Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1560427
MD5:	dd9ad82b68a13333652866431f0ee8d9
SHA1:	23b45a0875b428204f4f3448442aae222274612f
SHA256:	8ba30fce56df7cd2c37d70dda3dbde19b2d5ff5c3896e791e484f2a1838fd106
Tags:	exeuser-Bitsight
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Hides threads from debuggers

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains long sleeps (>= 3 min)

Detected potential crypto function

Enables debug privileges

Entry point lies outside standard sections

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 672 cmdline: "C:\Users\user\Desktop\file.exe" MD5: DD9AD82B68A13333652866431F0EE8D9)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: file.exe, 00000000.00000003.2185505679.00000000052E0000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2318671096.0000000000CC2000.00000040.00000001.01000000.00000003.sdmp

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E61080	0_2_00E61080
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EDBB1E	0_2_00EDBB1E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CCDFCC	0_2_00CCDFCC

Source: file.exe, 00000000.00000002.2318695288.0000000000CC6000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: classification engine

Classification label: mal100.evad.winEXE@1/1@0/0

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 42%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior

Source: file.exe

Static file information: File size 2823680 > 1048576

Source: file.exe

Static PE information: Raw size of tbudukip is bigger than: 0x100000 < 0x2ab600

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.cc0000.0.unpack :EW;.rsrc:W;.idata :W;tbudukip:EW;fmefboji:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x2bb1a4 should be: 0x2bc6e0

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: tbudukip
Source: file.exe	Static PE information: section name: fmefboji
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E566F9 push ebp; mov dword ptr [esp], 7BF951C1h	0_2_00E56745
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E566F9 push esi; mov dword ptr [esp], ebx	0_2_00E56778
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E566F9 push 001D74EFh; mov dword ptr [esp], ebp	0_2_00E56780
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CCE6F2 push edx; mov dword ptr [esp], esi	0_2_00CCF4E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F090F0 push 69D6F2C3h; mov dword ptr [esp], ebp	0_2_00F09118
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F090F0 push ecx; mov dword ptr [esp], esi	0_2_00F0916E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E650E8 push edi; mov dword ptr [esp], 5F7C1C07h	0_2_00E650E9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EDE0C7 push esi; mov dword ptr [esp], edx	0_2_00EDE0E2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EDE0C7 push esi; mov dword ptr [esp], ebx	0_2_00EDE14B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CD00F7 push cs; ret	0_2_00CD00F8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E570A4 push eax; mov dword ptr [esp], 5EBD9C02h	0_2_00E570EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E570A4 push 195DC500h; mov dword ptr [esp], ecx	0_2_00E57112
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E570A4 push ebx; mov dword ptr [esp], 7F714F09h	0_2_00E57126
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E570A4 push ebp; mov dword ptr [esp], 5EDF6737h	0_2_00E5714A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E570A4 push 7AB0B81Ch; mov dword ptr [esp], ecx	0_2_00E571CA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E570A4 push 0E500F31h; mov dword ptr [esp], esi	0_2_00E571F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CCF089 push 1A4C361Eh; mov dword ptr [esp], esi	0_2_00CCF7D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CD2097 push ecx; mov dword ptr [esp], ebp	0_2_00CD20C2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CD2097 push edi; mov dword ptr [esp], 2CB14658h	0_2_00CD25C3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F020AF push edi; mov dword ptr [esp], 6A1243BAh	0_2_00F02176
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F020AF push 6E584778h; mov dword ptr [esp], edi	0_2_00F021E2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E61080 push ecx; mov dword ptr [esp], ebp	0_2_00E610ED
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E61080 push edx; mov dword ptr [esp], eax	0_2_00E61121
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E57090 push eax; mov dword ptr [esp], 5EBD9C02h	0_2_00E570EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E57090 push 195DC500h; mov dword ptr [esp], ecx	0_2_00E57112
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E57090 push ebx; mov dword ptr [esp], 7F714F09h	0_2_00E57126
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E57090 push ebp; mov dword ptr [esp], 5EDF6737h	0_2_00E5714A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E57090 push 7AB0B81Ch; mov dword ptr [esp], ecx	0_2_00E571CA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E57090 push 0E500F31h; mov dword ptr [esp], esi	0_2_00E571F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E58090 push ebx; mov dword ptr [esp], ecx	0_2_00E5857B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E63098 push 5A0CF224h; mov dword ptr [esp], eax	0_2_00E630B5

Source: file.exe

Static PE information: section name: entropy: 7.795059537791165

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCE628 second address: CCDE99 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6CBCD9304Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b push ecx 0x0000000c push edx 0x0000000d pop edx 0x0000000e pop ecx 0x0000000f pop ebx 0x00000010 nop 0x00000011 cmc 0x00000012 push dword ptr [ebp+122D1375h] 0x00000018 jmp 00007F6CBCD93056h 0x0000001d mov dword ptr [ebp+122D261Ah], esi 0x00000023 call dword ptr [ebp+122D1F0Ah] 0x00000029 pushad 0x0000002a pushad 0x0000002b mov ecx, edx 0x0000002d jmp 00007F6CBCD93059h 0x00000032 popad 0x00000033 xor eax, eax 0x00000035 stc 0x00000036 mov edx, dword ptr [esp+28h] 0x0000003a clc 0x0000003b mov dword ptr [ebp+122D2DF2h], eax 0x00000041 jnc 00007F6CBCD93057h 0x00000047 mov esi, 0000003Ch 0x0000004c jmp 00007F6CBCD93054h 0x00000051 add esi, dword ptr [esp+24h] 0x00000055 stc 0x00000056 lodsw 0x00000058 jmp 00007F6CBCD93052h 0x0000005d add eax, dword ptr [esp+24h] 0x00000061 pushad 0x00000062 mov dword ptr [ebp+122D220Fh], eax 0x00000068 popad 0x00000069 mov ebx, dword ptr [esp+24h] 0x0000006d mov dword ptr [ebp+122D220Fh], esi 0x00000073 nop 0x00000074 push eax 0x00000075 push edx 0x00000076 jmp 00007F6CBCD9304Ah 0x0000007b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCDE99 second address: CCDEA3 instructions: 0x00000000 rdtsc 0x00000002 je 00007F6CBC6DD4ACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E57503 second address: E57524 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007F6CBCD93046h 0x0000000e jmp 00007F6CBCD93053h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E57524 second address: E57539 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a jmp 00007F6CBC6DD4AAh 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3B4BB second address: E3B4BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3B4BF second address: E3B4D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007F6CBC6DD4AAh 0x0000000c push edi 0x0000000d pop edi 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3B4D3 second address: E3B4D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3B4D9 second address: E3B4DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E56722 second address: E56729 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E56729 second address: E5672F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5688B second address: E56890 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5946B second address: E59483 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6CBC6DD4A8h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 jnp 00007F6CBC6DD4A6h 0x00000017 pop esi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E59483 second address: E594BC instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6CBCD93050h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jmp 00007F6CBCD93057h 0x00000016 jns 00007F6CBCD93046h 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E594BC second address: CCDE99 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jo 00007F6CBC6DD4A6h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d pushad 0x0000000e call 00007F6CBC6DD4AFh 0x00000013 mov edi, 0CAB2B39h 0x00000018 pop eax 0x00000019 pushad 0x0000001a mov dword ptr [ebp+122D1FB1h], edi 0x00000020 mov dword ptr [ebp+122D1E60h], edx 0x00000026 popad 0x00000027 popad 0x00000028 push dword ptr [ebp+122D1375h] 0x0000002e movzx ecx, bx 0x00000031 call dword ptr [ebp+122D1F0Ah] 0x00000037 pushad 0x00000038 pushad 0x00000039 mov ecx, edx 0x0000003b jmp 00007F6CBC6DD4B9h 0x00000040 popad 0x00000041 xor eax, eax 0x00000043 stc 0x00000044 mov edx, dword ptr [esp+28h] 0x00000048 clc 0x00000049 mov dword ptr [ebp+122D2DF2h], eax 0x0000004f jnc 00007F6CBC6DD4B7h 0x00000055 mov esi, 0000003Ch 0x0000005a jmp 00007F6CBC6DD4B4h 0x0000005f add esi, dword ptr [esp+24h] 0x00000063 stc 0x00000064 lodsw 0x00000066 jmp 00007F6CBC6DD4B2h 0x0000006b add eax, dword ptr [esp+24h] 0x0000006f pushad 0x00000070 mov dword ptr [ebp+122D220Fh], eax 0x00000076 popad 0x00000077 mov ebx, dword ptr [esp+24h] 0x0000007b mov dword ptr [ebp+122D220Fh], esi 0x00000081 nop 0x00000082 push eax 0x00000083 push edx 0x00000084 jmp 00007F6CBC6DD4AAh 0x00000089 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E59510 second address: E595DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6CBCD93052h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a mov dword ptr [esp], eax 0x0000000d mov dword ptr [ebp+122D1DD6h], esi 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push edi 0x00000018 call 00007F6CBCD93048h 0x0000001d pop edi 0x0000001e mov dword ptr [esp+04h], edi 0x00000022 add dword ptr [esp+04h], 00000017h 0x0000002a inc edi 0x0000002b push edi 0x0000002c ret 0x0000002d pop edi 0x0000002e ret 0x0000002f cmc 0x00000030 push 96354A66h 0x00000035 jc 00007F6CBCD93065h 0x0000003b add dword ptr [esp], 69CAB61Ah 0x00000042 mov edi, 5DE97B46h 0x00000047 movsx edx, cx 0x0000004a push 00000003h 0x0000004c or dword ptr [ebp+122D1C59h], ebx 0x00000052 push 00000000h 0x00000054 mov edx, dword ptr [ebp+122D25D1h] 0x0000005a sub dword ptr [ebp+122D1DD6h], esi 0x00000060 push 00000003h 0x00000062 push 00000000h 0x00000064 push edi 0x00000065 call 00007F6CBCD93048h 0x0000006a pop edi 0x0000006b mov dword ptr [esp+04h], edi 0x0000006f add dword ptr [esp+04h], 0000001Ch 0x00000077 inc edi 0x00000078 push edi 0x00000079 ret 0x0000007a pop edi 0x0000007b ret 0x0000007c and esi, dword ptr [ebp+122D2E06h] 0x00000082 push B6B3FF9Ah 0x00000087 push ebx 0x00000088 push eax 0x00000089 push edx 0x0000008a je 00007F6CBCD93046h 0x00000090 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E595DB second address: E5966C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 xor dword ptr [esp], 76B3FF9Ah 0x0000000e jnc 00007F6CBC6DD4ACh 0x00000014 push edi 0x00000015 mov cx, F0D3h 0x00000019 pop esi 0x0000001a lea ebx, dword ptr [ebp+1245F367h] 0x00000020 push 00000000h 0x00000022 push eax 0x00000023 call 00007F6CBC6DD4A8h 0x00000028 pop eax 0x00000029 mov dword ptr [esp+04h], eax 0x0000002d add dword ptr [esp+04h], 00000017h 0x00000035 inc eax 0x00000036 push eax 0x00000037 ret 0x00000038 pop eax 0x00000039 ret 0x0000003a mov edi, eax 0x0000003c sub dh, FFFFFFD7h 0x0000003f xchg eax, ebx 0x00000040 pushad 0x00000041 jmp 00007F6CBC6DD4AFh 0x00000046 pushad 0x00000047 jmp 00007F6CBC6DD4ADh 0x0000004c jmp 00007F6CBC6DD4B9h 0x00000051 popad 0x00000052 popad 0x00000053 push eax 0x00000054 push eax 0x00000055 push edx 0x00000056 pushad 0x00000057 jnl 00007F6CBC6DD4A6h 0x0000005d push ebx 0x0000005e pop ebx 0x0000005f popad 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5966C second address: E59672 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5977F second address: E59785 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E59785 second address: E597A4 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6CBCD93046h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F6CBCD9304Ch 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E597A4 second address: E597C3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F6CBC6DD4A8h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f mov eax, dword ptr [eax] 0x00000011 push eax 0x00000012 push edx 0x00000013 jl 00007F6CBC6DD4ACh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5989D second address: E598A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E598A9 second address: E598AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E599AD second address: E599B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E599B1 second address: E599E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 ja 00007F6CBC6DD4C0h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jnl 00007F6CBC6DD4A6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E599E6 second address: E599EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E599EA second address: E599F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E599F0 second address: E59A19 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6CBCD9304Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c jbe 00007F6CBCD93048h 0x00000012 push edi 0x00000013 pop edi 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F6CBCD9304Eh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7872D second address: E78731 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E789C6 second address: E789F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6CBCD93052h 0x00000009 popad 0x0000000a jmp 00007F6CBCD93057h 0x0000000f pushad 0x00000010 push esi 0x00000011 pop esi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E789F9 second address: E78A1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 popad 0x0000000a jng 00007F6CBC6DD4C3h 0x00000010 jmp 00007F6CBC6DD4ADh 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E78A1A second address: E78A20 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E78CE7 second address: E78D1A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6CBC6DD4ADh 0x00000010 pushad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 jo 00007F6CBC6DD4A6h 0x00000019 jmp 00007F6CBC6DD4B1h 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E78D1A second address: E78D20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E78E54 second address: E78E71 instructions: 0x00000000 rdtsc 0x00000002 je 00007F6CBC6DD4A6h 0x00000008 jo 00007F6CBC6DD4A6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007F6CBC6DD4AAh 0x00000015 push edi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E78E71 second address: E78E77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E78FD2 second address: E78FD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E79129 second address: E79135 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F6CBCD9304Ch 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E79288 second address: E7928C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6D03D second address: E6D043 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6D043 second address: E6D047 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6D047 second address: E6D087 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F6CBCD93055h 0x0000000d pushad 0x0000000e jmp 00007F6CBCD93050h 0x00000013 jmp 00007F6CBCD93050h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7972C second address: E79730 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E79D72 second address: E79D90 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F6CBCD93051h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E79D90 second address: E79DA8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6CBC6DD4B4h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E79DA8 second address: E79DAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7A43D second address: E7A44B instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6CBC6DD4A8h 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7A44B second address: E7A44F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7A44F second address: E7A455 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7E7EC second address: E7E7FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a je 00007F6CBCD93048h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7E99A second address: E7E9B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jc 00007F6CBC6DD4A6h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jbe 00007F6CBC6DD4ACh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7E9B1 second address: E7E9B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7E9B5 second address: E7E9DF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 ja 00007F6CBC6DD4A6h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jmp 00007F6CBC6DD4B2h 0x00000015 mov eax, dword ptr [eax] 0x00000017 push eax 0x00000018 push edx 0x00000019 push esi 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c pop esi 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7DA9E second address: E7DAAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop esi 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7FE56 second address: E7FE66 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jnp 00007F6CBC6DD4A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4070E second address: E4071D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6CBCD9304Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4071D second address: E4073A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F6CBC6DD4A6h 0x0000000a jmp 00007F6CBC6DD4B3h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4073A second address: E40767 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6CBCD93055h 0x00000007 jnc 00007F6CBCD93046h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jbe 00007F6CBCD93046h 0x00000017 jng 00007F6CBCD93046h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4734A second address: E47351 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E47351 second address: E47357 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E853DE second address: E85401 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F6CBC6DD4A6h 0x0000000a jmp 00007F6CBC6DD4B9h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E85401 second address: E85414 instructions: 0x00000000 rdtsc 0x00000002 je 00007F6CBCD93046h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E85414 second address: E85418 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E85418 second address: E85426 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F6CBCD93046h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8584E second address: E85860 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F6CBC6DD4ABh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E85860 second address: E85869 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E85869 second address: E8587F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6CBC6DD4AEh 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E85B49 second address: E85B5A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6CBCD9304Ch 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E85CB6 second address: E85CC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F6CBC6DD4A6h 0x0000000a jnc 00007F6CBC6DD4A6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E85CC6 second address: E85CD4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F6CBCD93046h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E85CD4 second address: E85CDA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E893AE second address: E893B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E89F44 second address: E89F4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8A3F9 second address: E8A403 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6CBCD9304Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8A594 second address: E8A59E instructions: 0x00000000 rdtsc 0x00000002 je 00007F6CBC6DD4ACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8AA31 second address: E8AA35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8AA35 second address: E8AA3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8AA3B second address: E8AA40 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8AA40 second address: E8AA5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F6CBC6DD4B3h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8B3D9 second address: E8B3DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8B3DD second address: E8B43E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push esi 0x0000000b call 00007F6CBC6DD4A8h 0x00000010 pop esi 0x00000011 mov dword ptr [esp+04h], esi 0x00000015 add dword ptr [esp+04h], 00000015h 0x0000001d inc esi 0x0000001e push esi 0x0000001f ret 0x00000020 pop esi 0x00000021 ret 0x00000022 mov dword ptr [ebp+122D3250h], ebx 0x00000028 push 00000000h 0x0000002a or esi, 783D9660h 0x00000030 push 00000000h 0x00000032 xor edi, 5CF35D27h 0x00000038 mov di, BBABh 0x0000003c xchg eax, ebx 0x0000003d js 00007F6CBC6DD4BBh 0x00000043 push esi 0x00000044 jmp 00007F6CBC6DD4B3h 0x00000049 pop esi 0x0000004a push eax 0x0000004b push edi 0x0000004c push eax 0x0000004d push edx 0x0000004e push ecx 0x0000004f pop ecx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8D779 second address: E8D78F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6CBCD93052h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8E1AF second address: E8E1B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E901F9 second address: E901FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E901FF second address: E9025C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b jne 00007F6CBC6DD4A6h 0x00000011 push 00000000h 0x00000013 mov edi, edx 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push ebx 0x0000001a call 00007F6CBC6DD4A8h 0x0000001f pop ebx 0x00000020 mov dword ptr [esp+04h], ebx 0x00000024 add dword ptr [esp+04h], 0000001Dh 0x0000002c inc ebx 0x0000002d push ebx 0x0000002e ret 0x0000002f pop ebx 0x00000030 ret 0x00000031 mov esi, dword ptr [ebp+122D1D3Ch] 0x00000037 push eax 0x00000038 pushad 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007F6CBC6DD4B7h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8DF8A second address: E8DFA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F6CBCD93050h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E90C3F second address: E90C52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F6CBC6DD4A6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007F6CBC6DD4A6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E943A9 second address: E943B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F6CBCD93046h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E96242 second address: E96248 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E95456 second address: E9545A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E96248 second address: E96259 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jne 00007F6CBC6DD4A6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9545A second address: E95466 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E96259 second address: E9625E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E95466 second address: E9546A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9625E second address: E962C8 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6CBC6DD4B1h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b pushad 0x0000000c push esi 0x0000000d and ax, D593h 0x00000012 pop eax 0x00000013 jmp 00007F6CBC6DD4ABh 0x00000018 popad 0x00000019 and edi, dword ptr [ebp+122D2C8Ah] 0x0000001f push 00000000h 0x00000021 mov bh, 9Dh 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push edx 0x00000028 call 00007F6CBC6DD4A8h 0x0000002d pop edx 0x0000002e mov dword ptr [esp+04h], edx 0x00000032 add dword ptr [esp+04h], 0000001Bh 0x0000003a inc edx 0x0000003b push edx 0x0000003c ret 0x0000003d pop edx 0x0000003e ret 0x0000003f pushad 0x00000040 mov dword ptr [ebp+122D3248h], edx 0x00000046 mov ax, dx 0x00000049 popad 0x0000004a xchg eax, esi 0x0000004b push eax 0x0000004c push edx 0x0000004d pushad 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9546A second address: E954DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F6CBCD93048h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f nop 0x00000010 pushad 0x00000011 mov ebx, dword ptr [ebp+122D1D33h] 0x00000017 mov dword ptr [ebp+124713C9h], edx 0x0000001d popad 0x0000001e push dword ptr fs:[00000000h] 0x00000025 xor edi, 156C2F5Ch 0x0000002b mov dword ptr fs:[00000000h], esp 0x00000032 push 00000000h 0x00000034 push ebx 0x00000035 call 00007F6CBCD93048h 0x0000003a pop ebx 0x0000003b mov dword ptr [esp+04h], ebx 0x0000003f add dword ptr [esp+04h], 0000001Ch 0x00000047 inc ebx 0x00000048 push ebx 0x00000049 ret 0x0000004a pop ebx 0x0000004b ret 0x0000004c mov eax, dword ptr [ebp+122D0AB1h] 0x00000052 mov edi, 7CEC6E72h 0x00000057 push FFFFFFFFh 0x00000059 mov edi, 19D13061h 0x0000005e push eax 0x0000005f push eax 0x00000060 push edx 0x00000061 pushad 0x00000062 push ebx 0x00000063 pop ebx 0x00000064 pushad 0x00000065 popad 0x00000066 popad 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E962C8 second address: E962E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6CBC6DD4B7h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E954DB second address: E954E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E954E1 second address: E954E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E96441 second address: E9645A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6CBCD93055h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9744C second address: E97452 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9972C second address: E997AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 jmp 00007F6CBCD9304Fh 0x0000000d nop 0x0000000e mov dword ptr [ebp+122D1F73h], ebx 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push edi 0x00000019 call 00007F6CBCD93048h 0x0000001e pop edi 0x0000001f mov dword ptr [esp+04h], edi 0x00000023 add dword ptr [esp+04h], 0000001Bh 0x0000002b inc edi 0x0000002c push edi 0x0000002d ret 0x0000002e pop edi 0x0000002f ret 0x00000030 mov di, 0680h 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push ebp 0x00000039 call 00007F6CBCD93048h 0x0000003e pop ebp 0x0000003f mov dword ptr [esp+04h], ebp 0x00000043 add dword ptr [esp+04h], 0000001Ch 0x0000004b inc ebp 0x0000004c push ebp 0x0000004d ret 0x0000004e pop ebp 0x0000004f ret 0x00000050 je 00007F6CBCD9304Ch 0x00000056 mov dword ptr [ebp+122D2226h], edx 0x0000005c push eax 0x0000005d push esi 0x0000005e pushad 0x0000005f push eax 0x00000060 push edx 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9B621 second address: E9B627 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9A8AA second address: E9A8AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9A8AF second address: E9A8BD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9A8BD second address: E9A8C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9D5C6 second address: E9D60D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push eax 0x0000000b call 00007F6CBC6DD4A8h 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 add dword ptr [esp+04h], 0000001Dh 0x0000001d inc eax 0x0000001e push eax 0x0000001f ret 0x00000020 pop eax 0x00000021 ret 0x00000022 mov bh, dl 0x00000024 push 00000000h 0x00000026 clc 0x00000027 push 00000000h 0x00000029 push ecx 0x0000002a sub dword ptr [ebp+122D2654h], ebx 0x00000030 pop ebx 0x00000031 push eax 0x00000032 push eax 0x00000033 push edx 0x00000034 jns 00007F6CBC6DD4A8h 0x0000003a push edi 0x0000003b pop edi 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9E7FE second address: E9E804 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9F7B0 second address: E9F7B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9C7C5 second address: E9C7C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9C88D second address: E9C891 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9C891 second address: E9C895 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9F8E6 second address: E9F8F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EA2BE8 second address: EA2BEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9F8F2 second address: E9F8F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9F8F7 second address: E9F8FC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E51597 second address: E515AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jne 00007F6CBC6DD4AEh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E515AA second address: E515DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6CBCD9304Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jns 00007F6CBCD93054h 0x00000011 js 00007F6CBCD9304Ah 0x00000017 push edi 0x00000018 pop edi 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E515DC second address: E515E1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB343D second address: EB344E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6CBCD9304Bh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB344E second address: EB346B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6CBC6DD4B3h 0x00000009 js 00007F6CBC6DD4A6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB346B second address: EB346F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB346F second address: EB347D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB347D second address: EB3481 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3D089 second address: E3D095 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3D095 second address: E3D099 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBA990 second address: EBA995 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBA995 second address: EBA9C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jno 00007F6CBCD9305Dh 0x00000013 mov eax, dword ptr [eax] 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBA9C7 second address: EBA9CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBA9CB second address: EBA9DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6CBCD9304Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBA9DA second address: EBA9ED instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBA9ED second address: EBA9F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBA9F2 second address: CCDE99 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6CBC6DD4B7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a jnl 00007F6CBC6DD4A7h 0x00000010 push dword ptr [ebp+122D1375h] 0x00000016 cmc 0x00000017 call dword ptr [ebp+122D1F0Ah] 0x0000001d pushad 0x0000001e pushad 0x0000001f mov ecx, edx 0x00000021 jmp 00007F6CBC6DD4B9h 0x00000026 popad 0x00000027 xor eax, eax 0x00000029 stc 0x0000002a mov edx, dword ptr [esp+28h] 0x0000002e clc 0x0000002f mov dword ptr [ebp+122D2DF2h], eax 0x00000035 jnc 00007F6CBC6DD4B7h 0x0000003b mov esi, 0000003Ch 0x00000040 jmp 00007F6CBC6DD4B4h 0x00000045 add esi, dword ptr [esp+24h] 0x00000049 stc 0x0000004a lodsw 0x0000004c jmp 00007F6CBC6DD4B2h 0x00000051 add eax, dword ptr [esp+24h] 0x00000055 pushad 0x00000056 mov dword ptr [ebp+122D220Fh], eax 0x0000005c popad 0x0000005d mov ebx, dword ptr [esp+24h] 0x00000061 mov dword ptr [ebp+122D220Fh], esi 0x00000067 nop 0x00000068 push eax 0x00000069 push edx 0x0000006a jmp 00007F6CBC6DD4AAh 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC0E1E second address: EC0E24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC0F44 second address: EC0F5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edx 0x0000000c je 00007F6CBC6DD4A6h 0x00000012 pop edx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC0F5A second address: EC0F70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F6CBCD93046h 0x0000000a je 00007F6CBCD93046h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC0F70 second address: EC0F76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC138E second address: EC13AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F6CBCD93056h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC13AB second address: EC13DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c jmp 00007F6CBC6DD4B1h 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 pushad 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 pushad 0x00000018 popad 0x00000019 push edx 0x0000001a pop edx 0x0000001b jnp 00007F6CBC6DD4A6h 0x00000021 popad 0x00000022 pushad 0x00000023 push ebx 0x00000024 pop ebx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC13DE second address: EC13FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F6CBCD93051h 0x0000000c jo 00007F6CBCD9304Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC1546 second address: EC1591 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6CBC6DD4B5h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jns 00007F6CBC6DD4B4h 0x00000011 pop edi 0x00000012 pushad 0x00000013 jmp 00007F6CBC6DD4ACh 0x00000018 push eax 0x00000019 jg 00007F6CBC6DD4A6h 0x0000001f pop eax 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 pop eax 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC1591 second address: EC1595 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC1726 second address: EC172B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC4C13 second address: EC4C6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 js 00007F6CBCD93046h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jo 00007F6CBCD93095h 0x00000012 pushad 0x00000013 jmp 00007F6CBCD93057h 0x00000018 jmp 00007F6CBCD9304Dh 0x0000001d jmp 00007F6CBCD9304Eh 0x00000022 pushad 0x00000023 popad 0x00000024 popad 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F6CBCD93051h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4C4D0 second address: E4C4DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F6CBC6DD4A6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC911B second address: EC9128 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007F6CBCD9304Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECEC45 second address: ECEC4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECDAE5 second address: ECDAFD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6CBCD93054h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECDAFD second address: ECDB03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E87D4F second address: E87D55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E87D55 second address: E87D59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E87D59 second address: E87D81 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push eax 0x0000000a mov dword ptr [ebp+122D345Dh], esi 0x00000010 pop edx 0x00000011 lea eax, dword ptr [ebp+1248DAA6h] 0x00000017 adc edi, 158E4100h 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 push esi 0x00000021 jng 00007F6CBCD93046h 0x00000027 pop esi 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E87D81 second address: E6D03D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6CBC6DD4B2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov edx, dword ptr [ebp+122D2F26h] 0x00000012 call dword ptr [ebp+122D2621h] 0x00000018 jmp 00007F6CBC6DD4B4h 0x0000001d pushad 0x0000001e jmp 00007F6CBC6DD4ABh 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88272 second address: E88281 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F6CBCD93046h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88281 second address: E88285 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88285 second address: CCDE99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jnp 00007F6CBCD9304Ch 0x0000000e nop 0x0000000f push dword ptr [ebp+122D1375h] 0x00000015 call 00007F6CBCD93057h 0x0000001a pop ecx 0x0000001b mov cx, si 0x0000001e call dword ptr [ebp+122D1F0Ah] 0x00000024 pushad 0x00000025 pushad 0x00000026 mov ecx, edx 0x00000028 jmp 00007F6CBCD93059h 0x0000002d popad 0x0000002e xor eax, eax 0x00000030 stc 0x00000031 mov edx, dword ptr [esp+28h] 0x00000035 clc 0x00000036 mov dword ptr [ebp+122D2DF2h], eax 0x0000003c jnc 00007F6CBCD93057h 0x00000042 mov esi, 0000003Ch 0x00000047 jmp 00007F6CBCD93054h 0x0000004c add esi, dword ptr [esp+24h] 0x00000050 stc 0x00000051 lodsw 0x00000053 jmp 00007F6CBCD93052h 0x00000058 add eax, dword ptr [esp+24h] 0x0000005c pushad 0x0000005d mov dword ptr [ebp+122D220Fh], eax 0x00000063 popad 0x00000064 mov ebx, dword ptr [esp+24h] 0x00000068 mov dword ptr [ebp+122D220Fh], esi 0x0000006e nop 0x0000006f push eax 0x00000070 push edx 0x00000071 jmp 00007F6CBCD9304Ah 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88326 second address: E8832A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8832A second address: E88330 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88330 second address: E88336 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88336 second address: E8833A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88417 second address: E8841E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8845B second address: E8845F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8845F second address: E88480 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6CBC6DD4B6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88480 second address: E88485 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88485 second address: E88495 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6CBC6DD4ABh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88495 second address: E884CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, esi 0x00000008 push 00000000h 0x0000000a push edi 0x0000000b call 00007F6CBCD93048h 0x00000010 pop edi 0x00000011 mov dword ptr [esp+04h], edi 0x00000015 add dword ptr [esp+04h], 00000017h 0x0000001d inc edi 0x0000001e push edi 0x0000001f ret 0x00000020 pop edi 0x00000021 ret 0x00000022 movzx edx, di 0x00000025 mov ecx, 0CE021BFh 0x0000002a push eax 0x0000002b push eax 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88588 second address: E8858C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E8858C second address: E88592 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88592 second address: E88596 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88596 second address: E8859A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88CC5 second address: E88CCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88EEE second address: E88EF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88EF2 second address: E88EFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88EFF second address: E88F03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECDDE1 second address: ECDDE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECDDE5 second address: ECDE1F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6CBCD93055h 0x00000007 jmp 00007F6CBCD93054h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jnc 00007F6CBCD93046h 0x00000015 pushad 0x00000016 popad 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECDE1F second address: ECDE57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 pushad 0x00000009 popad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jnl 00007F6CBC6DD4ACh 0x00000016 push edx 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 jmp 00007F6CBC6DD4B8h 0x0000001e pop edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECDE57 second address: ECDE61 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6CBCD9304Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECDF9A second address: ECDF9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECDF9E second address: ECDFAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jg 00007F6CBCD93046h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECDFAE second address: ECDFB8 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6CBC6DD4A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECE50D second address: ECE540 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6CBCD9304Ah 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F6CBCD93059h 0x00000010 jp 00007F6CBCD9304Eh 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECE7F2 second address: ECE7F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECE7F6 second address: ECE7FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECE7FA second address: ECE800 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED034E second address: ED0353 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED0353 second address: ED035F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jne 00007F6CBC6DD4A6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED035F second address: ED0363 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED0363 second address: ED0369 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED0369 second address: ED038A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F6CBCD93046h 0x0000000e jmp 00007F6CBCD93053h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4224E second address: E4225F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6CBC6DD4AAh 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED4894 second address: ED48C7 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F6CBCD9305Dh 0x00000008 jmp 00007F6CBCD93057h 0x0000000d push edx 0x0000000e jbe 00007F6CBCD93046h 0x00000014 pop edx 0x00000015 pop edx 0x00000016 pop eax 0x00000017 jg 00007F6CBCD93054h 0x0000001d push eax 0x0000001e push edx 0x0000001f push esi 0x00000020 pop esi 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED4A2D second address: ED4A32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED4A32 second address: ED4A37 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED4CA2 second address: ED4CD4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6CBC6DD4B5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6CBC6DD4B1h 0x00000010 jbe 00007F6CBC6DD4A6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED4CD4 second address: ED4CDE instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6CBCD93046h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED4E70 second address: ED4E8D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007F6CBC6DD4B6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED4439 second address: ED4445 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED4445 second address: ED444B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED444B second address: ED4465 instructions: 0x00000000 rdtsc 0x00000002 je 00007F6CBCD93046h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6CBCD9304Ch 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED4465 second address: ED4469 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED4469 second address: ED4473 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED4473 second address: ED4479 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED4479 second address: ED447D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED541D second address: ED542D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6CBC6DD4ACh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED542D second address: ED5435 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED5435 second address: ED5439 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED5439 second address: ED5449 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F6CBCD93046h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED5449 second address: ED544D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED5741 second address: ED574E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED574E second address: ED5758 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push edx 0x00000006 push edx 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDB3E1 second address: EDB3EC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jnc 00007F6CBCD93046h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED9E2C second address: ED9E3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6CBC6DD4ADh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED9E3D second address: ED9E41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED9E41 second address: ED9E65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6CBC6DD4ABh 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6CBC6DD4B1h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDA364 second address: EDA37D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F6CBCD93052h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDA90B second address: EDA91A instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6CBC6DD4A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push ecx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDA91A second address: EDA937 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6CBCD93055h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDAC35 second address: EDAC76 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6CBC6DD4A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b pushad 0x0000000c popad 0x0000000d jo 00007F6CBC6DD4A6h 0x00000013 pop esi 0x00000014 jmp 00007F6CBC6DD4B2h 0x00000019 popad 0x0000001a push ebx 0x0000001b jmp 00007F6CBC6DD4B4h 0x00000020 pushad 0x00000021 push edi 0x00000022 pop edi 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDE558 second address: EDE55C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDE55C second address: EDE564 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE08BB second address: EE08CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007F6CBCD9304Ch 0x0000000b jne 00007F6CBCD93046h 0x00000011 push ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE667D second address: EE6684 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE6684 second address: EE668A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE668A second address: EE6694 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F6CBC6DD4A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE6694 second address: EE66EB instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6CBCD93046h 0x00000008 jmp 00007F6CBCD93056h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jnl 00007F6CBCD9304Eh 0x00000015 pop edx 0x00000016 pop eax 0x00000017 pushad 0x00000018 jmp 00007F6CBCD93050h 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F6CBCD93052h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE66EB second address: EE66EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE66EF second address: EE6705 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6CBCD93052h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE6705 second address: EE670E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE670E second address: EE6714 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE6852 second address: EE6859 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE6859 second address: EE6861 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE6B11 second address: EE6B21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6CBC6DD4AAh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE6C9F second address: EE6CA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE6CA8 second address: EE6CB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F6CBC6DD4A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE6CB2 second address: EE6CB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88982 second address: E889D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edi 0x00000009 js 00007F6CBC6DD4ACh 0x0000000f jno 00007F6CBC6DD4A6h 0x00000015 pop edi 0x00000016 nop 0x00000017 mov cl, 1Fh 0x00000019 mov ebx, dword ptr [ebp+1248DAE5h] 0x0000001f push 00000000h 0x00000021 push edx 0x00000022 call 00007F6CBC6DD4A8h 0x00000027 pop edx 0x00000028 mov dword ptr [esp+04h], edx 0x0000002c add dword ptr [esp+04h], 00000014h 0x00000034 inc edx 0x00000035 push edx 0x00000036 ret 0x00000037 pop edx 0x00000038 ret 0x00000039 mov dx, D061h 0x0000003d add eax, ebx 0x0000003f or dword ptr [ebp+12470E47h], ecx 0x00000045 push eax 0x00000046 pushad 0x00000047 jnc 00007F6CBC6DD4A8h 0x0000004d push ecx 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E889D6 second address: E88A1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 mov cx, si 0x0000000c js 00007F6CBCD9304Ch 0x00000012 mov edx, dword ptr [ebp+122D2D82h] 0x00000018 push 00000004h 0x0000001a or dword ptr [ebp+122D279Ah], edx 0x00000020 nop 0x00000021 jmp 00007F6CBCD93054h 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F6CBCD9304Dh 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E88B69 second address: E88BDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jnp 00007F6CBC6DD4B0h 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edx 0x00000010 call 00007F6CBC6DD4A8h 0x00000015 pop edx 0x00000016 mov dword ptr [esp+04h], edx 0x0000001a add dword ptr [esp+04h], 00000019h 0x00000022 inc edx 0x00000023 push edx 0x00000024 ret 0x00000025 pop edx 0x00000026 ret 0x00000027 mov edi, dword ptr [ebp+122D2D4Eh] 0x0000002d push 0000001Eh 0x0000002f push 00000000h 0x00000031 push edx 0x00000032 call 00007F6CBC6DD4A8h 0x00000037 pop edx 0x00000038 mov dword ptr [esp+04h], edx 0x0000003c add dword ptr [esp+04h], 00000014h 0x00000044 inc edx 0x00000045 push edx 0x00000046 ret 0x00000047 pop edx 0x00000048 ret 0x00000049 xor edi, 3B4FA282h 0x0000004f push eax 0x00000050 pushad 0x00000051 jmp 00007F6CBC6DD4AFh 0x00000056 push edx 0x00000057 push eax 0x00000058 push edx 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE70B7 second address: EE70D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F6CBCD93056h 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE7B02 second address: EE7B08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE7B08 second address: EE7B0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE7B0C second address: EE7B10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE7B10 second address: EE7B20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6CBCD9304Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE7B20 second address: EE7B26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE7B26 second address: EE7B2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE7B2A second address: EE7B5D instructions: 0x00000000 rdtsc 0x00000002 je 00007F6CBC6DD4A6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jng 00007F6CBC6DD4ACh 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pop edx 0x00000019 pushad 0x0000001a popad 0x0000001b pop eax 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F6CBC6DD4ADh 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE7B5D second address: EE7B7C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6CBCD93059h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE9428 second address: EE9431 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE9431 second address: EE9444 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6CBCD9304Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEBB99 second address: EEBB9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEBB9D second address: EEBBA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEBD06 second address: EEBD0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF005B second address: EF0060 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF0060 second address: EF0080 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F6CBC6DD4B9h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEF2E8 second address: EEF300 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6CBCD9304Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d jnp 00007F6CBCD93046h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEF455 second address: EEF45A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEF45A second address: EEF45F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEF45F second address: EEF465 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEFA39 second address: EEFA49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push esi 0x0000000b pop esi 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEFA49 second address: EEFA67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007F6CBC6DD4AAh 0x0000000b push edi 0x0000000c pop edi 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f popad 0x00000010 jng 00007F6CBC6DD4B2h 0x00000016 jp 00007F6CBC6DD4ACh 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEFB90 second address: EEFB9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEFB9E second address: EEFBA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF5A24 second address: EF5A3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6CBCD93053h 0x00000009 pop edi 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF6309 second address: EF630D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF65D8 second address: EF65E2 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6CBCD93046h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF65E2 second address: EF65E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF6875 second address: EF6879 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF6879 second address: EF6883 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6CBC6DD4A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF6883 second address: EF689A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F6CBCD9304Fh 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF689A second address: EF689E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF6BB1 second address: EF6BB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF6BB5 second address: EF6BD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6CBC6DD4B3h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF6BD1 second address: EF6BEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6CBCD93054h 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF6F03 second address: EF6F2C instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6CBC6DD4A6h 0x00000008 jc 00007F6CBC6DD4A6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F6CBC6DD4B7h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF6F2C second address: EF6F61 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F6CBCD93046h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F6CBCD93057h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jng 00007F6CBCD93051h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF6F61 second address: EF6F77 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6CBC6DD4AAh 0x00000007 push eax 0x00000008 push edx 0x00000009 jng 00007F6CBC6DD4A6h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF724E second address: EF727C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F6CBCD93046h 0x00000009 jmp 00007F6CBCD93055h 0x0000000e jmp 00007F6CBCD9304Eh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF96CE second address: EF96D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF96D2 second address: EF96D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF96D6 second address: EF96E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edx 0x0000000a pop edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFD3DB second address: EFD3DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFD3DF second address: EFD3FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6CBC6DD4ABh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007F6CBC6DD4A6h 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC701 second address: EFC738 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6CBCD93046h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F6CBCD93058h 0x00000012 popad 0x00000013 popad 0x00000014 jo 00007F6CBCD93072h 0x0000001a push eax 0x0000001b push edx 0x0000001c jng 00007F6CBCD93046h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC738 second address: EFC73C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC73C second address: EFC740 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC9D9 second address: EFC9DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC9DD second address: EFC9E7 instructions: 0x00000000 rdtsc 0x00000002 js 00007F6CBCD93046h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFCB21 second address: EFCB31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 jg 00007F6CBC6DD4A6h 0x0000000c pop eax 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFCB31 second address: EFCB42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 jp 00007F6CBCD93046h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFCB42 second address: EFCB46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFCB46 second address: EFCB61 instructions: 0x00000000 rdtsc 0x00000002 je 00007F6CBCD93046h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007F6CBCD93052h 0x00000013 jbe 00007F6CBCD93046h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFCB61 second address: EFCB68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFCB68 second address: EFCB6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFCB6D second address: EFCB75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFCB75 second address: EFCB80 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFCFCC second address: EFCFD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0A0CE second address: F0A112 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6CBCD9304Dh 0x00000007 jmp 00007F6CBCD93058h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007F6CBCD93056h 0x00000013 push edx 0x00000014 push edi 0x00000015 pop edi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0A112 second address: F0A13E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F6CBC6DD4B3h 0x0000000c jmp 00007F6CBC6DD4B2h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0A13E second address: F0A142 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0903A second address: F09048 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F6CBC6DD4A6h 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09048 second address: F09053 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09053 second address: F09059 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09059 second address: F09063 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6CBCD93064h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F096B7 second address: F096E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6CBC6DD4B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F6CBC6DD4B6h 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09F71 second address: F09F87 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jng 00007F6CBCD93046h 0x00000014 push edi 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F07E64 second address: F07E68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F07E68 second address: F07E73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0C694 second address: F0C69E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F6CBC6DD4A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0C69E second address: F0C6A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F11C82 second address: F11CC6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6CBC6DD4B6h 0x00000007 jnl 00007F6CBC6DD4B2h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jng 00007F6CBC6DD4C9h 0x00000015 push eax 0x00000016 push edx 0x00000017 je 00007F6CBC6DD4A6h 0x0000001d jmp 00007F6CBC6DD4AAh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1CDFE second address: F1CE04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F23644 second address: F23648 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F23648 second address: F23668 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6CBCD93052h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jg 00007F6CBCD93048h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F23668 second address: F2367C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F6CBC6DD4AEh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4588C second address: E45896 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F6CBCD93046h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F23057 second address: F2305D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2305D second address: F23090 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6CBCD93057h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6CBCD93054h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F23090 second address: F23094 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F23094 second address: F2309A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F23200 second address: F23216 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6CBC6DD4B2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F23216 second address: F2321A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F27E33 second address: F27E37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F27E37 second address: F27E68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F6CBCD9304Ch 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F6CBCD93055h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push edi 0x0000001a pop edi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F27E68 second address: F27E74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F27E74 second address: F27E8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F6CBCD93046h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d je 00007F6CBCD93052h 0x00000013 jnl 00007F6CBCD93046h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F27E8F second address: F27E93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F26B80 second address: F26B88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2F1CF second address: F2F1EF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F6CBC6DD4B8h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2F1EF second address: F2F1F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3094B second address: F30953 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F30953 second address: F30957 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3A91B second address: F3A91F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3A91F second address: F3A957 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6CBCD93052h 0x00000007 jmp 00007F6CBCD9304Fh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F6CBCD9304Eh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F39299 second address: F392A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F6CBC6DD4A6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F392A5 second address: F392B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F6CBCD9304Ah 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F393E1 second address: F393E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F393E5 second address: F3941A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6CBCD93052h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F6CBCD93052h 0x00000011 push edx 0x00000012 pop edx 0x00000013 jng 00007F6CBCD93046h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3941A second address: F3941F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3941F second address: F39429 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6CBCD93052h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F39429 second address: F3942F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F396B1 second address: F396C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F6CBCD9304Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F396C7 second address: F396D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F6CBC6DD4A6h 0x0000000a jng 00007F6CBC6DD4A6h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F396D8 second address: F396F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F6CBCD93046h 0x0000000a jmp 00007F6CBCD93053h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F396F5 second address: F396F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F39B3B second address: F39B51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F6CBCD9304Fh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F39B51 second address: F39B5D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3A66E second address: F3A672 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3D674 second address: F3D68B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F6CBC6DD4B2h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3D68B second address: F3D6AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6CBCD93051h 0x00000007 jnc 00007F6CBCD93048h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3D6AD second address: F3D6B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3D6B3 second address: F3D6CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6CBCD93052h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3D6CD second address: F3D6D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3D6D3 second address: F3D6D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F46F20 second address: F46F42 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6CBC6DD4B7h 0x00000007 push ebx 0x00000008 jbe 00007F6CBC6DD4A6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F46D81 second address: F46D85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F46D85 second address: F46D8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F46D8D second address: F46D93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F46D93 second address: F46DA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jne 00007F6CBC6DD4A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jng 00007F6CBC6DD4A6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4AB27 second address: F4AB2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F57A6D second address: F57A90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6CBC6DD4ACh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6CBC6DD4B0h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5ECBE second address: F5ECD8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6CBCD93054h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5ECD8 second address: F5ECF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6CBC6DD4B6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5ECF2 second address: F5ED0C instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6CBCD93046h 0x00000008 jmp 00007F6CBCD9304Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esi 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5ED0C second address: F5ED18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5ED18 second address: F5ED1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F009 second address: F5F011 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F130 second address: F5F13A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F13A second address: F5F13F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6A921 second address: F6A92B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F6CBCD93046h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6A92B second address: F6A931 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6A931 second address: F6A941 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6CBCD93046h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6A4AC second address: F6A4CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6CBC6DD4AEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jo 00007F6CBC6DD4A8h 0x00000010 push edi 0x00000011 pop edi 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6A4CB second address: F6A4CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F62382 second address: F6238B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6238B second address: F62391 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F62391 second address: F62397 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F62397 second address: F6239C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6239C second address: F623A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F6CBC6DD4A6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F62506 second address: F62511 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F62511 second address: F62515 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F62515 second address: F62536 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6CBCD93058h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push esi 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: CCDEF7 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E7E914 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: EA7A69 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F17944 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 54D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 5650000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 7650000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E566F9 rdtsc

0_2_00E566F9

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 4800

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2319035994.0000000000E5D000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2319035994.0000000000E5D000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E566F9 rdtsc

0_2_00E566F9

Source: C:\Users\user\Desktop\file.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: file.exe, 00000000.00000002.2319311627.0000000000EA3000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: [Program Manager

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\Desktop\file.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\Desktop\file.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	641 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	41 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Bypass User Account Control	261 Virtualization/Sandbox Evasion	Security Account Manager	261 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	22 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Bypass User Account Control	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	42%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Joe Sandbox ML

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1560427
Start date and time:	2024-11-21 19:57:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@1/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.20.68.201, 2.20.68.210
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, tse1.mm.bing.net, ctldl.windowsupdate.com, g.bing.com, a767.dspw65.akamai.net, arc.msn.com, wu-b-net.trafficmanager.net, download.windowsupdate.com.edgesuite.net
Report size getting too big, too many NtProtectVirtualMemory calls found.
VT rate limit hit for: file.exe

Process:	C:\Users\user\Desktop\file.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.472048727918367
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'823'680 bytes
MD5:	dd9ad82b68a13333652866431f0ee8d9
SHA1:	23b45a0875b428204f4f3448442aae222274612f
SHA256:	8ba30fce56df7cd2c37d70dda3dbde19b2d5ff5c3896e791e484f2a1838fd106
SHA512:	35311c88fd3fa87f3ecbb4442c77d349673fcf8f7d6b68ba781efd1a95ef562a26dc3623437304f1b69bc128f8dce28656cf28a1e79d2ff0528d6c93def13ee7
SSDEEP:	24576:sn+QXRsBACBZyUN127toM2LMkGhQZFs7/kKLe1dpP2DSm1rwEIaMAygb67G50uey:w+QRW7Z7Py17EuDS3vAbkTle38WX
TLSH:	7ED54BA2B94576CFE48F27749527DE82595D07FA07204CE3E86EB47A7E63CC012B6C24
File Content Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. ........................+.......+...`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x6b8000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE
Time Stamp:	0x652C2850 [Sun Oct 15 17:58:40 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F6CBCDE09DAh
pmuludq mm5, qword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or al, 80h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], bh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax+00000000h], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8055	0x69	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6000	0x59c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x81f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x2000	0x4000	0x1200	d5b8e0032602464d297b15cb279a1eba	False	0.9331597222222222	data	7.795059537791165	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x6000	0x59c	0x600	aae15e30898a02f09cc86ed48aa06b09	False	0.4140625	data	4.036947054771808	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x8000	0x2000	0x200	ec9cb51e8cb4ea49a56ee3cf434fb69e	False	0.1484375	data	0.9342685949460681	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
tbudukip	0xa000	0x2ac000	0x2ab600	09dde8d2e5031e612f0358e20e0d083e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
fmefboji	0x2b6000	0x2000	0x400	ccc063126ffbed6f9e310d95592b616e	False	0.7998046875	data	6.2134144822570825	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x2b8000	0x4000	0x2200	39c2c28b04c9c8026344b9d27de2841f	False	0.053998161764705885	DOS executable (COM)	0.640048909829833	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x6090	0x30c	data			0.42948717948717946
RT_MANIFEST	0x63ac	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
kernel32.dll	lstrcpy

Target ID:	0
Start time:	13:58:02
Start date:	21/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xcc0000
File size:	2'823'680 bytes
MD5 hash:	DD9AD82B68A13333652866431F0EE8D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.6%
Dynamic/Decrypted Code Coverage:	45%
Signature Coverage:	10%
Total number of Nodes:	20
Total number of Limit Nodes:	0

Executed Functions

Function 00E566F9 Relevance: 1.6, APIs: 1, Instructions: 127
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00E566F9

Memory Dump Source

Source File: 00000000.00000002.2319035994.0000000000E53000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2318650224.0000000000CC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318671096.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318695288.0000000000CC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318716136.0000000000CCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318735742.0000000000CD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318757795.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318779826.0000000000CD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318992601.0000000000E38000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319013163.0000000000E3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319035994.0000000000E5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319078335.0000000000E66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319108846.0000000000E67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319128609.0000000000E68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319149567.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319172479.0000000000E79000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319191576.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319215518.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319231262.0000000000E90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319253571.0000000000E91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319272067.0000000000E98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319293907.0000000000E99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319311627.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319333914.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319363588.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319388275.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319604738.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319644200.0000000000ECE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319676497.0000000000ED0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319709533.0000000000ED1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319737085.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319769609.0000000000ED7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319807614.0000000000EDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319895535.0000000000EDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319954198.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319987883.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320018340.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320044354.0000000000EED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320076976.0000000000EF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320112694.0000000000EF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320141234.0000000000EF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320166193.0000000000EFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320199559.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320234000.0000000000F0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320262747.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320301319.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320324276.0000000000F28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320365741.0000000000F61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320365741.0000000000F67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320421670.0000000000F76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320456471.0000000000F78000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 2f4625e472c3b35a53fbffdf500f68947f57176e042fee341f19833365bcb042
Instruction ID: 03e28e31e1b042f94d27387613e73a1f33240b8d1651a6a4a041acc2d594a078
Opcode Fuzzy Hash: 2f4625e472c3b35a53fbffdf500f68947f57176e042fee341f19833365bcb042
Instruction Fuzzy Hash: 31415EB151C310AFE3156F18E8816BEF7E8FF94714F11082EE6C693200D73558548B9B

Function 00E59847 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 87
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?), ref: 00E598D6

Strings

C, xrefs: 00E59ADF

Memory Dump Source

Source File: 00000000.00000002.2319035994.0000000000E53000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2318650224.0000000000CC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318671096.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318695288.0000000000CC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318716136.0000000000CCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318735742.0000000000CD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318757795.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318779826.0000000000CD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318992601.0000000000E38000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319013163.0000000000E3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319035994.0000000000E5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319078335.0000000000E66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319108846.0000000000E67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319128609.0000000000E68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319149567.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319172479.0000000000E79000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319191576.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319215518.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319231262.0000000000E90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319253571.0000000000E91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319272067.0000000000E98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319293907.0000000000E99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319311627.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319333914.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319363588.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319388275.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319604738.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319644200.0000000000ECE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319676497.0000000000ED0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319709533.0000000000ED1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319737085.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319769609.0000000000ED7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319807614.0000000000EDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319895535.0000000000EDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319954198.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319987883.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320018340.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320044354.0000000000EED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320076976.0000000000EF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320112694.0000000000EF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320141234.0000000000EF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320166193.0000000000EFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320199559.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320234000.0000000000F0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320262747.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320301319.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320324276.0000000000F28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320365741.0000000000F61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320365741.0000000000F67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320421670.0000000000F76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320456471.0000000000F78000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: CreateFile
String ID: C
API String ID: 823142352-1037565863
Opcode ID: 0e13e6ee9c164eb5ee3f152ce9b26616761d6535f66100da7123339d3cf86018
Instruction ID: 8e2eb183dc7398b3470ff650a927baf65727fde126203153bfb66eb3de0218f5
Opcode Fuzzy Hash: 0e13e6ee9c164eb5ee3f152ce9b26616761d6535f66100da7123339d3cf86018
Instruction Fuzzy Hash: 3C21F6B208811AEDE7028E549A805FE776DF7D7330B30492AFC06A6943D3E51E0DA634

Function 00E59868 Relevance: 1.6, APIs: 1, Instructions: 72
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?), ref: 00E598D6

Memory Dump Source

Source File: 00000000.00000002.2319035994.0000000000E53000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2318650224.0000000000CC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318671096.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318695288.0000000000CC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318716136.0000000000CCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318735742.0000000000CD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318757795.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318779826.0000000000CD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318992601.0000000000E38000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319013163.0000000000E3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319035994.0000000000E5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319078335.0000000000E66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319108846.0000000000E67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319128609.0000000000E68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319149567.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319172479.0000000000E79000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319191576.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319215518.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319231262.0000000000E90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319253571.0000000000E91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319272067.0000000000E98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319293907.0000000000E99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319311627.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319333914.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319363588.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319388275.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319604738.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319644200.0000000000ECE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319676497.0000000000ED0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319709533.0000000000ED1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319737085.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319769609.0000000000ED7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319807614.0000000000EDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319895535.0000000000EDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319954198.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319987883.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320018340.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320044354.0000000000EED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320076976.0000000000EF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320112694.0000000000EF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320141234.0000000000EF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320166193.0000000000EFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320199559.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320234000.0000000000F0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320262747.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320301319.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320324276.0000000000F28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320365741.0000000000F61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320365741.0000000000F67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320421670.0000000000F76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320456471.0000000000F78000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 6d89836bdf5609a57f72d9661e39a04d516b3cf905233d439093e5dca1c480d9
Instruction ID: 781fa4d490ce1e4837fdf12645859b56eacada754492fe4d87e5258ca0d6948b
Opcode Fuzzy Hash: 6d89836bdf5609a57f72d9661e39a04d516b3cf905233d439093e5dca1c480d9
Instruction Fuzzy Hash: 5901E5F6089116EDA6068E619A404FEBB3DF6C3331330596AFC02A6843E3901E0E5231

Function 054D0D41 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 054D0DCD

Memory Dump Source

Source File: 00000000.00000002.2327299433.00000000054D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54d0000_file.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 26bf5c633f36aebdb7e5a5de984dbc71a82a3ee5b54485b7c1e71c27244528e1
Instruction ID: 4352c99177b0768f548591ad76d9f6df5f4cb804633df3ca3ebf99598e688ad2
Opcode Fuzzy Hash: 26bf5c633f36aebdb7e5a5de984dbc71a82a3ee5b54485b7c1e71c27244528e1
Instruction Fuzzy Hash: 0B2134BAC002199FCB50CF99D984BDEFBB0FF88320F14865AD909AB204D774A541CBA4

Function 054D0D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 054D0DCD

Memory Dump Source

Source File: 00000000.00000002.2327299433.00000000054D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54d0000_file.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: e0483535596b2c861f0cdfacaa7fe30750005e926264d521c143aa0840f8f8ee
Instruction ID: 4c75544c988ab9dfe6f71dd9fe4e5c5ee809a835783594fa802c38c6fe03a601
Opcode Fuzzy Hash: e0483535596b2c861f0cdfacaa7fe30750005e926264d521c143aa0840f8f8ee
Instruction Fuzzy Hash: A12102B68012199FCB50CF9AD884ADEFBB4FF88720F14825AD909AB204D774A540CBA4

Function 054D1509 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 054D1580

Memory Dump Source

Source File: 00000000.00000002.2327299433.00000000054D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54d0000_file.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 9a6cdb4fac9250f09353b5451cbbe6961fa43561b493f5aee8d4097b59886db9
Instruction ID: f6723cb0bc2669faac423200a7d63e19ca825b2d844c3bcca34d0ca4ff36bfff
Opcode Fuzzy Hash: 9a6cdb4fac9250f09353b5451cbbe6961fa43561b493f5aee8d4097b59886db9
Instruction Fuzzy Hash: B22103B69002498FDB10CF9AC584BDEFBF4BF48320F10842AE959A3250D778A644CFA5

Function 054D1510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 054D1580

Memory Dump Source

Source File: 00000000.00000002.2327299433.00000000054D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54d0000_file.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 5354a7120335c7c64c11ebdbf6123367b17e6cebf59f1e54706ee2ddae1998f5
Instruction ID: c141efd4e114b4022000c26879d2130d3e6112b00b9158a36acbba39a18af699
Opcode Fuzzy Hash: 5354a7120335c7c64c11ebdbf6123367b17e6cebf59f1e54706ee2ddae1998f5
Instruction Fuzzy Hash: E111D3B59002499FDB10CF9AC584BDEFBF4AB48320F10842AE959A3250D778A644CFA5

Function 054D1301 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 054D1367

Memory Dump Source

Source File: 00000000.00000002.2327299433.00000000054D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54d0000_file.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 49e7243e4b4acf86be1e07bf5b2084b6f9c05b1f86ac5b07039467db214849d5
Instruction ID: 665524c2c96693a13253fa034f777debd62f5d6ddf5ca73cd3c499aff66dff24
Opcode Fuzzy Hash: 49e7243e4b4acf86be1e07bf5b2084b6f9c05b1f86ac5b07039467db214849d5
Instruction Fuzzy Hash: AA1125B2800249CFDB10CF9AD585BDEFBF4EF49324F24846AD918A3250D778A584CFA1

Function 054D1308 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 054D1367

Memory Dump Source

Source File: 00000000.00000002.2327299433.00000000054D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54d0000_file.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 8d7fc6b9806c8d5051475c8e9c267ad38928281bc2bc8ab49b1eda714e228839
Instruction ID: 5350602ae18ab3913fb508078ef020a2b01b7bf609c3efb737fc02392e2c493f
Opcode Fuzzy Hash: 8d7fc6b9806c8d5051475c8e9c267ad38928281bc2bc8ab49b1eda714e228839
Instruction Fuzzy Hash: 6011F2B1800249CFDB10CF9AC545BDEFBF8AF48724F24846AD918A3650D778A944CBA5

Function 00E598B4 Relevance: 1.5, APIs: 1, Instructions: 46
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?), ref: 00E598D6

Memory Dump Source

Source File: 00000000.00000002.2319035994.0000000000E53000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2318650224.0000000000CC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318671096.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318695288.0000000000CC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318716136.0000000000CCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318735742.0000000000CD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318757795.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318779826.0000000000CD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318992601.0000000000E38000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319013163.0000000000E3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319035994.0000000000E5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319078335.0000000000E66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319108846.0000000000E67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319128609.0000000000E68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319149567.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319172479.0000000000E79000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319191576.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319215518.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319231262.0000000000E90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319253571.0000000000E91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319272067.0000000000E98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319293907.0000000000E99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319311627.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319333914.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319363588.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319388275.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319604738.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319644200.0000000000ECE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319676497.0000000000ED0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319709533.0000000000ED1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319737085.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319769609.0000000000ED7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319807614.0000000000EDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319895535.0000000000EDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319954198.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319987883.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320018340.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320044354.0000000000EED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320076976.0000000000EF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320112694.0000000000EF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320141234.0000000000EF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320166193.0000000000EFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320199559.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320234000.0000000000F0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320262747.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320301319.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320324276.0000000000F28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320365741.0000000000F61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320365741.0000000000F67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320421670.0000000000F76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320456471.0000000000F78000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4fe7bc4c5213b5ca60b99401c895365638870d2c044c79569f0a5ac3e33622a8
Instruction ID: d37627bbe3ad52d7e03f70f4723f0707467fe3d999265dfd81cba1aa0fcd4d26
Opcode Fuzzy Hash: 4fe7bc4c5213b5ca60b99401c895365638870d2c044c79569f0a5ac3e33622a8
Instruction Fuzzy Hash: D9F084A7088211ED82228E988A80CEA7A7AFBC3331330595EEC12E2943D3A40C0C6260

Function 00E59A16 Relevance: 1.5, APIs: 1, Instructions: 34
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00E59A81

Memory Dump Source

Source File: 00000000.00000002.2319035994.0000000000E53000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2318650224.0000000000CC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318671096.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318695288.0000000000CC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318716136.0000000000CCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318735742.0000000000CD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318757795.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318779826.0000000000CD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318992601.0000000000E38000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319013163.0000000000E3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319035994.0000000000E5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319078335.0000000000E66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319108846.0000000000E67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319128609.0000000000E68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319149567.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319172479.0000000000E79000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319191576.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319215518.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319231262.0000000000E90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319253571.0000000000E91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319272067.0000000000E98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319293907.0000000000E99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319311627.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319333914.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319363588.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319388275.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319604738.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319644200.0000000000ECE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319676497.0000000000ED0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319709533.0000000000ED1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319737085.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319769609.0000000000ED7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319807614.0000000000EDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319895535.0000000000EDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319954198.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319987883.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320018340.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320044354.0000000000EED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320076976.0000000000EF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320112694.0000000000EF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320141234.0000000000EF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320166193.0000000000EFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320199559.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320234000.0000000000F0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320262747.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320301319.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320324276.0000000000F28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320365741.0000000000F61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320365741.0000000000F67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320421670.0000000000F76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320456471.0000000000F78000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ca3bcf9e4a0bd25a71dc4a0a3b23bb04de3c6454345193fbe74b70a7b000b058
Instruction ID: ab0867f6229830619a855984ba4acfc23eba48acb022f30e2969ef1aa629b4da
Opcode Fuzzy Hash: ca3bcf9e4a0bd25a71dc4a0a3b23bb04de3c6454345193fbe74b70a7b000b058
Instruction Fuzzy Hash: 3FF02777549203CD9700CF61EE818E93365EAC2321730AE2ADD02EB153D338454D8575

Function 00E59A36 Relevance: 1.5, APIs: 1, Instructions: 28
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00E59A81

Memory Dump Source

Source File: 00000000.00000002.2319035994.0000000000E53000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2318650224.0000000000CC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318671096.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318695288.0000000000CC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318716136.0000000000CCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318735742.0000000000CD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318757795.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318779826.0000000000CD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318992601.0000000000E38000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319013163.0000000000E3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319035994.0000000000E5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319078335.0000000000E66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319108846.0000000000E67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319128609.0000000000E68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319149567.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319172479.0000000000E79000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319191576.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319215518.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319231262.0000000000E90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319253571.0000000000E91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319272067.0000000000E98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319293907.0000000000E99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319311627.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319333914.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319363588.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319388275.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319604738.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319644200.0000000000ECE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319676497.0000000000ED0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319709533.0000000000ED1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319737085.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319769609.0000000000ED7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319807614.0000000000EDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319895535.0000000000EDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319954198.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319987883.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320018340.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320044354.0000000000EED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320076976.0000000000EF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320112694.0000000000EF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320141234.0000000000EF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320166193.0000000000EFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320199559.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320234000.0000000000F0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320262747.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320301319.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320324276.0000000000F28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320365741.0000000000F61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320365741.0000000000F67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320421670.0000000000F76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320456471.0000000000F78000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: aa4b9f86c093517d27bc209ec255cce84241ee6c676d72025ef173bc12a20a5b
Instruction ID: c454e29f1b5558c601218af5ce4d5cdce789ca6aaa883fa2494228f630566f83
Opcode Fuzzy Hash: aa4b9f86c093517d27bc209ec255cce84241ee6c676d72025ef173bc12a20a5b
Instruction Fuzzy Hash: E6E09276948113CD9604CE64D9C59FD3369E9813123307C29D802EB407D228894E4674

Function 00E59A4F Relevance: 1.5, APIs: 1, Instructions: 25
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00E59A81

Memory Dump Source

Source File: 00000000.00000002.2319035994.0000000000E53000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2318650224.0000000000CC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318671096.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318695288.0000000000CC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318716136.0000000000CCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318735742.0000000000CD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318757795.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318779826.0000000000CD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318992601.0000000000E38000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319013163.0000000000E3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319035994.0000000000E5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319078335.0000000000E66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319108846.0000000000E67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319128609.0000000000E68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319149567.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319172479.0000000000E79000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319191576.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319215518.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319231262.0000000000E90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319253571.0000000000E91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319272067.0000000000E98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319293907.0000000000E99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319311627.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319333914.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319363588.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319388275.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319604738.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319644200.0000000000ECE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319676497.0000000000ED0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319709533.0000000000ED1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319737085.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319769609.0000000000ED7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319807614.0000000000EDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319895535.0000000000EDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319954198.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319987883.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320018340.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320044354.0000000000EED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320076976.0000000000EF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320112694.0000000000EF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320141234.0000000000EF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320166193.0000000000EFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320199559.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320234000.0000000000F0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320262747.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320301319.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320324276.0000000000F28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320365741.0000000000F61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320365741.0000000000F67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320421670.0000000000F76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320456471.0000000000F78000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 47f1047b89a33284c2536e1ddb3142f89bd1b45cf717b5d62a34730c8bc81f09
Instruction ID: 2a322e853081aab4cdf4264c2837aa949ca63514c798bde46353c26888561fbc
Opcode Fuzzy Hash: 47f1047b89a33284c2536e1ddb3142f89bd1b45cf717b5d62a34730c8bc81f09
Instruction Fuzzy Hash: 34E08CB56442239CD601CE698E859FE736DE9C23223206A2AED02EB487E328494E8174

Function 00E59A5A Relevance: 1.5, APIs: 1, Instructions: 25
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00E59A81

Memory Dump Source

Source File: 00000000.00000002.2319035994.0000000000E53000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2318650224.0000000000CC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318671096.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318695288.0000000000CC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318716136.0000000000CCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318735742.0000000000CD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318757795.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318779826.0000000000CD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318992601.0000000000E38000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319013163.0000000000E3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319035994.0000000000E5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319078335.0000000000E66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319108846.0000000000E67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319128609.0000000000E68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319149567.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319172479.0000000000E79000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319191576.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319215518.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319231262.0000000000E90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319253571.0000000000E91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319272067.0000000000E98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319293907.0000000000E99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319311627.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319333914.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319363588.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319388275.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319604738.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319644200.0000000000ECE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319676497.0000000000ED0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319709533.0000000000ED1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319737085.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319769609.0000000000ED7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319807614.0000000000EDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319895535.0000000000EDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319954198.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319987883.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320018340.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320044354.0000000000EED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320076976.0000000000EF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320112694.0000000000EF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320141234.0000000000EF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320166193.0000000000EFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320199559.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320234000.0000000000F0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320262747.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320301319.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320324276.0000000000F28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320365741.0000000000F61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320365741.0000000000F67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320421670.0000000000F76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320456471.0000000000F78000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 87118365ceb7d75aaef68eec6c367d96a4f5a3857a3a1d878ef3581e95495a78
Instruction ID: c53f1ff570c285ee302cd5ddb64dc1fd1dfeec198edd992ee9aeaa9bde8af3ac
Opcode Fuzzy Hash: 87118365ceb7d75aaef68eec6c367d96a4f5a3857a3a1d878ef3581e95495a78
Instruction Fuzzy Hash: 34E0CD755402139DD604CE754E85CFE736AF9E2311330AD1ED902AB507D63A594A4135

Function 00E6262E Relevance: 1.5, APIs: 1, Instructions: 24
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00E62661

Memory Dump Source

Source File: 00000000.00000002.2319035994.0000000000E5D000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2318650224.0000000000CC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318671096.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318695288.0000000000CC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318716136.0000000000CCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318735742.0000000000CD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318757795.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318779826.0000000000CD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318992601.0000000000E38000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319013163.0000000000E3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319035994.0000000000E53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319078335.0000000000E66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319108846.0000000000E67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319128609.0000000000E68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319149567.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319172479.0000000000E79000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319191576.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319215518.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319231262.0000000000E90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319253571.0000000000E91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319272067.0000000000E98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319293907.0000000000E99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319311627.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319333914.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319363588.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319388275.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319604738.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319644200.0000000000ECE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319676497.0000000000ED0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319709533.0000000000ED1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319737085.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319769609.0000000000ED7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319807614.0000000000EDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319895535.0000000000EDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319954198.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319987883.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320018340.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320044354.0000000000EED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320076976.0000000000EF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320112694.0000000000EF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320141234.0000000000EF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320166193.0000000000EFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320199559.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320234000.0000000000F0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320262747.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320301319.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320324276.0000000000F28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320365741.0000000000F61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320365741.0000000000F67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320421670.0000000000F76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320456471.0000000000F78000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9896b5c997f84c4e58e85b0d20e3310be2c336f1b006fa18252c8e2ef460d8f0
Instruction ID: e286c9ca33f455129e512e8b8f309a4f7c493cbd81cc2bceba65b3279d65a92c
Opcode Fuzzy Hash: 9896b5c997f84c4e58e85b0d20e3310be2c336f1b006fa18252c8e2ef460d8f0
Instruction Fuzzy Hash: B8E01A3250C129CBD719AF78A8558BEFBE0EF08244F06493ED4D2D3940DF7595448B82

Function 00CCE6F2 Relevance: 1.3, APIs: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 00CCE787

Memory Dump Source

Source File: 00000000.00000002.2318716136.0000000000CCA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2318650224.0000000000CC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318671096.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318695288.0000000000CC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318735742.0000000000CD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318757795.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318779826.0000000000CD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318992601.0000000000E38000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319013163.0000000000E3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319035994.0000000000E53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319035994.0000000000E5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319078335.0000000000E66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319108846.0000000000E67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319128609.0000000000E68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319149567.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319172479.0000000000E79000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319191576.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319215518.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319231262.0000000000E90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319253571.0000000000E91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319272067.0000000000E98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319293907.0000000000E99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319311627.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319333914.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319363588.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319388275.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319604738.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319644200.0000000000ECE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319676497.0000000000ED0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319709533.0000000000ED1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319737085.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319769609.0000000000ED7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319807614.0000000000EDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319895535.0000000000EDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319954198.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319987883.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320018340.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320044354.0000000000EED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320076976.0000000000EF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320112694.0000000000EF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320141234.0000000000EF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320166193.0000000000EFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320199559.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320234000.0000000000F0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320262747.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320301319.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320324276.0000000000F28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320365741.0000000000F61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320365741.0000000000F67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320421670.0000000000F76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320456471.0000000000F78000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b9ef1d6a92ef198ec1d3fa6001a7cfb7427c73c8ed6928fb8032fb511937619b
Instruction ID: 78748c10876f831f50cb7f0af0437d9b3cc8264966e5124fc983d358da791740
Opcode Fuzzy Hash: b9ef1d6a92ef198ec1d3fa6001a7cfb7427c73c8ed6928fb8032fb511937619b
Instruction Fuzzy Hash: 93218BB650C600EFD3046F16C841F7EBBF5EF94710F21492DE6D6862A0E33158A2AB27

Function 00CCEA1E Relevance: 1.3, APIs: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 00CCF3F6

Memory Dump Source

Source File: 00000000.00000002.2318716136.0000000000CCA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2318650224.0000000000CC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318671096.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318695288.0000000000CC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318735742.0000000000CD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318757795.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318779826.0000000000CD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318992601.0000000000E38000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319013163.0000000000E3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319035994.0000000000E53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319035994.0000000000E5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319078335.0000000000E66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319108846.0000000000E67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319128609.0000000000E68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319149567.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319172479.0000000000E79000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319191576.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319215518.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319231262.0000000000E90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319253571.0000000000E91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319272067.0000000000E98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319293907.0000000000E99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319311627.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319333914.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319363588.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319388275.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319604738.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319644200.0000000000ECE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319676497.0000000000ED0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319709533.0000000000ED1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319737085.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319769609.0000000000ED7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319807614.0000000000EDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319895535.0000000000EDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319954198.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319987883.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320018340.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320044354.0000000000EED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320076976.0000000000EF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320112694.0000000000EF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320141234.0000000000EF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320166193.0000000000EFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320199559.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320234000.0000000000F0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320262747.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320301319.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320324276.0000000000F28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320365741.0000000000F61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320365741.0000000000F67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320421670.0000000000F76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320456471.0000000000F78000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e1cb928651af2e8b71697779d9bc56c55254a5a9855540b4a07cbca7612dde05
Instruction ID: f73a5233560093747ee63717628cb8d7920b369a5898311991f9ae48ce454e0e
Opcode Fuzzy Hash: e1cb928651af2e8b71697779d9bc56c55254a5a9855540b4a07cbca7612dde05
Instruction Fuzzy Hash: BBF03AF540C209EBEB152F10D808BBD7BA1EB04311F14462DEAA281A90E2330D61AA9B

Non-executed Functions

Function 00EDBB1E Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2319769609.0000000000ED7000.00000080.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2318650224.0000000000CC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318671096.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318695288.0000000000CC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318716136.0000000000CCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318735742.0000000000CD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318757795.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318779826.0000000000CD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318992601.0000000000E38000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319013163.0000000000E3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319035994.0000000000E53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319035994.0000000000E5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319078335.0000000000E66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319108846.0000000000E67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319128609.0000000000E68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319149567.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319172479.0000000000E79000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319191576.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319215518.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319231262.0000000000E90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319253571.0000000000E91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319272067.0000000000E98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319293907.0000000000E99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319311627.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319333914.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319363588.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319388275.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319604738.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319644200.0000000000ECE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319676497.0000000000ED0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319709533.0000000000ED1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319737085.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319807614.0000000000EDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319895535.0000000000EDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319954198.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319987883.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320018340.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320044354.0000000000EED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320076976.0000000000EF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320112694.0000000000EF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320141234.0000000000EF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320166193.0000000000EFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320199559.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320234000.0000000000F0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320262747.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320301319.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320324276.0000000000F28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320365741.0000000000F61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320365741.0000000000F67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320421670.0000000000F76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320456471.0000000000F78000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 076264cd1e3c8beeda8981b3a54ca3dd6abec53a6f3460c96b0c5faf235c690f
Instruction ID: ca7057b1b86de59532790e9e5982206fa0ca6aca8e36a6243b29acfc6289ba06
Opcode Fuzzy Hash: 076264cd1e3c8beeda8981b3a54ca3dd6abec53a6f3460c96b0c5faf235c690f
Instruction Fuzzy Hash: 5A5147B350C2044FD708BE29EC9567AFBE5EF98320F5A052DDBD683740EE7514148692

Function 00CCDFCC Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2318716136.0000000000CCA000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2318650224.0000000000CC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318671096.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318695288.0000000000CC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318735742.0000000000CD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318757795.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318779826.0000000000CD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318992601.0000000000E38000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319013163.0000000000E3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319035994.0000000000E53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319035994.0000000000E5D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319078335.0000000000E66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319108846.0000000000E67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319128609.0000000000E68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319149567.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319172479.0000000000E79000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319191576.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319215518.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319231262.0000000000E90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319253571.0000000000E91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319272067.0000000000E98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319293907.0000000000E99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319311627.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319333914.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319363588.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319388275.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319604738.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319644200.0000000000ECE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319676497.0000000000ED0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319709533.0000000000ED1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319737085.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319769609.0000000000ED7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319807614.0000000000EDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319895535.0000000000EDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319954198.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319987883.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320018340.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320044354.0000000000EED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320076976.0000000000EF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320112694.0000000000EF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320141234.0000000000EF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320166193.0000000000EFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320199559.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320234000.0000000000F0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320262747.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320301319.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320324276.0000000000F28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320365741.0000000000F61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320365741.0000000000F67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320421670.0000000000F76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320456471.0000000000F78000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7491b88bebda617f9910a2e0d55fcd0ac5439a666701c8b878cfc2bf5fdfd1a4
Instruction ID: dde7ff4cccd1e52fbaa4aae748036ffde33d1b358881ae18967858449f51a823
Opcode Fuzzy Hash: 7491b88bebda617f9910a2e0d55fcd0ac5439a666701c8b878cfc2bf5fdfd1a4
Instruction Fuzzy Hash: 08212B3650461E8BDB118E35C485BEF77A1EF57320F24412ED84287A42CAE64E16FBD8

Function 00E61080 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2319035994.0000000000E5D000.00000040.00000001.01000000.00000003.sdmp, Offset: 00CC0000, based on PE: true

Associated: 00000000.00000002.2318650224.0000000000CC0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318671096.0000000000CC2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318695288.0000000000CC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318716136.0000000000CCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318735742.0000000000CD4000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318757795.0000000000CD5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318779826.0000000000CD6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2318992601.0000000000E38000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319013163.0000000000E3A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319035994.0000000000E53000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319078335.0000000000E66000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319108846.0000000000E67000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319128609.0000000000E68000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319149567.0000000000E69000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319172479.0000000000E79000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319191576.0000000000E7A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319215518.0000000000E8F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319231262.0000000000E90000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319253571.0000000000E91000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319272067.0000000000E98000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319293907.0000000000E99000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319311627.0000000000EA3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319333914.0000000000EB1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319363588.0000000000EB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319388275.0000000000EC3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319604738.0000000000EC5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319644200.0000000000ECE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319676497.0000000000ED0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319709533.0000000000ED1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319737085.0000000000ED6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319769609.0000000000ED7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319807614.0000000000EDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319895535.0000000000EDD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319954198.0000000000EE1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2319987883.0000000000EEA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320018340.0000000000EEC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320044354.0000000000EED000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320076976.0000000000EF0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320112694.0000000000EF1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320141234.0000000000EF7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320166193.0000000000EFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320199559.0000000000F02000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320234000.0000000000F0A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320262747.0000000000F0D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320301319.0000000000F27000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320324276.0000000000F28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320365741.0000000000F61000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320365741.0000000000F67000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320421670.0000000000F76000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2320456471.0000000000F78000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4599c5c5c4cef4c2a92fa4da44fe9d0aada6ced500c2758f793f239db6b0275
Instruction ID: dfcdc7c6d730f44d4a8aab85b9d61d730d0ad3fd77de9512be8bd47f5828b043
Opcode Fuzzy Hash: b4599c5c5c4cef4c2a92fa4da44fe9d0aada6ced500c2758f793f239db6b0275
Instruction Fuzzy Hash: B321EAB25CE218DFD7426994BC457FBB2D89B053D0F2E28ADDB92F7200E5654840A7D2

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: file.exePID: 672, Parent PID: 4004

General

Chronological Activities

Disassembly

Analysis Process: file.exePID: 672, Parent PID: 4004COMMON

Execution Graph

Graph

Executed Functions

Function 00E566F9 Relevance: 1.6, APIs: 1, Instructions: 127libraryCOMMON

Windows Analysis Report
file.exe

Function 00E566F9 Relevance: 1.6, APIs: 1, Instructions: 127
libraryCOMMON

Function 00E59847 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 87
fileCOMMON

Function 00E59868 Relevance: 1.6, APIs: 1, Instructions: 72
fileCOMMON

Function 054D0D41 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Function 054D0D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Function 054D1509 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Function 054D1510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Function 054D1301 Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Function 054D1308 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 00E598B4 Relevance: 1.5, APIs: 1, Instructions: 46
fileCOMMON

Function 00E59A16 Relevance: 1.5, APIs: 1, Instructions: 34
fileCOMMON

Function 00E59A36 Relevance: 1.5, APIs: 1, Instructions: 28
fileCOMMON

Function 00E59A4F Relevance: 1.5, APIs: 1, Instructions: 25
fileCOMMON

Function 00E59A5A Relevance: 1.5, APIs: 1, Instructions: 25
fileCOMMON

Function 00E6262E Relevance: 1.5, APIs: 1, Instructions: 24
libraryCOMMON