca991653fc317861
Instruction Fuzzy Hash: F9416B7250820EAFEF11DF14D888BEF3BE9EB45301F10456AE94292941DBB64CA4DF59

Function 00C0D833 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(00F207AC,-11895FEC), ref: 00C0D8AC
GetFileAttributesA.KERNEL32(00000000,-11895FEC), ref: 00C0D8BA

Strings

@, xrefs: 00C0D85F

Memory Dump Source

Source File: 00000000.00000002.2240290779.0000000000C0C000.00000080.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2239906821.0000000000A30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239923237.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239939022.0000000000A36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239955712.0000000000A3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239972899.0000000000A46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240082754.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240100293.0000000000B9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240119163.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240136708.0000000000BBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240156400.0000000000BCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240174158.0000000000BD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240188865.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240204985.0000000000BD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240226204.0000000000BF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240242651.0000000000BFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240258237.0000000000BFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240274267.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240306521.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240327525.0000000000C25000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240344306.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240360120.0000000000C35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240376060.0000000000C38000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240390748.0000000000C39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240406530.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240423113.0000000000C44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240439583.0000000000C47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240454912.0000000000C48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240469864.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240485899.0000000000C52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240501109.0000000000C53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240518440.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240534839.0000000000C5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240551228.0000000000C64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240567434.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240601609.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240618165.0000000000CBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240667087.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240688612.0000000000CDA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: AttributesFile
String ID: @
API String ID: 3188754299-2726393805
Opcode ID: 1d715e8fac4045f3b1477318768e8c1261cf5eb61b543dc90b125e5e47fa5b2e
Instruction ID: 6ce44839466bf3e71560bc9377eeff12ba5355718ec01a4f424638fa14970ae9
Opcode Fuzzy Hash: 1d715e8fac4045f3b1477318768e8c1261cf5eb61b543dc90b125e5e47fa5b2e
Instruction Fuzzy Hash: 4A011931604605FAEF259FD5D90A79CBEB0BF50344F20C225E517690E2D7B19A91FA90

Function 00C0DA4F Relevance: 3.1, APIs: 2, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00F207AC,?,-11895FEC,?,?,?,?,-11895FEC), ref: 00C0DB01

Part of subcall function 00C0DA01: IsBadWritePtr.KERNEL32(?,00000004), ref: 00C0DA0F

CreateFileA.KERNEL32(?,?,-11895FEC,?,?,?,?,-11895FEC), ref: 00C0DB21

Memory Dump Source

Source File: 00000000.00000002.2240290779.0000000000C0C000.00000080.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2239906821.0000000000A30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239923237.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239939022.0000000000A36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239955712.0000000000A3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239972899.0000000000A46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240082754.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240100293.0000000000B9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240119163.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240136708.0000000000BBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240156400.0000000000BCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240174158.0000000000BD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240188865.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240204985.0000000000BD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240226204.0000000000BF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240242651.0000000000BFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240258237.0000000000BFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240274267.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240306521.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240327525.0000000000C25000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240344306.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240360120.0000000000C35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240376060.0000000000C38000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240390748.0000000000C39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240406530.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240423113.0000000000C44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240439583.0000000000C47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240454912.0000000000C48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240469864.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240485899.0000000000C52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240501109.0000000000C53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240518440.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240534839.0000000000C5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240551228.0000000000C64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240567434.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240601609.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240618165.0000000000CBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240667087.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240688612.0000000000CDA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CreateFile$Write
String ID:
API String ID: 1125675974-0
Opcode ID: 25ba775dd1af1f486776751d25a07144198e2d85d74e4afe1c25d1eb0e75bec7
Instruction ID: 20eef2a7423c68fe49acf46017f15a4e5684193157533418985608ea8a998a15
Opcode Fuzzy Hash: 25ba775dd1af1f486776751d25a07144198e2d85d74e4afe1c25d1eb0e75bec7
Instruction Fuzzy Hash: 8611A23220824AFBDF229FD0CD05BA97E72BF08344F144115BA16644B1D7768AA1FB91

Function 00C0D3BB Relevance: 3.0, APIs: 2, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(-11895FEC), ref: 00C0D3C8
DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00C0D42E

Memory Dump Source

Source File: 00000000.00000002.2240290779.0000000000C0C000.00000080.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2239906821.0000000000A30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239923237.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239939022.0000000000A36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239955712.0000000000A3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239972899.0000000000A46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240082754.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240100293.0000000000B9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240119163.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240136708.0000000000BBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240156400.0000000000BCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240174158.0000000000BD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240188865.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240204985.0000000000BD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240226204.0000000000BF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240242651.0000000000BFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240258237.0000000000BFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240274267.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240306521.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240327525.0000000000C25000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240344306.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240360120.0000000000C35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240376060.0000000000C38000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240390748.0000000000C39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240406530.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240423113.0000000000C44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240439583.0000000000C47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240454912.0000000000C48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240469864.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240485899.0000000000C52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240501109.0000000000C53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240518440.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240534839.0000000000C5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240551228.0000000000C64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240567434.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240601609.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240618165.0000000000CBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240667087.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240688612.0000000000CDA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CurrentDuplicateHandleProcess
String ID:
API String ID: 1009649615-0
Opcode ID: eb8279700bc97efe166a02c1e5d1e7c5f2d2c06a9fd6223bda7f0f9c0f5a34dc
Instruction ID: 436283d47cbc194cc0891b7f693f9ae9c306f8ac834675d1fda62c3dd1cfdcea
Opcode Fuzzy Hash: eb8279700bc97efe166a02c1e5d1e7c5f2d2c06a9fd6223bda7f0f9c0f5a34dc
Instruction Fuzzy Hash: F901193220014AFBCF22AFE4DC09D9E3B35FF987507004526F916940A6D732E662FB21

Function 00BB2442 Relevance: 1.6, APIs: 1, Instructions: 93
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00BB2442

Memory Dump Source

Source File: 00000000.00000002.2240119163.0000000000BAF000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2239906821.0000000000A30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239923237.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239939022.0000000000A36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239955712.0000000000A3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239972899.0000000000A46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240082754.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240100293.0000000000B9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240136708.0000000000BBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240156400.0000000000BCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240174158.0000000000BD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240188865.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240204985.0000000000BD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240226204.0000000000BF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240242651.0000000000BFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240258237.0000000000BFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240274267.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240290779.0000000000C0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240306521.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240327525.0000000000C25000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240344306.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240360120.0000000000C35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240376060.0000000000C38000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240390748.0000000000C39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240406530.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240423113.0000000000C44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240439583.0000000000C47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240454912.0000000000C48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240469864.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240485899.0000000000C52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240501109.0000000000C53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240518440.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240534839.0000000000C5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240551228.0000000000C64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240567434.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240601609.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240618165.0000000000CBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240667087.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240688612.0000000000CDA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 68c14f2630ff12585950c49a1c87f82f4b2ad3e69c65c186d945c905e11f10aa
Instruction ID: 72be058add561eb98a8ed37d2dd71db43a8adb0bbcf711742e96e8a13b4da944
Opcode Fuzzy Hash: 68c14f2630ff12585950c49a1c87f82f4b2ad3e69c65c186d945c905e11f10aa
Instruction Fuzzy Hash: 553122B250C300AFD349AF28D88566EFBF5EF98710F16892EE2D682210D7314990DB17

Function 00BB5B30 Relevance: 1.6, APIs: 1, Instructions: 67
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?), ref: 00BB5B5E

Memory Dump Source

Source File: 00000000.00000002.2240119163.0000000000BAF000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2239906821.0000000000A30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239923237.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239939022.0000000000A36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239955712.0000000000A3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239972899.0000000000A46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240082754.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240100293.0000000000B9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240136708.0000000000BBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240156400.0000000000BCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240174158.0000000000BD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240188865.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240204985.0000000000BD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240226204.0000000000BF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240242651.0000000000BFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240258237.0000000000BFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240274267.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240290779.0000000000C0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240306521.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240327525.0000000000C25000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240344306.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240360120.0000000000C35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240376060.0000000000C38000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240390748.0000000000C39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240406530.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240423113.0000000000C44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240439583.0000000000C47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240454912.0000000000C48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240469864.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240485899.0000000000C52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240501109.0000000000C53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240518440.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240534839.0000000000C5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240551228.0000000000C64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240567434.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240601609.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240618165.0000000000CBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240667087.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240688612.0000000000CDA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d947e2ce2afec48c4c5a6e3f792c30cdff877f30cb5c7d174fbe53046e03b8e5
Instruction ID: 4ca6113d45bb230d2b46deb14be62b1879ae4abfeea0fb867144d3a4a7066a0d
Opcode Fuzzy Hash: d947e2ce2afec48c4c5a6e3f792c30cdff877f30cb5c7d174fbe53046e03b8e5
Instruction Fuzzy Hash: FA01A2F72086653EFA31CE51BE20FFB7B9CDAD2731B2484AAF805D2443C1902C064236

Function 05030D41 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 05030DCD

Memory Dump Source

Source File: 00000000.00000002.2242476139.0000000005030000.00000040.00000800.00020000.00000000.sdmp, Offset: 05030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5030000_file.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: e23deb7427a2c0d422d538a6b285bff651de844422eef206d468e31d6ab8be13
Instruction ID: a1cf62b2de5b02de608b94f9fc47e9e53b6ea03aa7ee2ac507d225638869052e
Opcode Fuzzy Hash: e23deb7427a2c0d422d538a6b285bff651de844422eef206d468e31d6ab8be13
Instruction Fuzzy Hash: 49214CB6C012189FDB50CF99D885ADEFBF4FF88320F14851AD909BB205D774A541CBA4

Function 05030D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 05030DCD

Memory Dump Source

Source File: 00000000.00000002.2242476139.0000000005030000.00000040.00000800.00020000.00000000.sdmp, Offset: 05030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5030000_file.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 475be76ee88615bd4eb07063a6d5d1c50a8539385f9648864642d4695b2227c0
Instruction ID: 14d4ce3c46234519b1ea981a83594c604bc2d8a692e1dd08b7cd821a2782e7cf
Opcode Fuzzy Hash: 475be76ee88615bd4eb07063a6d5d1c50a8539385f9648864642d4695b2227c0
Instruction Fuzzy Hash: A02147B6C012189FCB50CF99D885ADEFBF8FF88310F14851AD809AB205C734A540CBA4

Function 00BB5C2A Relevance: 1.6, APIs: 1, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00BB5C9D

Memory Dump Source

Source File: 00000000.00000002.2240119163.0000000000BAF000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2239906821.0000000000A30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239923237.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239939022.0000000000A36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239955712.0000000000A3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239972899.0000000000A46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240082754.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240100293.0000000000B9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240136708.0000000000BBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240156400.0000000000BCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240174158.0000000000BD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240188865.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240204985.0000000000BD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240226204.0000000000BF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240242651.0000000000BFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240258237.0000000000BFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240274267.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240290779.0000000000C0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240306521.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240327525.0000000000C25000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240344306.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240360120.0000000000C35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240376060.0000000000C38000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240390748.0000000000C39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240406530.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240423113.0000000000C44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240439583.0000000000C47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240454912.0000000000C48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240469864.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240485899.0000000000C52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240501109.0000000000C53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240518440.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240534839.0000000000C5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240551228.0000000000C64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240567434.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240601609.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240618165.0000000000CBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240667087.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240688612.0000000000CDA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8e013d672dd2864caaf4527fc8dad3ac64e489b51e45e44859d6183828ce7776
Instruction ID: 2b021ad8399ccbe346146344e00d097d092fd149393e5a5184a0327896d2313f
Opcode Fuzzy Hash: 8e013d672dd2864caaf4527fc8dad3ac64e489b51e45e44859d6183828ce7776
Instruction Fuzzy Hash: 6D01B5B71493963EE6129A208E94FFBAFADEBC2630F2440A9F441975D3D1C50D499225

Function 05031509 Relevance: 1.6, APIs: 1, Instructions: 56
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 05031580

Memory Dump Source

Source File: 00000000.00000002.2242476139.0000000005030000.00000040.00000800.00020000.00000000.sdmp, Offset: 05030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5030000_file.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: b4c4f029522b7611d7cc8acfdd87e2d41d4e26cae399282e1b699b7c50622a26
Instruction ID: c19c2733afcbeb3c6adc9d15f082fa1054caec4411be7008b79cef9b01628624
Opcode Fuzzy Hash: b4c4f029522b7611d7cc8acfdd87e2d41d4e26cae399282e1b699b7c50622a26
Instruction Fuzzy Hash: F42117B1D00249DFDB10CF9AC984BDEFBF8EB58320F148429E519A3240D774A544CFA5

Function 05031510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 05031580

Memory Dump Source

Source File: 00000000.00000002.2242476139.0000000005030000.00000040.00000800.00020000.00000000.sdmp, Offset: 05030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5030000_file.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 53e7de4f9a9fd436a96e1c7ddb47a4014a0b9a0becc82decade3fda1eb469cd7
Instruction ID: ec5ba2d141c2f0d0cdf6a5efa58658e8fa5f5943fedd06873f9acbed41078858
Opcode Fuzzy Hash: 53e7de4f9a9fd436a96e1c7ddb47a4014a0b9a0becc82decade3fda1eb469cd7
Instruction Fuzzy Hash: E41117B1900249DFDB10CF9AC984BDEFBF8EB48320F148429E519A3240D374A544CFA5

Function 00C0E587 Relevance: 1.6, APIs: 1, Instructions: 51
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MapViewOfFileEx.KERNELBASE(?,?,?,?,?,?), ref: 00C0E60E

Memory Dump Source

Source File: 00000000.00000002.2240290779.0000000000C0C000.00000080.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2239906821.0000000000A30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239923237.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239939022.0000000000A36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239955712.0000000000A3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239972899.0000000000A46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240082754.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240100293.0000000000B9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240119163.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240136708.0000000000BBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240156400.0000000000BCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240174158.0000000000BD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240188865.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240204985.0000000000BD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240226204.0000000000BF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240242651.0000000000BFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240258237.0000000000BFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240274267.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240306521.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240327525.0000000000C25000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240344306.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240360120.0000000000C35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240376060.0000000000C38000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240390748.0000000000C39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240406530.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240423113.0000000000C44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240439583.0000000000C47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240454912.0000000000C48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240469864.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240485899.0000000000C52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240501109.0000000000C53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240518440.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240534839.0000000000C5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240551228.0000000000C64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240567434.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240601609.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240618165.0000000000CBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240667087.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240688612.0000000000CDA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 586b6929c9fce664d67a0ad5a480a841277ebced14c1e17ca5ec39ba886d9147
Instruction ID: bf4b1e2b4451cbb8aa93b01c5386c68db8bb7ca54f02be0a40de9f67deb686d7
Opcode Fuzzy Hash: 586b6929c9fce664d67a0ad5a480a841277ebced14c1e17ca5ec39ba886d9147
Instruction Fuzzy Hash: AD11F37214410AEBCF22AFA4DC09D9E3B76FF69340B004815FA11550A2DB36D5B2FB61

Function 00C0E36F Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2240290779.0000000000C0C000.00000080.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2239906821.0000000000A30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239923237.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239939022.0000000000A36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239955712.0000000000A3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239972899.0000000000A46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240082754.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240100293.0000000000B9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240119163.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240136708.0000000000BBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240156400.0000000000BCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240174158.0000000000BD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240188865.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240204985.0000000000BD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240226204.0000000000BF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240242651.0000000000BFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240258237.0000000000BFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240274267.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240306521.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240327525.0000000000C25000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240344306.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240360120.0000000000C35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240376060.0000000000C38000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240390748.0000000000C39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240406530.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240423113.0000000000C44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240439583.0000000000C47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240454912.0000000000C48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240469864.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240485899.0000000000C52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240501109.0000000000C53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240518440.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240534839.0000000000C5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240551228.0000000000C64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240567434.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240601609.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240618165.0000000000CBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240667087.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240688612.0000000000CDA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86afa93ea10219e43ead64ee2f239c43b47d801fee7bd6bc756258b049b10669
Instruction ID: 4955172622146e470d40972e3ed64f4e4c9b4be934019354a8b173bef1cee6a7
Opcode Fuzzy Hash: 86afa93ea10219e43ead64ee2f239c43b47d801fee7bd6bc756258b049b10669
Instruction Fuzzy Hash: AD111B3224424AEFCF12AFE4C809A9E7B75EF44740F048865FA21560F2C776CA66FB51

Function 05031301 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 05031367

Memory Dump Source

Source File: 00000000.00000002.2242476139.0000000005030000.00000040.00000800.00020000.00000000.sdmp, Offset: 05030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5030000_file.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: b56efa6f81892f25d84d5b5e6aacf9a3b6f6a27bb816c2f73885ab833fbf0ac3
Instruction ID: 2c3c29e22d6320fa271585fd6f6e6935160f55b7bb2b62ac811bb94ca5bf3fbd
Opcode Fuzzy Hash: b56efa6f81892f25d84d5b5e6aacf9a3b6f6a27bb816c2f73885ab833fbf0ac3
Instruction Fuzzy Hash: B0113AB1800249CFDB20CF9AD985BEEFBF8EF48320F148469D519A3240C778A545CFA5

Function 05031308 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 05031367

Memory Dump Source

Source File: 00000000.00000002.2242476139.0000000005030000.00000040.00000800.00020000.00000000.sdmp, Offset: 05030000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5030000_file.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: af4560fdb02d0497ea58e47b4ce4efd7a02f410fecf72d988f757b60a88eba47
Instruction ID: bc286cbe7b4c95219483e4e787ea162e6b5673f9c152d9f8a02de519a1e058ac
Opcode Fuzzy Hash: af4560fdb02d0497ea58e47b4ce4efd7a02f410fecf72d988f757b60a88eba47
Instruction Fuzzy Hash: B01118B1800249CFDB20CF9AD945BDEFBF8EF48320F14845AD518A3651D778A944CFA5

Function 00BB5C5A Relevance: 1.5, APIs: 1, Instructions: 46fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 00BB5C9D

Memory Dump Source

Source File: 00000000.00000002.2240119163.0000000000BAF000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2239906821.0000000000A30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239923237.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239939022.0000000000A36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239955712.0000000000A3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239972899.0000000000A46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240082754.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240100293.0000000000B9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240136708.0000000000BBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240156400.0000000000BCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240174158.0000000000BD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240188865.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240204985.0000000000BD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240226204.0000000000BF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240242651.0000000000BFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240258237.0000000000BFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240274267.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240290779.0000000000C0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240306521.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240327525.0000000000C25000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240344306.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240360120.0000000000C35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240376060.0000000000C38000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240390748.0000000000C39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240406530.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240423113.0000000000C44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240439583.0000000000C47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240454912.0000000000C48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240469864.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240485899.0000000000C52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240501109.0000000000C53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240518440.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240534839.0000000000C5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240551228.0000000000C64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240567434.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240601609.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240618165.0000000000CBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240667087.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240688612.0000000000CDA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ca243e516840c12e777245ed3b6c62a339fe85847da6096f74061ac01b2fb520
Instruction ID: 968f5760a75006aac2728fbcce5f0737af09be7655ba62c2b021075ad82bfc14
Opcode Fuzzy Hash: ca243e516840c12e777245ed3b6c62a339fe85847da6096f74061ac01b2fb520
Instruction Fuzzy Hash: 19F0B4B714925A2EE621D9059E84FFF6FAEFAC277473440B9F40697443D1801D4A9232

Function 00C0DC53 Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,?), ref: 00C0DCBF

Memory Dump Source

Source File: 00000000.00000002.2240290779.0000000000C0C000.00000080.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2239906821.0000000000A30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239923237.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239939022.0000000000A36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239955712.0000000000A3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239972899.0000000000A46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240082754.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240100293.0000000000B9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240119163.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240136708.0000000000BBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240156400.0000000000BCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240174158.0000000000BD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240188865.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240204985.0000000000BD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240226204.0000000000BF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240242651.0000000000BFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240258237.0000000000BFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240274267.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240306521.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240327525.0000000000C25000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240344306.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240360120.0000000000C35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240376060.0000000000C38000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240390748.0000000000C39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240406530.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240423113.0000000000C44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240439583.0000000000C47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240454912.0000000000C48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240469864.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240485899.0000000000C52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240501109.0000000000C53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240518440.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240534839.0000000000C5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240551228.0000000000C64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240567434.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240601609.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240618165.0000000000CBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240667087.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240688612.0000000000CDA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: cc3efc4066f640d390745d9547bbbb589799607e5e725643580427cd9f6f307e
Instruction ID: dda9f1683e9944748885a8843bd92aee435daebb651d69eaabaa71265ed0ab12
Opcode Fuzzy Hash: cc3efc4066f640d390745d9547bbbb589799607e5e725643580427cd9f6f307e
Instruction Fuzzy Hash: 78F0143220000AEADF22AFE8DC09E9E7B26EF99350F004011FA06491A5C772C9A1FB60

Function 00BB5C5C Relevance: 1.5, APIs: 1, Instructions: 37fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 00BB5C9D

Memory Dump Source

Source File: 00000000.00000002.2240119163.0000000000BAF000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2239906821.0000000000A30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239923237.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239939022.0000000000A36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239955712.0000000000A3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239972899.0000000000A46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240082754.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240100293.0000000000B9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240136708.0000000000BBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240156400.0000000000BCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240174158.0000000000BD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240188865.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240204985.0000000000BD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240226204.0000000000BF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240242651.0000000000BFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240258237.0000000000BFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240274267.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240290779.0000000000C0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240306521.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240327525.0000000000C25000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240344306.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240360120.0000000000C35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240376060.0000000000C38000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240390748.0000000000C39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240406530.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240423113.0000000000C44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240439583.0000000000C47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240454912.0000000000C48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240469864.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240485899.0000000000C52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240501109.0000000000C53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240518440.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240534839.0000000000C5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240551228.0000000000C64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240567434.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240601609.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240618165.0000000000CBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240667087.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240688612.0000000000CDA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 84498f8007308258b6909f27d5b3cdbfb5dc5e7c2fbbab63ce7b229d2c875dd6
Instruction ID: 90b9ef19ff86b905f4c7117e4ff016f6134533b1337f6745f403bb2ee8113e8c
Opcode Fuzzy Hash: 84498f8007308258b6909f27d5b3cdbfb5dc5e7c2fbbab63ce7b229d2c875dd6
Instruction Fuzzy Hash: CEF0ABF75442961FD13299585E54BEE5F9BFEE26B0F3040BAE045D788BC0829C4F0222

Function 00BC03FA Relevance: 1.5, APIs: 1, Instructions: 23libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 00BC0413

Memory Dump Source

Source File: 00000000.00000002.2240136708.0000000000BBC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2239906821.0000000000A30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239923237.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239939022.0000000000A36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239955712.0000000000A3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239972899.0000000000A46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240082754.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240100293.0000000000B9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240119163.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240156400.0000000000BCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240174158.0000000000BD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240188865.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240204985.0000000000BD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240226204.0000000000BF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240242651.0000000000BFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240258237.0000000000BFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240274267.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240290779.0000000000C0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240306521.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240327525.0000000000C25000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240344306.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240360120.0000000000C35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240376060.0000000000C38000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240390748.0000000000C39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240406530.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240423113.0000000000C44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240439583.0000000000C47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240454912.0000000000C48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240469864.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240485899.0000000000C52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240501109.0000000000C53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240518440.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240534839.0000000000C5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240551228.0000000000C64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240567434.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240601609.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240618165.0000000000CBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240667087.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240688612.0000000000CDA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 925fff5a9bff95d019fc5e24f22df2fc7c98ba7420aadd8a800205ed4d4b7ecf
Instruction ID: 7da882d35fa90b582922d45185d52dcc276627e7c6ca5ed7e0d884b0d4140a7b
Opcode Fuzzy Hash: 925fff5a9bff95d019fc5e24f22df2fc7c98ba7420aadd8a800205ed4d4b7ecf
Instruction Fuzzy Hash: E8E0C2B251CA10DFD702BE28D894AB9BBE4EF58710F120A2DDAC187A00E67108909B82

Function 00C0C054 Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 00C0C092

Memory Dump Source

Source File: 00000000.00000002.2240290779.0000000000C0C000.00000080.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2239906821.0000000000A30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239923237.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239939022.0000000000A36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239955712.0000000000A3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239972899.0000000000A46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240082754.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240100293.0000000000B9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240119163.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240136708.0000000000BBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240156400.0000000000BCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240174158.0000000000BD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240188865.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240204985.0000000000BD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240226204.0000000000BF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240242651.0000000000BFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240258237.0000000000BFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240274267.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240306521.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240327525.0000000000C25000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240344306.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240360120.0000000000C35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240376060.0000000000C38000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240390748.0000000000C39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240406530.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240423113.0000000000C44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240439583.0000000000C47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240454912.0000000000C48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240469864.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240485899.0000000000C52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240501109.0000000000C53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240518440.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240534839.0000000000C5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240551228.0000000000C64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240567434.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240601609.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240618165.0000000000CBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240667087.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240688612.0000000000CDA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: e695b7d45edbe56e54813e7d7de1daa13fdbaf085773efc37e9452015bd073a5
Instruction ID: 86491b65781852f6977e686e620a9639871e948bb6f013593768fd15a224088a
Opcode Fuzzy Hash: e695b7d45edbe56e54813e7d7de1daa13fdbaf085773efc37e9452015bd073a5
Instruction Fuzzy Hash: 8EE04F72204406E5CE20BBB9CC4EF4EAB28EFD47547104222F101950E6DA75C592FA60

Function 00A3E774 Relevance: 1.3, APIs: 1, Instructions: 25memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 00A3F005

Memory Dump Source

Source File: 00000000.00000002.2239955712.0000000000A3A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2239906821.0000000000A30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239923237.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239939022.0000000000A36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239972899.0000000000A46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240082754.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240100293.0000000000B9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240119163.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240136708.0000000000BBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240156400.0000000000BCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240174158.0000000000BD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240188865.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240204985.0000000000BD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240226204.0000000000BF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240242651.0000000000BFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240258237.0000000000BFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240274267.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240290779.0000000000C0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240306521.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240327525.0000000000C25000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240344306.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240360120.0000000000C35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240376060.0000000000C38000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240390748.0000000000C39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240406530.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240423113.0000000000C44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240439583.0000000000C47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240454912.0000000000C48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240469864.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240485899.0000000000C52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240501109.0000000000C53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240518440.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240534839.0000000000C5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240551228.0000000000C64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240567434.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240601609.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240618165.0000000000CBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240667087.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240688612.0000000000CDA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 63a0af56f3aaf7290f705707a835823bf4fd1efd241b474f92afd483005e7ec8
Instruction ID: e88c1fbc293acec2a75541c21cbf1c04cfb9e5492bee1bae749a39d3538276d7
Opcode Fuzzy Hash: 63a0af56f3aaf7290f705707a835823bf4fd1efd241b474f92afd483005e7ec8
Instruction Fuzzy Hash: FEF0D4B6909301EFC3409F2A9544A7EB7F4EF94B56F21882DB5C54A548E7724C90EB0A

Function 00A3E5FF Relevance: 1.3, APIs: 1, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 00A3E859

Memory Dump Source

Source File: 00000000.00000002.2239955712.0000000000A3A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2239906821.0000000000A30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239923237.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239939022.0000000000A36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239972899.0000000000A46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240082754.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240100293.0000000000B9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240119163.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240136708.0000000000BBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240156400.0000000000BCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240174158.0000000000BD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240188865.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240204985.0000000000BD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240226204.0000000000BF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240242651.0000000000BFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240258237.0000000000BFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240274267.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240290779.0000000000C0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240306521.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240327525.0000000000C25000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240344306.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240360120.0000000000C35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240376060.0000000000C38000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240390748.0000000000C39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240406530.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240423113.0000000000C44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240439583.0000000000C47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240454912.0000000000C48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240469864.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240485899.0000000000C52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240501109.0000000000C53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240518440.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240534839.0000000000C5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240551228.0000000000C64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240567434.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240601609.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240618165.0000000000CBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240667087.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240688612.0000000000CDA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 664e15223720997849d8d80f7bd160ba7f384aafa3af9b2a585ebf438f3f6299
Instruction ID: 6b35af28ab2c0fe4e0ae11d7b9afb36379eb997991e6a5e6adfd0fab71a84a9a
Opcode Fuzzy Hash: 664e15223720997849d8d80f7bd160ba7f384aafa3af9b2a585ebf438f3f6299
Instruction Fuzzy Hash: 01E04C7550854ADBC7406F78D0491AEBBB0EF18351F210A29FDA286AD0D7B24C709A5A

Non-executed Functions

Function 00C0E30B Relevance: 1.5, APIs: 1, Instructions: 24encryptionCOMMON

Download Yara Rule

APIs

CryptVerifySignatureA.ADVAPI32(?,?,?,?,?,?), ref: 00C0E352

Memory Dump Source

Source File: 00000000.00000002.2240290779.0000000000C0C000.00000080.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2239906821.0000000000A30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239923237.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239939022.0000000000A36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239955712.0000000000A3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239972899.0000000000A46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240082754.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240100293.0000000000B9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240119163.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240136708.0000000000BBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240156400.0000000000BCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240174158.0000000000BD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240188865.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240204985.0000000000BD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240226204.0000000000BF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240242651.0000000000BFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240258237.0000000000BFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240274267.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240306521.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240327525.0000000000C25000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240344306.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240360120.0000000000C35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240376060.0000000000C38000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240390748.0000000000C39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240406530.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240423113.0000000000C44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240439583.0000000000C47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240454912.0000000000C48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240469864.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240485899.0000000000C52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240501109.0000000000C53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240518440.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240534839.0000000000C5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240551228.0000000000C64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240567434.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240601609.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240618165.0000000000CBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240667087.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240688612.0000000000CDA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: CryptSignatureVerify
String ID:
API String ID: 1015439381-0
Opcode ID: 4193830a142d6b20278f8c61b31ca0b02ec02b13c1608745cad02eefd971cbe1
Instruction ID: 78735aa7d5a7dfc327b0e4999d9ba1ee01164dbd91fb042d421fabfe162cd3e4
Opcode Fuzzy Hash: 4193830a142d6b20278f8c61b31ca0b02ec02b13c1608745cad02eefd971cbe1
Instruction Fuzzy Hash: 6AF0F83260014AFFCF11CF94D90498D7FB2FF08344B108525FA059A261D3769A61EF40

Function 00A3DDD2 Relevance: 1.4, Strings: 1, Instructions: 188COMMON

Download Yara Rule

Strings

NTDL, xrefs: 00A3DF74

Memory Dump Source

Source File: 00000000.00000002.2239955712.0000000000A3A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2239906821.0000000000A30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239923237.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239939022.0000000000A36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239972899.0000000000A46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240082754.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240100293.0000000000B9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240119163.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240136708.0000000000BBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240156400.0000000000BCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240174158.0000000000BD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240188865.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240204985.0000000000BD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240226204.0000000000BF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240242651.0000000000BFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240258237.0000000000BFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240274267.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240290779.0000000000C0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240306521.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240327525.0000000000C25000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240344306.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240360120.0000000000C35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240376060.0000000000C38000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240390748.0000000000C39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240406530.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240423113.0000000000C44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240439583.0000000000C47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240454912.0000000000C48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240469864.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240485899.0000000000C52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240501109.0000000000C53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240518440.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240534839.0000000000C5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240551228.0000000000C64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240567434.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240601609.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240618165.0000000000CBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240667087.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240688612.0000000000CDA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID:
String ID: NTDL
API String ID: 0-3662016964
Opcode ID: 407c8487fb62d9a3d8caece27e09db446b539ef6c70a9c7ca271afcf826cac0e
Instruction ID: 86f809851da6a76e9e7e7107715e1e15266b31cfa56cb6f57063da5a61dcacca
Opcode Fuzzy Hash: 407c8487fb62d9a3d8caece27e09db446b539ef6c70a9c7ca271afcf826cac0e
Instruction Fuzzy Hash: 5251137664821ECFDB18CF25E5402EF7BB1FB66321F24852AF8428B681C2B24D51DF59

Function 00A45E2E Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2239955712.0000000000A3A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2239906821.0000000000A30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239923237.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239939022.0000000000A36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239972899.0000000000A46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240082754.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240100293.0000000000B9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240119163.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240136708.0000000000BBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240156400.0000000000BCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240174158.0000000000BD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240188865.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240204985.0000000000BD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240226204.0000000000BF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240242651.0000000000BFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240258237.0000000000BFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240274267.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240290779.0000000000C0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240306521.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240327525.0000000000C25000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240344306.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240360120.0000000000C35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240376060.0000000000C38000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240390748.0000000000C39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240406530.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240423113.0000000000C44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240439583.0000000000C47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240454912.0000000000C48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240469864.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240485899.0000000000C52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240501109.0000000000C53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240518440.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240534839.0000000000C5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240551228.0000000000C64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240567434.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240601609.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240618165.0000000000CBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240667087.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240688612.0000000000CDA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 141a44966be7e5b4efe1d995df72aa74b0861ffa9663febf177b83bbabc4b70f
Instruction ID: eb0f864da432e2056b744549c198a2dfe2dad022e5b913a6373769461027cbda
Opcode Fuzzy Hash: 141a44966be7e5b4efe1d995df72aa74b0861ffa9663febf177b83bbabc4b70f
Instruction Fuzzy Hash: 76215EB3F1562547F3548879CC64362A283DBD4315F2F8278CB48ABBC8ED7E6C0A4284

Function 00BC647B Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2240136708.0000000000BBC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2239906821.0000000000A30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239923237.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239939022.0000000000A36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239955712.0000000000A3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239972899.0000000000A46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240082754.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240100293.0000000000B9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240119163.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240156400.0000000000BCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240174158.0000000000BD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240188865.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240204985.0000000000BD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240226204.0000000000BF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240242651.0000000000BFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240258237.0000000000BFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240274267.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240290779.0000000000C0C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240306521.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240327525.0000000000C25000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240344306.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240360120.0000000000C35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240376060.0000000000C38000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240390748.0000000000C39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240406530.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240423113.0000000000C44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240439583.0000000000C47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240454912.0000000000C48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240469864.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240485899.0000000000C52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240501109.0000000000C53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240518440.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240534839.0000000000C5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240551228.0000000000C64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240567434.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240601609.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240618165.0000000000CBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240667087.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240688612.0000000000CDA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76e92e31b4029f309d802b3db0b1fd4a958a70f849010e442a672376946697e2
Instruction ID: 742920673ad8c850142ca4f929744bd9112ff5186eed5778624cdb0da118b3a1
Opcode Fuzzy Hash: 76e92e31b4029f309d802b3db0b1fd4a958a70f849010e442a672376946697e2
Instruction Fuzzy Hash: 8DE04F361041019EC700DF54C845A9FFBF4FF59310F218849E844C7726C2758D41CB29

Function 00C0C983 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00C0DA01: IsBadWritePtr.KERNEL32(?,00000004), ref: 00C0DA0F

wsprintfA.USER32 ref: 00C0C9C9
LoadImageA.USER32(?,?,?,?,?,?), ref: 00C0CA8D

Strings

%8x, xrefs: 00C0C9C4, 00C0C9C7
%8x, xrefs: 00C0CA57, 00C0CA8A

Memory Dump Source

Source File: 00000000.00000002.2240290779.0000000000C0C000.00000080.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2239906821.0000000000A30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239923237.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239939022.0000000000A36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239955712.0000000000A3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239972899.0000000000A46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240082754.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240100293.0000000000B9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240119163.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240136708.0000000000BBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240156400.0000000000BCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240174158.0000000000BD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240188865.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240204985.0000000000BD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240226204.0000000000BF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240242651.0000000000BFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240258237.0000000000BFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240274267.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240306521.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240327525.0000000000C25000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240344306.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240360120.0000000000C35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240376060.0000000000C38000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240390748.0000000000C39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240406530.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240423113.0000000000C44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240439583.0000000000C47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240454912.0000000000C48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240469864.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240485899.0000000000C52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240501109.0000000000C53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240518440.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240534839.0000000000C5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240551228.0000000000C64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240567434.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240601609.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240618165.0000000000CBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240667087.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240688612.0000000000CDA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: ImageLoadWritewsprintf
String ID: %8x$%8x
API String ID: 416453052-2046107164
Opcode ID: ab4e9b2e7cb1a9a46543cafad04a17c4de995934966ad476b6fb392beb5f79ec
Instruction ID: 9603818206a8db73fd06b488ea3673c83aff9922f0268936ebe871e90ecadb7f
Opcode Fuzzy Hash: ab4e9b2e7cb1a9a46543cafad04a17c4de995934966ad476b6fb392beb5f79ec
Instruction Fuzzy Hash: 3A31C771A0010AFBCF21DF94DC49EEEBB75FF89710F108125F911A61A1D7719A61EB50

Function 00C0D554 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNEL32(00F207AC,00004020,00000000,-11895FEC), ref: 00C0D641

Strings

@, xrefs: 00C0D580

Memory Dump Source

Source File: 00000000.00000002.2240290779.0000000000C0C000.00000080.00000001.01000000.00000003.sdmp, Offset: 00A30000, based on PE: true

Associated: 00000000.00000002.2239906821.0000000000A30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239923237.0000000000A32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239939022.0000000000A36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239955712.0000000000A3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2239972899.0000000000A46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240082754.0000000000B9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240100293.0000000000B9F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240119163.0000000000BAF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240136708.0000000000BBC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240156400.0000000000BCF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240174158.0000000000BD0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240188865.0000000000BD1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240204985.0000000000BD6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240226204.0000000000BF4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240242651.0000000000BFA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240258237.0000000000BFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240274267.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240306521.0000000000C11000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240327525.0000000000C25000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240344306.0000000000C2D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240360120.0000000000C35000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240376060.0000000000C38000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240390748.0000000000C39000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240406530.0000000000C3E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240423113.0000000000C44000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240439583.0000000000C47000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240454912.0000000000C48000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240469864.0000000000C4A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240485899.0000000000C52000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240501109.0000000000C53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240518440.0000000000C5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240534839.0000000000C5C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240551228.0000000000C64000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240567434.0000000000C66000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240601609.0000000000CBC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240618165.0000000000CBF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240633321.0000000000CCA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240667087.0000000000CD8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2240688612.0000000000CDA000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_a30000_file.jbxd

Similarity

API ID: AttributesFile
String ID: @
API String ID: 3188754299-2726393805
Opcode ID: 2cc199c05f75b770288289c3a0316a76772383b8a66bf9ba9725a834b0526810
Instruction ID: ab301324539ebf8a8e17616762c255116ec98597351285e5a577b4b89e596059
Opcode Fuzzy Hash: 2cc199c05f75b770288289c3a0316a76772383b8a66bf9ba9725a834b0526810
Instruction Fuzzy Hash: 883159B1504705EFDF258F84C844B9ABBB4FF08310F10851AF95A676A1C3B5AAA5DF90

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: file.exePID: 6604, Parent PID: 1028

General

Chronological Activities

Disassembly

Analysis Process: file.exePID: 6604, Parent PID: 1028COMMON

Execution Graph

Graph

Executed Functions

Windows Analysis Report
file.exe

Function 00BB22D7 Relevance: 1.6, APIs: 1, Instructions: 109
libraryCOMMON

Function 00BBF702 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 96
registryCOMMON

Function 00C0D833 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Function 00C0DA4F Relevance: 3.1, APIs: 2, Instructions: 57
fileCOMMON

Function 00C0D3BB Relevance: 3.0, APIs: 2, Instructions: 41
COMMON

Function 00BB2442 Relevance: 1.6, APIs: 1, Instructions: 93
libraryCOMMON

Function 00BB5B30 Relevance: 1.6, APIs: 1, Instructions: 67
fileCOMMON

Function 05030D41 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Function 05030D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Function 00BB5C2A Relevance: 1.6, APIs: 1, Instructions: 57
fileCOMMON

Function 05031509 Relevance: 1.6, APIs: 1, Instructions: 56
serviceCOMMON

Function 05031510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Function 00C0E587 Relevance: 1.6, APIs: 1, Instructions: 51
fileCOMMON

Function 00C0E36F Relevance: 1.6, APIs: 1, Instructions: 50
COMMON