Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1565665
MD5:	c54023b84d77e5ce72a48eda24bbc227
SHA1:	21c893f54354a48114c3d36e938f69f7d7f32430
SHA256:	e2cee0f3aa497ae6990b9ff45110eaf89a95b31e34383ef8c655bf1a12544d43
Tags:	exeuser-Bitsight
Infos:

Detection

Nymaim

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Nymaim

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found potential dummy code loops (likely to delay analysis)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Abnormal high CPU Usage

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 5796 cmdline: "C:\Users\user\Desktop\file.exe" MD5: C54023B84D77E5CE72A48EDA24BBC227)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Nymaim	Nymaim is a trojan downloader. It downloads (and runs) other malware on affected systems and was one of the primary malware families hosted on Avalanche. Nymaim is different in that it displays a localized lockscreen while it downloads additional malware. Nymaim is usually delivered by exploit kits and malvertising.	No Attribution	https://arielkoren.com/blog/2016/11/02/nymaim-deep-technical-dive-adventures-in-evasive-malware/ https://bitbucket.org/daniel_plohmann/idapatchwork https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/goznym/ https://github.com/coldshell/Malware-Scripts/tree/master/Nymaim	https://malpedia.caad.fkie.fraunhofer.de/details/win.nymaim

Malware Configuration

Threatname: Nymaim

{"C2 addresses": ["185.156.72.65", "185.156.72.65", "185.156.72.65", "185.156.72.65"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.4101686121.00000000047A0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x8436:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000003.1656980225.0000000004A40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89

Unpacked PEs

Source	Rule	Description	Author
0.3.file.exe.4a40000.0.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.2.file.exe.4950e67.1.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.2.file.exe.400000.0.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.2.file.exe.400000.0.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://185.156.72.65/add?substr=mixtwo&s=three&sub=nosubPj

Avira URL Cloud: Label: malware

Found malware configuration

Source: 0.3.file.exe.4a40000.0.raw.unpack

Malware Configuration Extractor: Nymaim {"C2 addresses": ["185.156.72.65", "185.156.72.65", "185.156.72.65", "185.156.72.65"]}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 31%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004035D0 CryptAcquireContextW,CryptCreateHash,CryptHashData,GetLastError,CryptDeriveKey,GetLastError,CryptReleaseContext,CryptDecrypt,CryptDestroyKey,		0_2_004035D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04953837 CryptAcquireContextW,CryptCreateHash,CryptHashData,GetLastError,CryptDeriveKey,GetLastError,CryptReleaseContext,CryptDecrypt,CryptDestroyKey,		0_2_04953837

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 185.156.72.65
Source: Malware configuration extractor	IPs: 185.156.72.65
Source: Malware configuration extractor	IPs: 185.156.72.65
Source: Malware configuration extractor	IPs: 185.156.72.65

Source: Joe Sandbox View

IP Address: 185.156.72.65 185.156.72.65

Source: Joe Sandbox View

ASN Name: ITDELUXE-ASRU ITDELUXE-ASRU

Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00401970 HttpAddRequestHeadersA,InternetSetFilePointer,InternetReadFile,HttpQueryInfoA,CoCreateInstance,

0_2_00401970

Source: global traffic	HTTP traffic detected: GET /add?substr=mixtwo&s=three&sub=nosub HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /add?substr=mixtwo&s=three&sub=nosub HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /add?substr=mixtwo&s=three&sub=nosub HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /add?substr=mixtwo&s=three&sub=nosub HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /add?substr=mixtwo&s=three&sub=nosub HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /add?substr=mixtwo&s=three&sub=nosub HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /add?substr=mixtwo&s=three&sub=nosub HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /add?substr=mixtwo&s=three&sub=nosub HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /add?substr=mixtwo&s=three&sub=nosub HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /add?substr=mixtwo&s=three&sub=nosub HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /add?substr=mixtwo&s=three&sub=nosub HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache

Source: file.exe, 00000000.00000002.4100666631.0000000000C62000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4100666631.0000000000C2D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.4100666631.0000000000C67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.72.65/add?substr=mixtwo&s=three&sub=nosub
Source: file.exe, 00000000.00000002.4100666631.0000000000C67000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.156.72.65/add?substr=mixtwo&s=three&sub=nosubPj

E-Banking Fraud

Yara detected Nymaim

Source: Yara match	File source: 0.3.file.exe.4a40000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.4950e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1656980225.0000000004A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.4101686121.00000000047A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00410940	0_2_00410940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041A346	0_2_0041A346
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040EBC7	0_2_0040EBC7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00403D40	0_2_00403D40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00415E59	0_2_00415E59
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040B6D0	0_2_0040B6D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402EE0	0_2_00402EE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00404F70	0_2_00404F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040EF09	0_2_0040EF09
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0041572E	0_2_0041572E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00688132	0_2_00688132
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006C72A1	0_2_006C72A1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0070230E	0_2_0070230E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00480C4B	0_2_00480C4B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005F2856	0_2_005F2856
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005DCE53	0_2_005DCE53
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005DAE72	0_2_005DAE72
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00473403	0_2_00473403
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005E4E3C	0_2_005E4E3C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00552E31	0_2_00552E31
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004CAA28	0_2_004CAA28
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005CB6D5	0_2_005CB6D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005624E1	0_2_005624E1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005E189C	0_2_005E189C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0047389F	0_2_0047389F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0054828B	0_2_0054828B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004A2702	0_2_004A2702
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005E693F	0_2_005E693F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005F0D31	0_2_005F0D31
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0050C9D4	0_2_0050C9D4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005EB99E	0_2_005EB99E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005DE398	0_2_005DE398
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005DFDBE	0_2_005DFDBE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005ED5B7	0_2_005ED5B7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005E33A6	0_2_005E33A6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_049551D7	0_2_049551D7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0495EE2E	0_2_0495EE2E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04953FA7	0_2_04953FA7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04965995	0_2_04965995
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_049551D7	0_2_049551D7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0495B937	0_2_0495B937
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0495F170	0_2_0495F170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04960BA7	0_2_04960BA7

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0495AA07 appears 34 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0040A7A0 appears 35 times

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.4101686121.00000000047A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9953100119426752
Source: file.exe	Static PE information: Section: cippurft ZLIB complexity 0.9926368211269656

Source: file.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00402A50 VirtualProtect,GetLastError,FormatMessageA,LocalAlloc,OutputDebugStringA,LocalFree,LocalFree,LocalFree,

0_2_00402A50

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_047A8464 CreateToolhelp32Snapshot,Module32First,

0_2_047A8464

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00401970 HttpAddRequestHeadersA,InternetSetFilePointer,InternetReadFile,HttpQueryInfoA,CoCreateInstance,

0_2_00401970

Source: C:\Users\user\Desktop\file.exe	Command line argument: nosub		0_2_004087E0
Source: C:\Users\user\Desktop\file.exe	Command line argument: mixtwo		0_2_004087E0

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 31%

Source: file.exe	String found in binary or memory: /add?substr=
Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 2029568 > 1048576

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe

Static PE information: Raw size of cippurft is bigger than: 0x100000 < 0x1ad400

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.400000.0.unpack :EW;.rsrc:W;.idata :W; :EW;cippurft:EW;vcdmathy:EW;.taggant:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1fe036 should be: 0x1fd309

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: cippurft
Source: file.exe	Static PE information: section name: vcdmathy
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040A237 push ecx; ret	0_2_0040A24A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00421B7D push esi; ret	0_2_00421B86
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00706F6A push ebp; mov dword ptr [esp], 1CC82F81h	0_2_007071B3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007068FA push esi; ret	0_2_00706909
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007060FF push ebp; ret	0_2_0070610E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0070B0D8 push es; ret	0_2_0070B0D9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007068AC push ebp; ret	0_2_007068BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007060AF push ebx; ret	0_2_007060BE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00709961 push 56611FC7h; mov dword ptr [esp], esi	0_2_007099EF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00709961 push 2D762CA2h; mov dword ptr [esp], edi	0_2_00709A21
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00709961 push esi; mov dword ptr [esp], ecx	0_2_00709A49
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00709961 push 485458E8h; mov dword ptr [esp], edi	0_2_00709A79
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00709961 push 50F2A918h; mov dword ptr [esp], ebp	0_2_00709A81
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00706153 push ebx; ret	0_2_00706162
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0070B132 push es; retf	0_2_0070B150
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0070693A push edx; ret	0_2_00706949
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007061F3 push ebx; ret	0_2_00706202
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007069FB push edi; ret	0_2_00706A0A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007081E5 push 79B24A64h; mov dword ptr [esp], esi	0_2_0070821C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007081E5 push 06E45827h; mov dword ptr [esp], edi	0_2_00708249
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007081E5 push 4718A8D7h; mov dword ptr [esp], ecx	0_2_00708277
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007061C5 push edi; ret	0_2_007061D4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007099C8 push 56611FC7h; mov dword ptr [esp], esi	0_2_007099EF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007099C8 push esi; mov dword ptr [esp], ecx	0_2_00709A49
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007099C8 push 485458E8h; mov dword ptr [esp], edi	0_2_00709A79
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007099C8 push 50F2A918h; mov dword ptr [esp], ebp	0_2_00709A81
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007079B0 push 81000000h; retn 0004h	0_2_007079B7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007069BB push edi; ret	0_2_007069CA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007099AD push 56611FC7h; mov dword ptr [esp], esi	0_2_007099EF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007099AD push 2D762CA2h; mov dword ptr [esp], edi	0_2_00709A21
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007099AD push esi; mov dword ptr [esp], ecx	0_2_00709A49

Source: file.exe	Static PE information: section name: entropy: 7.9437280014334295
Source: file.exe	Static PE information: section name: cippurft entropy: 7.950859026244158

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F9062 second address: 5F9068 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F9068 second address: 5F906C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F906C second address: 5F908E instructions: 0x00000000 rdtsc 0x00000002 jg 00007F79113F0796h 0x00000008 jmp 00007F79113F07A8h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F908E second address: 5F9094 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F9094 second address: 5F909A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EB4C4 second address: 5EB4D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jng 00007F79111F4F02h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EB4D1 second address: 5EB4D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F7FCF second address: 5F7FFF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F79111F4F03h 0x00000011 push edx 0x00000012 pop edx 0x00000013 popad 0x00000014 jp 00007F79111F4EFEh 0x0000001a jo 00007F79111F4EF6h 0x00000020 push edx 0x00000021 pop edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F7FFF second address: 5F8005 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F8005 second address: 5F8009 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F8415 second address: 5F8424 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F79113F0796h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d pop eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F86E7 second address: 5F8701 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F79111F4EF6h 0x0000000a jbe 00007F79111F4EFCh 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F8701 second address: 5F8707 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F884F second address: 5F8892 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F79111F4F05h 0x0000000c push edi 0x0000000d jmp 00007F79111F4EFAh 0x00000012 pop edi 0x00000013 jnc 00007F79111F4F02h 0x00000019 pushad 0x0000001a jnc 00007F79111F4EF6h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FC713 second address: 5FC779 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F79113F0796h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b jno 00007F79113F0796h 0x00000011 pop ebx 0x00000012 popad 0x00000013 xor dword ptr [esp], 12D67B41h 0x0000001a mov dword ptr [ebp+122D18BAh], edx 0x00000020 mov dh, 7Ah 0x00000022 push 00000003h 0x00000024 or dh, 00000037h 0x00000027 push 00000000h 0x00000029 movsx esi, di 0x0000002c push 00000003h 0x0000002e push 00000000h 0x00000030 push edx 0x00000031 call 00007F79113F0798h 0x00000036 pop edx 0x00000037 mov dword ptr [esp+04h], edx 0x0000003b add dword ptr [esp+04h], 0000001Ch 0x00000043 inc edx 0x00000044 push edx 0x00000045 ret 0x00000046 pop edx 0x00000047 ret 0x00000048 add edx, 520A8979h 0x0000004e push A77AE824h 0x00000053 jo 00007F79113F07A4h 0x00000059 pushad 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FC779 second address: 5FC77F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FC77F second address: 5FC79D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 add dword ptr [esp], 188517DCh 0x0000000c push ebx 0x0000000d stc 0x0000000e pop esi 0x0000000f lea ebx, dword ptr [ebp+1245C4ADh] 0x00000015 sbb ch, 00000025h 0x00000018 xchg eax, ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FC79D second address: 5FC7A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FC91B second address: 5FC921 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61C00F second address: 61C014 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61C014 second address: 61C027 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F79113F0798h 0x00000008 push esi 0x00000009 pop esi 0x0000000a push edi 0x0000000b jo 00007F79113F0796h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61A1F4 second address: 61A1FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61A1FA second address: 61A200 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61A7C5 second address: 61A7E3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F79111F4F04h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61A7E3 second address: 61A7E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61A7E9 second address: 61A813 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F79111F4F01h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F79111F4F00h 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61A92F second address: 61A954 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F79113F07ACh 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61A954 second address: 61A95A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61AC05 second address: 61AC0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61AD3B second address: 61AD67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F79111F4EFDh 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F79111F4F02h 0x00000011 jc 00007F79111F4EF6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61AD67 second address: 61AD94 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jno 00007F79113F0796h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 jmp 00007F79113F07A0h 0x00000017 popad 0x00000018 jmp 00007F79113F079Ah 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61AD94 second address: 61AD9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61AD9A second address: 61AD9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61AF00 second address: 61AF0A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61AF0A second address: 61AF0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 612F49 second address: 612F68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F79111F4F08h 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 620B7E second address: 620B83 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 621E40 second address: 621E44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 621E44 second address: 621E4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 621E4A second address: 621E66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F79111F4EFEh 0x0000000d jng 00007F79111F4EF6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 623465 second address: 62346B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62346B second address: 623474 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 629AA4 second address: 629AA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 629AA8 second address: 629AAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 628EDD second address: 628EF2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F79113F079Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62B8E3 second address: 62B908 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F79111F4EFDh 0x0000000c popad 0x0000000d push eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F79111F4EFCh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62BA67 second address: 62BA6D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62BCBA second address: 62BCBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62BCBE second address: 62BCC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62BDAC second address: 62BDB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62C55C second address: 62C561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62C561 second address: 62C567 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62C567 second address: 62C56B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62E857 second address: 62E869 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 je 00007F79111F4F00h 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62FDFB second address: 62FE18 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F79113F07A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62F17C second address: 62F182 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 631248 second address: 63124C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63124C second address: 63125B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F79111F4EFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6312E4 second address: 6312EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 631CC8 second address: 631CEA instructions: 0x00000000 rdtsc 0x00000002 jne 00007F79111F4EF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F79111F4F05h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63545C second address: 635474 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F79113F0796h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jnc 00007F79113F0796h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 635474 second address: 63547E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F79111F4EF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63547E second address: 6354E3 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F79113F0796h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d sbb di, 4008h 0x00000012 push 00000000h 0x00000014 mov edi, dword ptr [ebp+122D2CAEh] 0x0000001a mov dword ptr [ebp+122D3244h], ecx 0x00000020 push 00000000h 0x00000022 push 00000000h 0x00000024 push esi 0x00000025 call 00007F79113F0798h 0x0000002a pop esi 0x0000002b mov dword ptr [esp+04h], esi 0x0000002f add dword ptr [esp+04h], 00000017h 0x00000037 inc esi 0x00000038 push esi 0x00000039 ret 0x0000003a pop esi 0x0000003b ret 0x0000003c mov bx, dx 0x0000003f xchg eax, esi 0x00000040 jng 00007F79113F07AAh 0x00000046 jnl 00007F79113F07A4h 0x0000004c push eax 0x0000004d push esi 0x0000004e push eax 0x0000004f push edx 0x00000050 push esi 0x00000051 pop esi 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 630FE1 second address: 630FE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 630FE5 second address: 630FEF instructions: 0x00000000 rdtsc 0x00000002 jne 00007F79113F0796h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63853B second address: 638541 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 638541 second address: 638599 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F79113F079Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007F79113F07E4h 0x0000000f pushad 0x00000010 jmp 00007F79113F07A1h 0x00000015 jmp 00007F79113F079Eh 0x0000001a jmp 00007F79113F07A9h 0x0000001f push edx 0x00000020 pop edx 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 638599 second address: 63859D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63859D second address: 6385A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63ABFF second address: 63AC08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63AC08 second address: 63AC0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63AC0E second address: 63AC1E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F79111F4EFCh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 638CDE second address: 638CE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63AC1E second address: 63AC24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 638CE4 second address: 638CEB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63B2A4 second address: 63B2AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F79111F4EF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63B2AE second address: 63B2C1 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F79113F0796h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63B2C1 second address: 63B2C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63B2C5 second address: 63B2CB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63B2CB second address: 63B2D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63B2D1 second address: 63B2D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63B2D5 second address: 63B2D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63B3D8 second address: 63B3DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63C334 second address: 63C338 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63D1BB second address: 63D1C1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63C3EC second address: 63C409 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F79111F4F09h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63C409 second address: 63C40D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63E1AA second address: 63E1B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63E1B2 second address: 63E1C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 je 00007F79113F079Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63E1C3 second address: 63E1C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63F262 second address: 63F267 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63F267 second address: 63F2CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jl 00007F79111F4EF6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e nop 0x0000000f call 00007F79111F4EFBh 0x00000014 mov edi, dword ptr [ebp+122D395Eh] 0x0000001a pop ebx 0x0000001b push 00000000h 0x0000001d call 00007F79111F4F02h 0x00000022 or di, F500h 0x00000027 pop edi 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push eax 0x0000002d call 00007F79111F4EF8h 0x00000032 pop eax 0x00000033 mov dword ptr [esp+04h], eax 0x00000037 add dword ptr [esp+04h], 00000018h 0x0000003f inc eax 0x00000040 push eax 0x00000041 ret 0x00000042 pop eax 0x00000043 ret 0x00000044 movsx edi, dx 0x00000047 xchg eax, esi 0x00000048 pushad 0x00000049 pushad 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63F2CC second address: 63F2D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63F2D7 second address: 63F2E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push ebx 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 640233 second address: 640239 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 640239 second address: 640277 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b jmp 00007F79111F4F06h 0x00000010 push 00000000h 0x00000012 mov bl, ABh 0x00000014 adc edi, 6A4BC6F3h 0x0000001a push 00000000h 0x0000001c sub ebx, dword ptr [ebp+122D2B2Ah] 0x00000022 xchg eax, esi 0x00000023 push eax 0x00000024 push edx 0x00000025 jo 00007F79111F4EF8h 0x0000002b pushad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6411E3 second address: 6411E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6411E7 second address: 6411ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6411ED second address: 64124A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jbe 00007F79113F0796h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push ebx 0x00000010 push ebx 0x00000011 pushad 0x00000012 popad 0x00000013 pop ebx 0x00000014 pop ebx 0x00000015 nop 0x00000016 push 00000000h 0x00000018 push ecx 0x00000019 call 00007F79113F0798h 0x0000001e pop ecx 0x0000001f mov dword ptr [esp+04h], ecx 0x00000023 add dword ptr [esp+04h], 00000018h 0x0000002b inc ecx 0x0000002c push ecx 0x0000002d ret 0x0000002e pop ecx 0x0000002f ret 0x00000030 mov dword ptr [ebp+1247CC7Ah], edi 0x00000036 push ebx 0x00000037 mov dword ptr [ebp+122D30AAh], eax 0x0000003d pop ebx 0x0000003e push 00000000h 0x00000040 and bx, 8F40h 0x00000045 push 00000000h 0x00000047 mov edi, dword ptr [ebp+1245F863h] 0x0000004d push eax 0x0000004e js 00007F79113F07A4h 0x00000054 pushad 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6421AD second address: 642237 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F79111F4EF8h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jp 00007F79111F4EF6h 0x00000017 popad 0x00000018 pushad 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b jmp 00007F79111F4F07h 0x00000020 popad 0x00000021 popad 0x00000022 nop 0x00000023 jmp 00007F79111F4EFCh 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push ebx 0x0000002d call 00007F79111F4EF8h 0x00000032 pop ebx 0x00000033 mov dword ptr [esp+04h], ebx 0x00000037 add dword ptr [esp+04h], 00000016h 0x0000003f inc ebx 0x00000040 push ebx 0x00000041 ret 0x00000042 pop ebx 0x00000043 ret 0x00000044 mov dword ptr [ebp+1247CF12h], esi 0x0000004a push 00000000h 0x0000004c add dword ptr [ebp+122D188Fh], eax 0x00000052 xchg eax, esi 0x00000053 pushad 0x00000054 push eax 0x00000055 push edx 0x00000056 jmp 00007F79111F4F07h 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6431F6 second address: 6431FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 642498 second address: 6424A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F79111F4EF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6444AA second address: 644571 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F79113F07A3h 0x0000000a popad 0x0000000b push eax 0x0000000c jmp 00007F79113F07A5h 0x00000011 nop 0x00000012 mov edi, dword ptr [ebp+122D1C3Bh] 0x00000018 push dword ptr fs:[00000000h] 0x0000001f push 00000000h 0x00000021 push edx 0x00000022 call 00007F79113F0798h 0x00000027 pop edx 0x00000028 mov dword ptr [esp+04h], edx 0x0000002c add dword ptr [esp+04h], 0000001Bh 0x00000034 inc edx 0x00000035 push edx 0x00000036 ret 0x00000037 pop edx 0x00000038 ret 0x00000039 mov dword ptr [ebp+122D1DBCh], ecx 0x0000003f mov dword ptr fs:[00000000h], esp 0x00000046 xor edi, 6C679A92h 0x0000004c mov eax, dword ptr [ebp+122D064Dh] 0x00000052 push 00000000h 0x00000054 push edx 0x00000055 call 00007F79113F0798h 0x0000005a pop edx 0x0000005b mov dword ptr [esp+04h], edx 0x0000005f add dword ptr [esp+04h], 00000018h 0x00000067 inc edx 0x00000068 push edx 0x00000069 ret 0x0000006a pop edx 0x0000006b ret 0x0000006c mov edi, dword ptr [ebp+122D2E16h] 0x00000072 mov di, dx 0x00000075 push FFFFFFFFh 0x00000077 pushad 0x00000078 mov cx, 1766h 0x0000007c movzx ebx, bx 0x0000007f popad 0x00000080 push eax 0x00000081 push eax 0x00000082 push edx 0x00000083 jg 00007F79113F07A7h 0x00000089 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64553A second address: 64553F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 644571 second address: 644577 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6472C9 second address: 647338 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F79111F4EF8h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 jmp 00007F79111F4F02h 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push esi 0x0000001c call 00007F79111F4EF8h 0x00000021 pop esi 0x00000022 mov dword ptr [esp+04h], esi 0x00000026 add dword ptr [esp+04h], 00000018h 0x0000002e inc esi 0x0000002f push esi 0x00000030 ret 0x00000031 pop esi 0x00000032 ret 0x00000033 mov dword ptr [ebp+1245F880h], esi 0x00000039 sub dword ptr [ebp+122D323Fh], edx 0x0000003f push 00000000h 0x00000041 jmp 00007F79111F4F05h 0x00000046 xchg eax, esi 0x00000047 pushad 0x00000048 push eax 0x00000049 push edx 0x0000004a push esi 0x0000004b pop esi 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 644577 second address: 64457B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 647338 second address: 64733C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64733C second address: 647346 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64953B second address: 649547 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C60E second address: 64C61C instructions: 0x00000000 rdtsc 0x00000002 jc 00007F79113F0796h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64EE1F second address: 64EE28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64EE28 second address: 64EE2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65140A second address: 65140E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6543FD second address: 654417 instructions: 0x00000000 rdtsc 0x00000002 js 00007F79113F07A5h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 654563 second address: 65457A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push ebx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F79111F4EFCh 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 654709 second address: 65470D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65470D second address: 654719 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F79111F4EF6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 654719 second address: 654724 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F79113F0796h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 654724 second address: 654740 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F79111F4F02h 0x00000009 popad 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 654740 second address: 654753 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jnp 00007F79113F07B4h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 654753 second address: 654765 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jc 00007F79111F4EF6h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6548F2 second address: 6548F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65A562 second address: 65A566 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65A566 second address: 65A586 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 jnc 00007F79113F079Eh 0x0000000e jp 00007F79113F0798h 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 push eax 0x00000019 push edx 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d pop edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65A586 second address: 65A58C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65A58C second address: 65A590 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65A590 second address: 65A5A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push edi 0x0000000b jnl 00007F79111F4EFCh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65A5A3 second address: 65A5B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 mov dword ptr [esp+04h], eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65A5B1 second address: 65A5B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 661C70 second address: 661C74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 661C74 second address: 661C78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 661C78 second address: 661C90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jmp 00007F79113F079Eh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 661C90 second address: 661C94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6623BE second address: 6623C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 667EEA second address: 667F10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F79111F4F08h 0x0000000d pushad 0x0000000e push edi 0x0000000f pop edi 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 667F10 second address: 667F1C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F79113F079Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 666C9E second address: 666CA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 666CA4 second address: 666CD1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F79113F079Dh 0x00000007 jmp 00007F79113F07A2h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 jp 00007F79113F0796h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 666CD1 second address: 666CE0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 666CE0 second address: 666CE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 666CE4 second address: 666CE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 666CE8 second address: 666CF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E6412 second address: 5E6461 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F79111F4F00h 0x0000000a jmp 00007F79111F4EFAh 0x0000000f push eax 0x00000010 jc 00007F79111F4EF6h 0x00000016 pushad 0x00000017 popad 0x00000018 pop eax 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d push esi 0x0000001e pop esi 0x0000001f jmp 00007F79111F4EFCh 0x00000024 jnl 00007F79111F4EF6h 0x0000002a popad 0x0000002b push edi 0x0000002c jmp 00007F79111F4F00h 0x00000031 jnc 00007F79111F4EF6h 0x00000037 pop edi 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66727A second address: 667296 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F79113F0796h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnl 00007F79113F079Ah 0x00000010 push eax 0x00000011 push edx 0x00000012 jbe 00007F79113F0796h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 667664 second address: 667669 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 667669 second address: 66768A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F79113F07A0h 0x00000007 jp 00007F79113F0798h 0x0000000d push edi 0x0000000e pop edi 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push edi 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66768A second address: 66768E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66768E second address: 6676A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F79113F079Fh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 667837 second address: 66783B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66783B second address: 667841 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 667981 second address: 667989 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 613A85 second address: 613A9C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jmp 00007F79113F079Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6666A4 second address: 6666B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pop edi 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6666B1 second address: 6666B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6666B7 second address: 6666C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F79111F4EFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E4936 second address: 5E493B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E493B second address: 5E4947 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F79111F4EFEh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E4947 second address: 5E4951 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66B5F1 second address: 66B602 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F79111F4EF6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push edi 0x0000000e pushad 0x0000000f popad 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 632F33 second address: 632F51 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F79113F07A0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007F79113F0796h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 632F51 second address: 632FA1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F79111F4F04h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a nop 0x0000000b movzx ecx, bx 0x0000000e lea eax, dword ptr [ebp+12492C95h] 0x00000014 mov di, AC21h 0x00000018 sub dword ptr [ebp+122D3244h], edx 0x0000001e nop 0x0000001f jmp 00007F79111F4F08h 0x00000024 push eax 0x00000025 pushad 0x00000026 push edi 0x00000027 push edi 0x00000028 pop edi 0x00000029 pop edi 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 632FA1 second address: 632FA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 632FA5 second address: 612F49 instructions: 0x00000000 rdtsc 0x00000002 js 00007F79111F4EF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007F79111F4EF8h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 mov dword ptr [ebp+1245F548h], esi 0x0000002c sub dword ptr [ebp+122D31FAh], ecx 0x00000032 call dword ptr [ebp+122D39B6h] 0x00000038 push eax 0x00000039 push edx 0x0000003a push edx 0x0000003b pushad 0x0000003c popad 0x0000003d jns 00007F79111F4EF6h 0x00000043 pop edx 0x00000044 jmp 00007F79111F4F03h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633162 second address: 633169 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633523 second address: 633529 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633529 second address: 633548 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F79113F0798h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F79113F07A0h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633548 second address: 63357E instructions: 0x00000000 rdtsc 0x00000002 jo 00007F79111F4EFCh 0x00000008 jo 00007F79111F4EF6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 jbe 00007F79111F4F0Bh 0x0000001a jmp 00007F79111F4F05h 0x0000001f mov eax, dword ptr [eax] 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 push esi 0x00000025 pop esi 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63357E second address: 633596 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F79113F0798h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push edi 0x00000017 pop edi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633596 second address: 633614 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F79111F4EFDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub dword ptr [ebp+122D1C42h], esi 0x00000011 call 00007F79111F4EF9h 0x00000016 jmp 00007F79111F4EFBh 0x0000001b push eax 0x0000001c jmp 00007F79111F4F06h 0x00000021 mov eax, dword ptr [esp+04h] 0x00000025 jmp 00007F79111F4EFEh 0x0000002a mov eax, dword ptr [eax] 0x0000002c jno 00007F79111F4EFEh 0x00000032 mov dword ptr [esp+04h], eax 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007F79111F4F02h 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633614 second address: 63361A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63361A second address: 63361E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633DB4 second address: 633E32 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007F79113F0798h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 0000001Bh 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 mov ecx, 45BDF078h 0x00000029 pushad 0x0000002a jnc 00007F79113F079Ch 0x00000030 popad 0x00000031 push 0000001Eh 0x00000033 push 00000000h 0x00000035 push ecx 0x00000036 call 00007F79113F0798h 0x0000003b pop ecx 0x0000003c mov dword ptr [esp+04h], ecx 0x00000040 add dword ptr [esp+04h], 00000015h 0x00000048 inc ecx 0x00000049 push ecx 0x0000004a ret 0x0000004b pop ecx 0x0000004c ret 0x0000004d clc 0x0000004e nop 0x0000004f push eax 0x00000050 push edx 0x00000051 push eax 0x00000052 push edx 0x00000053 jmp 00007F79113F07A9h 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633E32 second address: 633E3C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F79111F4EF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633E3C second address: 633E5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F79113F07A6h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633E5F second address: 633E6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jl 00007F79111F4EF6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6341AC second address: 6341BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F79113F079Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6341BC second address: 6341C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6341C0 second address: 6341CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6341CF second address: 6341DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F79111F4EFBh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66B918 second address: 66B91D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66BA65 second address: 66BA6C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66BBF4 second address: 66BBFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66BBFA second address: 66BC00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66BC00 second address: 66BC04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66BC04 second address: 66BC25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F79111F4EFBh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 pop esi 0x00000015 jng 00007F79111F4EF6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66BC25 second address: 66BC29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66BC29 second address: 66BC43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F79111F4F02h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66BC43 second address: 66BC4D instructions: 0x00000000 rdtsc 0x00000002 jns 00007F79113F079Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66BED1 second address: 66BEE0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jo 00007F79111F4EF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66BEE0 second address: 66BEF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F79113F07A0h 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66BEF5 second address: 66BEFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66BEFB second address: 66BEFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66BEFF second address: 66BF1B instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F79111F4F02h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66BF1B second address: 66BF2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F79113F079Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66BF2C second address: 66BF30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66BF30 second address: 66BF36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67AC93 second address: 67AC9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679B7D second address: 679B81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679B81 second address: 679B9E instructions: 0x00000000 rdtsc 0x00000002 js 00007F79111F4EF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F79111F4F01h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679B9E second address: 679BAA instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F79113F0796h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67A135 second address: 67A139 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67A139 second address: 67A13D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6796F3 second address: 6796F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6796F9 second address: 679708 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 jno 00007F79113F0796h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679708 second address: 67970E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67970E second address: 679712 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679712 second address: 679716 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67A6BF second address: 67A6C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67A6C5 second address: 67A6D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F79111F4EF6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67A6D0 second address: 67A6D5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67CE31 second address: 67CE4D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a jnc 00007F79111F4EF6h 0x00000010 jmp 00007F79111F4EFBh 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 680F81 second address: 680F85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 680F85 second address: 680FA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F79111F4EFBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jns 00007F79111F4EF8h 0x00000014 pushad 0x00000015 popad 0x00000016 push ecx 0x00000017 push edi 0x00000018 pop edi 0x00000019 pushad 0x0000001a popad 0x0000001b pop ecx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 680FA7 second address: 680FBC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F79113F079Bh 0x00000007 jno 00007F79113F07A2h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 681273 second address: 68127B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68127B second address: 68127F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68127F second address: 681283 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 681283 second address: 681292 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jno 00007F79113F0796h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68141F second address: 68142B instructions: 0x00000000 rdtsc 0x00000002 js 00007F79111F4EF6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6866AC second address: 6866CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F79113F07A8h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 686828 second address: 68682C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68682C second address: 686832 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 686832 second address: 68684E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F79111F4F02h 0x00000009 jnl 00007F79111F4EF6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68706E second address: 6870AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F79113F07A3h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jno 00007F79113F07B1h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6870AE second address: 6870C6 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F79111F4F0Ah 0x00000008 jmp 00007F79111F4EFEh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F3DB5 second address: 5F3DBA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F3DBA second address: 5F3DC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F79111F4EF6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68D07E second address: 68D091 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F79113F079Bh 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68D091 second address: 68D0A6 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F79111F4EF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b jp 00007F79111F4F25h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68D0A6 second address: 68D0B0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68D0B0 second address: 68D0B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68C97D second address: 68C99B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c jmp 00007F79113F07A2h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68C99B second address: 68C99F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68C99F second address: 68C9B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a js 00007F79113F0796h 0x00000010 js 00007F79113F0796h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68C9B5 second address: 68C9BF instructions: 0x00000000 rdtsc 0x00000002 ja 00007F79111F4EF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68C9BF second address: 68C9C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68CDAA second address: 68CDCA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 jmp 00007F79111F4F06h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 690D97 second address: 690D9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 690D9D second address: 690DC4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F79111F4F01h 0x00000007 jmp 00007F79111F4EFFh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68FFFE second address: 690008 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push edx 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 690008 second address: 69002C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 jmp 00007F79111F4F00h 0x0000000e pop eax 0x0000000f ja 00007F79111F4EFEh 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69002C second address: 690030 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6901A5 second address: 6901BD instructions: 0x00000000 rdtsc 0x00000002 jne 00007F79111F4EF6h 0x00000008 jp 00007F79111F4EF6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jnp 00007F79111F4EF6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6901BD second address: 6901DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F79113F07A9h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6901DC second address: 6901F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F79111F4EFBh 0x00000007 pushad 0x00000008 jnp 00007F79111F4EF6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69047F second address: 690498 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F79113F07A1h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 690498 second address: 69049E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69049E second address: 6904A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6904A4 second address: 6904A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6908F8 second address: 6908FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6908FE second address: 690932 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F79111F4F07h 0x00000009 popad 0x0000000a pushad 0x0000000b push esi 0x0000000c pop esi 0x0000000d jmp 00007F79111F4EFDh 0x00000012 push eax 0x00000013 pop eax 0x00000014 popad 0x00000015 push edi 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 696D8B second address: 696D8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 696D8F second address: 696D9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 697055 second address: 697059 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 697321 second address: 697327 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6978AD second address: 6978B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6983DA second address: 6983DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6983DE second address: 6983E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6983E4 second address: 6983EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6983EA second address: 69840D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F79113F07A9h 0x00000009 jg 00007F79113F0796h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69840D second address: 698411 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69BC14 second address: 69BC18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69BC18 second address: 69BC2C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 js 00007F79111F4EF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007F79111F4EF6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69BC2C second address: 69BC30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69BC30 second address: 69BC3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F79111F4EF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69BC3C second address: 69BC5E instructions: 0x00000000 rdtsc 0x00000002 jo 00007F79113F07ACh 0x00000008 jmp 00007F79113F07A6h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69BC5E second address: 69BC64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69BC64 second address: 69BC68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69BC68 second address: 69BC6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69BC6E second address: 69BC89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F79113F079Dh 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69BDC5 second address: 69BDCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C08C second address: 69C098 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C098 second address: 69C09E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C09E second address: 69C0C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F79113F07A9h 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C0C2 second address: 69C0C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C0C8 second address: 69C0FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jnl 00007F79113F07A2h 0x0000000b jmp 00007F79113F07A6h 0x00000010 pushad 0x00000011 je 00007F79113F0796h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C0FE second address: 69C104 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C25F second address: 69C263 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C263 second address: 69C274 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F79111F4EF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C274 second address: 69C27D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C27D second address: 69C281 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C437 second address: 69C451 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F79113F07A1h 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C6C1 second address: 69C6C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C815 second address: 69C819 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A7A90 second address: 6A7A96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A7A96 second address: 6A7A9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A7C0E second address: 6A7C12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A7C12 second address: 6A7C18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A7C18 second address: 6A7C1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A7C1E second address: 6A7C2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jne 00007F79113F0796h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A7C2A second address: 6A7C64 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F79111F4F03h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jg 00007F79111F4F02h 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F79111F4EFBh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A7C64 second address: 6A7C88 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jno 00007F79113F0796h 0x00000009 jmp 00007F79113F07A6h 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A7C88 second address: 6A7C8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A7F92 second address: 6A7F9F instructions: 0x00000000 rdtsc 0x00000002 jg 00007F79113F0796h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A80E8 second address: 6A80FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F79111F4EF6h 0x0000000a pop esi 0x0000000b push esi 0x0000000c push edx 0x0000000d pop edx 0x0000000e pop esi 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A80FE second address: 6A811E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F79113F07A6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A811E second address: 6A8124 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A8124 second address: 6A8133 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push ebx 0x00000007 jbe 00007F79113F079Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A8283 second address: 6A8297 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F79111F4EF6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jl 00007F79111F4EF8h 0x00000012 push edx 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A858A second address: 6A858E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A8709 second address: 6A870E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A9081 second address: 6A9087 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A7584 second address: 6A7593 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jne 00007F79111F4EF6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A7593 second address: 6A759B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A759B second address: 6A75A5 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F79111F4EFCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A75A5 second address: 6A75C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F79113F07A4h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B1A3C second address: 6B1A40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B1407 second address: 6B140F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B140F second address: 6B1423 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F79111F4EFAh 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jc 00007F79111F4EF6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B15C9 second address: 6B15CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B171D second address: 6B1726 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BEE6D second address: 6BEE86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F79113F07A1h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BEE86 second address: 6BEEA3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F79111F4F07h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D1ABF second address: 6D1AC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D1AC5 second address: 6D1ACB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D9255 second address: 6D9261 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F79113F0796h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D9261 second address: 6D9265 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D9265 second address: 6D926F instructions: 0x00000000 rdtsc 0x00000002 jo 00007F79113F0796h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D969A second address: 6D96B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F79111F4F05h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D996B second address: 6D996F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D996F second address: 6D9973 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D9973 second address: 6D99A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F79113F079Dh 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F79113F07A5h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D9C46 second address: 6D9C62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F79111F4EFFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007F79111F4EF6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D9C62 second address: 6D9C66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D9C66 second address: 6D9C70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D9C70 second address: 6D9C74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DA6F7 second address: 6DA702 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DA702 second address: 6DA706 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DFB26 second address: 6DFB2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DFB2A second address: 6DFB4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F79113F07A7h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DFB4D second address: 6DFB51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DF6DB second address: 6DF6E1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DF6E1 second address: 6DF6EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DF84B second address: 6DF86F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 jne 00007F79113F0796h 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F79113F07A4h 0x00000013 push edx 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E9381 second address: 6E9395 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F79111F4EFEh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E9395 second address: 6E939C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EC526 second address: 6EC52A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EC52A second address: 6EC530 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EC530 second address: 6EC540 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a jo 00007F79111F4EF6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F07F0 second address: 5F07FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F07FB second address: 5F07FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F07FF second address: 5F0803 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F0803 second address: 5F0826 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F79111F4F09h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F8CAB second address: 6F8CAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FC1E9 second address: 6FC204 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F79111F4F07h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FC204 second address: 6FC234 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F79113F07A1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F79113F079Ah 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F79113F079Dh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FC0A4 second address: 6FC0A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FC0A8 second address: 6FC0B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F79113F0796h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FC0B4 second address: 6FC0BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 702032 second address: 702037 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 700E80 second address: 700E8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F79111F4EF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 700FF5 second address: 701024 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F79113F07A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007F79113F079Eh 0x0000000f pushad 0x00000010 popad 0x00000011 ja 00007F79113F0796h 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 701024 second address: 701041 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F79111F4F09h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70118E second address: 701194 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 701719 second address: 70171D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70171D second address: 70174D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jmp 00007F79113F07A0h 0x0000000c jmp 00007F79113F07A8h 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70174D second address: 701753 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 701753 second address: 701757 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 701A78 second address: 701A7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 701A7E second address: 701A8D instructions: 0x00000000 rdtsc 0x00000002 jno 00007F79113F0796h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 701D6B second address: 701D70 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 701D70 second address: 701DA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F79113F079Bh 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f jmp 00007F79113F07A0h 0x00000014 pop ecx 0x00000015 jmp 00007F79113F079Fh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7067CB second address: 7067DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 jl 00007F79111F4EFCh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7067DA second address: 7067E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7067E2 second address: 706816 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov edx, 73A2E475h 0x0000000d mov dword ptr [ebp+122D3855h], ebx 0x00000013 push 00000004h 0x00000015 sub dword ptr [ebp+1245768Bh], edx 0x0000001b call 00007F79111F4EF9h 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 jc 00007F79111F4EF6h 0x00000029 jno 00007F79111F4EF6h 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 706816 second address: 70682B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F79113F07A0h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 706B13 second address: 706B1D instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F79111F4EF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 706B1D second address: 706B4B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b je 00007F79113F0799h 0x00000011 mov dx, ax 0x00000014 and dh, FFFFFFD4h 0x00000017 push dword ptr [ebp+122D1AFAh] 0x0000001d mov dl, A2h 0x0000001f call 00007F79113F0799h 0x00000024 push esi 0x00000025 pushad 0x00000026 push ecx 0x00000027 pop ecx 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 706B4B second address: 706B81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 jnp 00007F79111F4EFEh 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 pushad 0x00000012 pushad 0x00000013 push esi 0x00000014 pop esi 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 jmp 00007F79111F4EFDh 0x0000001d popad 0x0000001e mov eax, dword ptr [eax] 0x00000020 push eax 0x00000021 push edx 0x00000022 push esi 0x00000023 push ecx 0x00000024 pop ecx 0x00000025 pop esi 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 706B81 second address: 706B96 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F79113F07A0h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 706B96 second address: 706BAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007F79111F4EF8h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 709E37 second address: 709E3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 709E3B second address: 709E43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 709976 second address: 70997C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70997C second address: 709993 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F79111F4F03h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 709993 second address: 709997 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 709997 second address: 7099A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7099A0 second address: 7099D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F79113F07A5h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d jc 00007F79113F07A7h 0x00000013 jmp 00007F79113F07A1h 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7099D8 second address: 7099E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F79111F4EF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A1197B second address: 4A11996 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F79113F07A7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A11996 second address: 4A119C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F79111F4F09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov bx, 342Eh 0x00000013 push ebx 0x00000014 pop eax 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A119C0 second address: 4A119C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A119C6 second address: 4A119CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0952 second address: 49B0956 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B0956 second address: 49B095A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49B095A second address: 49B0960 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E06A8 second address: 49E06AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E06AC second address: 49E06BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F79113F079Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E06BA second address: 49E076B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F79111F4EFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F79111F4F06h 0x0000000f push eax 0x00000010 pushad 0x00000011 pushad 0x00000012 mov ebx, 540C1CE2h 0x00000017 mov edx, 36D3252Eh 0x0000001c popad 0x0000001d pushfd 0x0000001e jmp 00007F79111F4EFFh 0x00000023 jmp 00007F79111F4F03h 0x00000028 popfd 0x00000029 popad 0x0000002a xchg eax, ebp 0x0000002b pushad 0x0000002c pushfd 0x0000002d jmp 00007F79111F4F04h 0x00000032 and si, 8DD8h 0x00000037 jmp 00007F79111F4EFBh 0x0000003c popfd 0x0000003d pushfd 0x0000003e jmp 00007F79111F4F08h 0x00000043 adc al, 00000038h 0x00000046 jmp 00007F79111F4EFBh 0x0000004b popfd 0x0000004c popad 0x0000004d mov ebp, esp 0x0000004f pushad 0x00000050 push eax 0x00000051 push edx 0x00000052 mov ah, 5Fh 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E076B second address: 49E0793 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 movsx edi, ax 0x00000009 popad 0x0000000a push dword ptr [ebp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 call 00007F79113F07A1h 0x00000015 pop ecx 0x00000016 mov edx, 3A4A8274h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0793 second address: 49E07DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop edx 0x00000005 pushfd 0x00000006 jmp 00007F79111F4F04h 0x0000000b add ax, 1428h 0x00000010 jmp 00007F79111F4EFBh 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push dword ptr [ebp+0Ch] 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F79111F4F05h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0820 second address: 49E0826 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49E0826 second address: 49E06A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 retn 0008h 0x0000000b push 00401BF4h 0x00000010 push edi 0x00000011 mov dword ptr [0045F81Ch], eax 0x00000016 call esi 0x00000018 mov edi, edi 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0C6B second address: 49C0C70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0C70 second address: 49C0C84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F79111F4F00h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0C84 second address: 49C0C88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0C88 second address: 49C0C97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0C97 second address: 49C0C9D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0C9D second address: 49C0CA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0CA3 second address: 49C0CA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0CA7 second address: 49C0CC9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F79111F4F05h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0CC9 second address: 49C0DBA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F79113F07A7h 0x00000008 pushfd 0x00000009 jmp 00007F79113F07A8h 0x0000000e xor esi, 380A6F38h 0x00000014 jmp 00007F79113F079Bh 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d mov ebp, esp 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007F79113F07A4h 0x00000026 sub si, E998h 0x0000002b jmp 00007F79113F079Bh 0x00000030 popfd 0x00000031 pushfd 0x00000032 jmp 00007F79113F07A8h 0x00000037 sbb esi, 68DE13F8h 0x0000003d jmp 00007F79113F079Bh 0x00000042 popfd 0x00000043 popad 0x00000044 pop ebp 0x00000045 push eax 0x00000046 push edx 0x00000047 pushad 0x00000048 pushfd 0x00000049 jmp 00007F79113F079Bh 0x0000004e adc ecx, 01967FBEh 0x00000054 jmp 00007F79113F07A9h 0x00000059 popfd 0x0000005a pushfd 0x0000005b jmp 00007F79113F07A0h 0x00000060 xor ecx, 684478B8h 0x00000066 jmp 00007F79113F079Bh 0x0000006b popfd 0x0000006c popad 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49C0DBA second address: 4A11660 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, di 0x00000006 mov bh, 1Ch 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp dword ptr [74E51560h] 0x00000011 mov edi, edi 0x00000013 push ebp 0x00000014 mov ebp, esp 0x00000016 push esi 0x00000017 mov esi, dword ptr [ebp+08h] 0x0000001a push edi 0x0000001b mov edi, dword ptr fs:[00000018h] 0x00000022 cmp esi, 40h 0x00000025 jnc 00007F79111F4F07h 0x00000027 mov eax, dword ptr [ebp+0Ch] 0x0000002a mov dword ptr [edi+esi*4+00000E10h], eax 0x00000031 mov eax, 00000001h 0x00000036 pop edi 0x00000037 pop esi 0x00000038 pop ebp 0x00000039 retn 0008h 0x0000003c test eax, eax 0x0000003e je 00007F79111F4FB1h 0x00000044 call 00007F79111F3421h 0x00000049 mov edi, edi 0x0000004b push esi 0x0000004c call 00007F79111F6551h 0x00000051 push 00000000h 0x00000053 call 00007F79111F4E7Ch 0x00000058 mov edi, edi 0x0000005a push ebp 0x0000005b mov ebp, esp 0x0000005d push esi 0x0000005e push dword ptr [00459714h] 0x00000064 mov esi, dword ptr [00401128h] 0x0000006a call esi 0x0000006c mov edi, edi 0x0000006e push eax 0x0000006f push edx 0x00000070 jmp 00007F79111F4F03h 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A11660 second address: 4A116A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F79113F079Fh 0x00000008 pop ecx 0x00000009 call 00007F79113F07A9h 0x0000000e pop esi 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F79113F07A3h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A116A6 second address: 4A116C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, di 0x00000006 mov eax, ebx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F79111F4EFFh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A116C7 second address: 4A116CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A116CB second address: 4A116D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0776 second address: 49A077C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A077C second address: 49A0780 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0780 second address: 49A079A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b mov ecx, edx 0x0000000d mov di, 9FB6h 0x00000011 popad 0x00000012 mov ecx, dword ptr [ebp+08h] 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A079A second address: 49A07A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ax, 9BCBh 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A07A3 second address: 49A07EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F79113F07A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub eax, eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F79113F07A8h 0x00000014 and ax, CD38h 0x00000019 jmp 00007F79113F079Bh 0x0000001e popfd 0x0000001f mov dx, si 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A07EB second address: 49A0810 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, E5h 0x00000005 mov ecx, 1DCAE103h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d inc eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F79111F4F05h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0810 second address: 49A084E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop esi 0x00000005 mov bx, 485Eh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c lock xadd dword ptr [ecx], eax 0x00000010 jmp 00007F79113F07A5h 0x00000015 inc eax 0x00000016 jmp 00007F79113F079Eh 0x0000001b pop ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f mov ax, di 0x00000022 pushad 0x00000023 popad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A084E second address: 49A0854 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A0854 second address: 49A0858 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A100F5 second address: 4A1013C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F79111F4F01h 0x00000009 sub esi, 0BD63026h 0x0000000f jmp 00007F79111F4F01h 0x00000014 popfd 0x00000015 jmp 00007F79111F4F00h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d xchg eax, ebx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A1013C second address: 4A10140 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10140 second address: 4A1015D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F79111F4F09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A1015D second address: 4A101D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F79113F07A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebx, dword ptr [eax+10h] 0x0000000c pushad 0x0000000d mov ecx, 6DA607B3h 0x00000012 mov si, 6C0Fh 0x00000016 popad 0x00000017 xchg eax, esi 0x00000018 pushad 0x00000019 mov si, CE07h 0x0000001d mov bh, ch 0x0000001f popad 0x00000020 push eax 0x00000021 jmp 00007F79113F07A6h 0x00000026 xchg eax, esi 0x00000027 jmp 00007F79113F07A0h 0x0000002c mov esi, dword ptr [74E806ECh] 0x00000032 jmp 00007F79113F07A0h 0x00000037 test esi, esi 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007F79113F079Ah 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A101D7 second address: 4A101DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A101DD second address: 4A10230 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F79113F079Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F79113F159Ah 0x0000000f jmp 00007F79113F07A0h 0x00000014 xchg eax, edi 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F79113F079Dh 0x0000001e sub cx, E1C6h 0x00000023 jmp 00007F79113F07A1h 0x00000028 popfd 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10230 second address: 4A10235 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10235 second address: 4A102A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F79113F07A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c jmp 00007F79113F07A2h 0x00000011 pop esi 0x00000012 mov dh, C4h 0x00000014 popad 0x00000015 xchg eax, edi 0x00000016 jmp 00007F79113F079Ah 0x0000001b call dword ptr [74E50B60h] 0x00000021 mov eax, 750BE5E0h 0x00000026 ret 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a pushfd 0x0000002b jmp 00007F79113F079Dh 0x00000030 and ah, FFFFFFE6h 0x00000033 jmp 00007F79113F07A1h 0x00000038 popfd 0x00000039 mov edi, eax 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A102A3 second address: 4A10306 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F79111F4EFDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push 00000044h 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F79111F4F03h 0x00000012 and ah, FFFFFFCEh 0x00000015 jmp 00007F79111F4F09h 0x0000001a popfd 0x0000001b popad 0x0000001c pop edi 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F79111F4F08h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10306 second address: 4A1030A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A1030A second address: 4A10310 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10310 second address: 4A103A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, 1F1BB253h 0x00000008 mov bx, si 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, edi 0x0000000f pushad 0x00000010 push esi 0x00000011 mov edx, 621FAFF2h 0x00000016 pop edx 0x00000017 mov ax, 939Fh 0x0000001b popad 0x0000001c push eax 0x0000001d pushad 0x0000001e mov bx, D216h 0x00000022 call 00007F79113F07A7h 0x00000027 mov ax, 4D7Fh 0x0000002b pop ecx 0x0000002c popad 0x0000002d xchg eax, edi 0x0000002e jmp 00007F79113F079Bh 0x00000033 push dword ptr [eax] 0x00000035 jmp 00007F79113F07A6h 0x0000003a mov eax, dword ptr fs:[00000030h] 0x00000040 jmp 00007F79113F07A0h 0x00000045 push dword ptr [eax+18h] 0x00000048 push eax 0x00000049 push edx 0x0000004a jmp 00007F79113F07A7h 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A1042A second address: 4A10488 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F79111F4F09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F79815E4157h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F79111F4F03h 0x00000018 or eax, 7FCDB8EEh 0x0000001e jmp 00007F79111F4F09h 0x00000023 popfd 0x00000024 mov bx, ax 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10488 second address: 4A104B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F79113F079Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub eax, eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F79113F07A9h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A104B8 second address: 4A104BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A104BE second address: 4A104D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F79113F07A3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A104D5 second address: 4A104F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi], edi 0x0000000a pushad 0x0000000b mov ebx, 7E4513E6h 0x00000010 popad 0x00000011 mov dword ptr [esi+04h], eax 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 movzx eax, bx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A104F1 second address: 4A104F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A104F6 second address: 4A10513 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F79111F4F09h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10513 second address: 4A105FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F79113F07A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esi+08h], eax 0x0000000e pushad 0x0000000f push eax 0x00000010 jmp 00007F79113F07A3h 0x00000015 pop eax 0x00000016 movsx edi, cx 0x00000019 popad 0x0000001a mov dword ptr [esi+0Ch], eax 0x0000001d jmp 00007F79113F07A0h 0x00000022 mov eax, dword ptr [ebx+4Ch] 0x00000025 jmp 00007F79113F07A0h 0x0000002a mov dword ptr [esi+10h], eax 0x0000002d pushad 0x0000002e mov dh, ah 0x00000030 pushfd 0x00000031 jmp 00007F79113F07A3h 0x00000036 xor cl, FFFFFFEEh 0x00000039 jmp 00007F79113F07A9h 0x0000003e popfd 0x0000003f popad 0x00000040 mov eax, dword ptr [ebx+50h] 0x00000043 jmp 00007F79113F079Eh 0x00000048 mov dword ptr [esi+14h], eax 0x0000004b pushad 0x0000004c mov edi, 0CD5A780h 0x00000051 popad 0x00000052 mov eax, dword ptr [ebx+54h] 0x00000055 pushad 0x00000056 mov dl, E6h 0x00000058 mov di, ax 0x0000005b popad 0x0000005c mov dword ptr [esi+18h], eax 0x0000005f pushad 0x00000060 mov ebx, eax 0x00000062 jmp 00007F79113F07A2h 0x00000067 popad 0x00000068 mov eax, dword ptr [ebx+58h] 0x0000006b jmp 00007F79113F07A0h 0x00000070 mov dword ptr [esi+1Ch], eax 0x00000073 pushad 0x00000074 push eax 0x00000075 push edx 0x00000076 mov ebx, ecx 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A105FE second address: 4A10649 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F79111F4F08h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov bx, si 0x0000000c popad 0x0000000d mov eax, dword ptr [ebx+5Ch] 0x00000010 jmp 00007F79111F4EFCh 0x00000015 mov dword ptr [esi+20h], eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F79111F4F07h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10649 second address: 4A10666 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, bx 0x00000006 jmp 00007F79113F079Bh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [ebx+60h] 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10666 second address: 4A10681 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F79111F4F07h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10681 second address: 4A106A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F79113F07A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+24h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A106A7 second address: 4A106AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A106AB second address: 4A106AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A106AF second address: 4A106B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A106B5 second address: 4A106BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A106BA second address: 4A106EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007F79111F4EFEh 0x00000009 pop eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [ebx+64h] 0x00000010 jmp 00007F79111F4F01h 0x00000015 mov dword ptr [esi+28h], eax 0x00000018 pushad 0x00000019 pushad 0x0000001a mov cx, 38B9h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A106EF second address: 4A1070A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 call 00007F79113F07A4h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A1070A second address: 4A107DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 mov eax, dword ptr [ebx+68h] 0x00000009 jmp 00007F79111F4F07h 0x0000000e mov dword ptr [esi+2Ch], eax 0x00000011 jmp 00007F79111F4F06h 0x00000016 mov ax, word ptr [ebx+6Ch] 0x0000001a pushad 0x0000001b mov dx, si 0x0000001e mov ch, 3Fh 0x00000020 popad 0x00000021 mov word ptr [esi+30h], ax 0x00000025 jmp 00007F79111F4F05h 0x0000002a mov ax, word ptr [ebx+00000088h] 0x00000031 jmp 00007F79111F4EFEh 0x00000036 mov word ptr [esi+32h], ax 0x0000003a pushad 0x0000003b pushfd 0x0000003c jmp 00007F79111F4EFEh 0x00000041 sbb esi, 2C064318h 0x00000047 jmp 00007F79111F4EFBh 0x0000004c popfd 0x0000004d pushfd 0x0000004e jmp 00007F79111F4F08h 0x00000053 jmp 00007F79111F4F05h 0x00000058 popfd 0x00000059 popad 0x0000005a mov eax, dword ptr [ebx+0000008Ch] 0x00000060 push eax 0x00000061 push edx 0x00000062 push eax 0x00000063 push edx 0x00000064 pushad 0x00000065 popad 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A107DE second address: 4A107E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A107E2 second address: 4A107E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A107E8 second address: 4A10832 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F79113F07A2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+34h], eax 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F79113F079Eh 0x00000013 or ecx, 6BBD1238h 0x00000019 jmp 00007F79113F079Bh 0x0000001e popfd 0x0000001f mov ecx, 0AC7D06Fh 0x00000024 popad 0x00000025 mov eax, dword ptr [ebx+18h] 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10832 second address: 4A10836 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10836 second address: 4A1083A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A1083A second address: 4A10840 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A109A2 second address: 4A109E9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 call 00007F79113F07A5h 0x0000000b jmp 00007F79113F07A0h 0x00000010 pop eax 0x00000011 popad 0x00000012 lea eax, dword ptr [ebp-10h] 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F79113F07A3h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A109E9 second address: 4A109EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A109EF second address: 4A109F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A109F5 second address: 4A109F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A109F9 second address: 4A109FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A109FD second address: 4A10A47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 jmp 00007F79111F4EFAh 0x0000000e push eax 0x0000000f jmp 00007F79111F4EFBh 0x00000014 nop 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 movsx edi, si 0x0000001b pushfd 0x0000001c jmp 00007F79111F4EFCh 0x00000021 jmp 00007F79111F4F05h 0x00000026 popfd 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10A47 second address: 4A10A4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10A60 second address: 4A10A74 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov edx, 5B3E0FEEh 0x0000000b popad 0x0000000c mov edi, eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10A74 second address: 4A10A7A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10A7A second address: 4A10A9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a test edi, edi 0x0000000c pushad 0x0000000d push ebx 0x0000000e movzx ecx, bx 0x00000011 pop ebx 0x00000012 pushad 0x00000013 push eax 0x00000014 pop ebx 0x00000015 movzx esi, bx 0x00000018 popad 0x00000019 popad 0x0000001a js 00007F79815E3B25h 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10A9F second address: 4A10AC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F79113F079Eh 0x0000000a sub al, FFFFFFC8h 0x0000000d jmp 00007F79113F079Bh 0x00000012 popfd 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10AC2 second address: 4A10ADA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F79111F4F04h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10ADA second address: 4A10ADE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10ADE second address: 4A10B6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebp-0Ch] 0x0000000b pushad 0x0000000c pushad 0x0000000d mov edx, 666350BEh 0x00000012 jmp 00007F79111F4EFFh 0x00000017 popad 0x00000018 jmp 00007F79111F4F08h 0x0000001d popad 0x0000001e mov dword ptr [esi+04h], eax 0x00000021 jmp 00007F79111F4F00h 0x00000026 lea eax, dword ptr [ebx+78h] 0x00000029 pushad 0x0000002a mov ax, 763Dh 0x0000002e mov dh, cl 0x00000030 popad 0x00000031 push 00000001h 0x00000033 jmp 00007F79111F4F05h 0x00000038 nop 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007F79111F4F08h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10B6B second address: 4A10B71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10B71 second address: 4A10B94 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F79111F4EFEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F79111F4EFEh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10B94 second address: 4A10B9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10B9A second address: 4A10BB9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F79111F4F04h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10C6A second address: 4A10C8A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop ecx 0x00000005 call 00007F79113F079Bh 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e js 00007F79817DF1D1h 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10C8A second address: 4A10C8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10C8E second address: 4A10C94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10C94 second address: 4A10C9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10C9A second address: 4A10C9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10C9E second address: 4A10CCE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F79111F4F05h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [ebp-04h] 0x0000000e pushad 0x0000000f mov dx, cx 0x00000012 mov ah, 1Ah 0x00000014 popad 0x00000015 mov dword ptr [esi+08h], eax 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b mov cx, AA23h 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10CCE second address: 4A10D12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ch, 5Eh 0x00000005 mov dx, C902h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c lea eax, dword ptr [ebx+70h] 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F79113F079Fh 0x00000016 adc ecx, 0FD44BFEh 0x0000001c jmp 00007F79113F07A9h 0x00000021 popfd 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10D12 second address: 4A10D16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10D16 second address: 4A10D45 instructions: 0x00000000 rdtsc 0x00000002 call 00007F79113F079Ch 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push 00000001h 0x0000000d jmp 00007F79113F07A1h 0x00000012 nop 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10D45 second address: 4A10D49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10D49 second address: 4A10D5A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F79113F079Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10D5A second address: 4A10DA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007F79111F4EFDh 0x0000000b or eax, 50BC50F6h 0x00000011 jmp 00007F79111F4F01h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a nop 0x0000001b jmp 00007F79111F4EFEh 0x00000020 lea eax, dword ptr [ebp-18h] 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F79111F4EFAh 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10DA8 second address: 4A10DB7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F79113F079Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10DB7 second address: 4A10DCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F79111F4F04h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10DCF second address: 4A10DE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a call 00007F79113F079Ah 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10E06 second address: 4A10E59 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F79111F4F02h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, eax 0x0000000b jmp 00007F79111F4F00h 0x00000010 test edi, edi 0x00000012 pushad 0x00000013 movzx eax, bx 0x00000016 call 00007F79111F4F03h 0x0000001b mov edi, esi 0x0000001d pop ecx 0x0000001e popad 0x0000001f js 00007F79815E375Ah 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 push esi 0x00000029 pop ebx 0x0000002a mov edi, eax 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10E59 second address: 4A10ECB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F79113F079Bh 0x00000009 sbb cx, 11BEh 0x0000000e jmp 00007F79113F07A9h 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007F79113F07A0h 0x0000001a sub al, FFFFFFB8h 0x0000001d jmp 00007F79113F079Bh 0x00000022 popfd 0x00000023 popad 0x00000024 pop edx 0x00000025 pop eax 0x00000026 mov eax, dword ptr [ebp-14h] 0x00000029 jmp 00007F79113F07A6h 0x0000002e mov ecx, esi 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10ECB second address: 4A10ECF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10ECF second address: 4A10ED5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10ED5 second address: 4A10EDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10EDB second address: 4A10EDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10EDF second address: 4A10F01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+0Ch], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e movsx edi, ax 0x00000011 jmp 00007F79111F4F00h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10F01 second address: 4A10F97 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F79113F07A1h 0x00000009 sub si, C016h 0x0000000e jmp 00007F79113F07A1h 0x00000013 popfd 0x00000014 mov ecx, 5BDF2A87h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c mov edx, 74E806ECh 0x00000021 pushad 0x00000022 mov si, E37Fh 0x00000026 pushfd 0x00000027 jmp 00007F79113F07A4h 0x0000002c and al, 00000068h 0x0000002f jmp 00007F79113F079Bh 0x00000034 popfd 0x00000035 popad 0x00000036 sub eax, eax 0x00000038 pushad 0x00000039 call 00007F79113F07A5h 0x0000003e mov cx, 3647h 0x00000042 pop eax 0x00000043 push eax 0x00000044 push edx 0x00000045 call 00007F79113F07A3h 0x0000004a pop esi 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10F97 second address: 4A10FE5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F79111F4F09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a lock cmpxchg dword ptr [edx], ecx 0x0000000e pushad 0x0000000f push eax 0x00000010 mov ah, dl 0x00000012 pop ecx 0x00000013 mov dl, 72h 0x00000015 popad 0x00000016 pop edi 0x00000017 jmp 00007F79111F4EFCh 0x0000001c test eax, eax 0x0000001e pushad 0x0000001f mov eax, 11CB1BCDh 0x00000024 mov ch, A7h 0x00000026 popad 0x00000027 jne 00007F79815E35F9h 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10FE5 second address: 4A10FEB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10FEB second address: 4A10FF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A10FF1 second address: 4A1101A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edx, dword ptr [ebp+08h] 0x0000000b pushad 0x0000000c mov ebx, 0B080230h 0x00000011 mov ebx, 3823115Ch 0x00000016 popad 0x00000017 mov eax, dword ptr [esi] 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F79113F079Eh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A1101A second address: 4A11020 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 473C30 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 64C65F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6B3CA7 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00706806 rdtsc

0_2_00706806

Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1883			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 1695			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

API coverage: 4.7 %

Source: C:\Users\user\Desktop\file.exe TID: 928	Thread sleep count: 55 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 928	Thread sleep time: -110055s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4564	Thread sleep count: 70 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4564	Thread sleep time: -140070s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4956	Thread sleep count: 96 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4956	Thread sleep count: 115 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4956	Thread sleep count: 137 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4956	Thread sleep count: 144 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1216	Thread sleep count: 1883 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1216	Thread sleep time: -3767883s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5800	Thread sleep count: 1695 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5800	Thread sleep time: -3391695s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4956	Thread sleep count: 204 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4956	Thread sleep count: 88 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4956	Thread sleep count: 98 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4956	Thread sleep count: 92 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4956	Thread sleep count: 84 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 416	Thread sleep count: 76 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 416	Thread sleep time: -152076s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5752	Thread sleep count: 63 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5752	Thread sleep time: -126063s >= -30000s	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: file.exe, file.exe, 00000000.00000002.4100040646.0000000000603000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.4100666631.0000000000C4C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: file.exe, 00000000.00000002.4100666631.0000000000C78000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.4100040646.0000000000603000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Found potential dummy code loops (likely to delay analysis)

Source: C:\Users\user\Desktop\file.exe

Process Stats: CPU usage > 42% for more than 60s

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00706806 rdtsc

0_2_00706806

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0040CDE3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0040CDE3

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00402A50 VirtualProtect,GetLastError,FormatMessageA,LocalAlloc,OutputDebugStringA,LocalFree,LocalFree,LocalFree,

0_2_00402A50

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_047A7D41 push dword ptr fs:[00000030h]	0_2_047A7D41
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04950D90 mov eax, dword ptr fs:[00000030h]	0_2_04950D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0495092B mov eax, dword ptr fs:[00000030h]	0_2_0495092B

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00418592 GetProcessHeap,

0_2_00418592

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00409A2A SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00409A2A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040CDE3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0040CDE3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040A58A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0040A58A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040A720 SetUnhandledExceptionFilter,	0_2_0040A720
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04959C91 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_04959C91
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0495A7F1 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0495A7F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0495D04A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0495D04A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0495A987 SetUnhandledExceptionFilter,	0_2_0495A987

Source: file.exe, file.exe, 00000000.00000002.4100040646.0000000000603000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: &Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0040A2EC cpuid

0_2_0040A2EC

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00410822 GetSystemTimeAsFileTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,

0_2_00410822

Stealing of Sensitive Information

Yara detected Nymaim

Source: Yara match	File source: 0.3.file.exe.4a40000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.4950e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1656980225.0000000004A40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	341 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	771 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	341 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	4 Obfuscated Files or Information	NTDS	3 Process Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	213 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	32%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://185.156.72.65/add?substr=mixtwo&s=three&sub=nosubPj	100%	Avira URL Cloud	malware

Name	Malicious	Antivirus Detection	Reputation
http://185.156.72.65/add?substr=mixtwo&s=three&sub=nosub	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.156.72.65/add?substr=mixtwo&s=three&sub=nosubPj	file.exe, 00000000.00000002.4100666631.0000000000C67000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.156.72.65	unknown	Russian Federation		44636	ITDELUXE-ASRU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1565665
Start date and time:	2024-11-30 13:50:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
07:51:25	API Interceptor	10787082x Sleep call for process: file.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.156.72.65	file.exe	Get hash	malicious	Nymaim	Browse	185.156.72.65/add?substr=mixtwo&s=three&sub=nosub
	file.exe	Get hash	malicious	Nymaim	Browse	185.156.72.65/add?substr=mixtwo&s=three&sub=nosub
	file.exe	Get hash	malicious	Amadey, Nymaim	Browse	185.156.72.65/add?substr=mixtwo&s=three&sub=nosub
	file.exe	Get hash	malicious	Nymaim	Browse	185.156.72.65/add?substr=mixtwo&s=three&sub=nosub
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	185.156.72.65/add?substr=mixtwo&s=three&sub=nosub
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Nymaim, Stealc	Browse	185.156.72.65/soft/download
	file.exe	Get hash	malicious	Nymaim	Browse	185.156.72.65/soft/download
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.156.72.65/files/download
	file.exe	Get hash	malicious	Nymaim	Browse	185.156.72.65/soft/download
	file.exe	Get hash	malicious	Nymaim	Browse	185.156.72.65/soft/download

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ITDELUXE-ASRU	file.exe	Get hash	malicious	Nymaim	Browse	185.156.72.65
	file.exe	Get hash	malicious	Nymaim	Browse	185.156.72.65
	file.exe	Get hash	malicious	Amadey, Nymaim	Browse	185.156.72.65
	file.exe	Get hash	malicious	Nymaim	Browse	185.156.72.65
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	185.156.72.65
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Nymaim, Stealc	Browse	185.156.72.65
	file.exe	Get hash	malicious	Nymaim	Browse	185.156.72.65
	file.exe	Get hash	malicious	Nymaim	Browse	185.156.72.65
	file.exe	Get hash	malicious	Nymaim	Browse	185.156.72.65
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Nymaim, Xmrig	Browse	185.156.72.65

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948955755292811
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'029'568 bytes
MD5:	c54023b84d77e5ce72a48eda24bbc227
SHA1:	21c893f54354a48114c3d36e938f69f7d7f32430
SHA256:	e2cee0f3aa497ae6990b9ff45110eaf89a95b31e34383ef8c655bf1a12544d43
SHA512:	ad9d8a1df60fb4a3fbd4a1f3f16544eb41c59b642d9b81e00c50f0d3f4cc12b22fe07b70cefbaaa8bf02d076eb9039fbdac41e9cf2b73137e013ea9615b10bab
SSDEEP:	24576:o8iiAa6PY9XMdXUFDbtM950HXWEcSouzyL34WTqfy+J4HQQS2alBekOJ0QqNRz7v:o8YwSdQouHXhcBr4AsUPegJTCz
TLSH:	279533EF0733F7B1D648D4F6C1ADE01E7114297A5B894753D5A46FA00ABF2D31882AB8
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........RC..<...<...<.......<.......<.......<..~G...<...=.3.<.......<.......<.......<.Rich..<.........PE..L....[.d.................\|.

File Icon


Icon Hash:	cfa99b8a8651798d

Static PE Info

General

Entrypoint:	0x8c4000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x64C65B18 [Sun Jul 30 12:44:08 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F7910887E4Ah

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6f05b	0x6f	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x66000	0x8234	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4bedbc	0x18	cippurft
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x65000	0x3ae00	e0997b2adf8811fdfd04bb86ea98314b	False	0.9953100119426752	data	7.9437280014334295	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x66000	0x8234	0x3c00	6c7468eca8cf398f19d1b5cbc986ecad	False	0.926171875	data	7.716426009400757	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6f000	0x1000	0x200	6eb091ff88873fe4d3f846082d82dda4	False	0.154296875	data	1.0965193819233	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x70000	0x2a5000	0x200	ce54b6444357e67d5ba43f6f78b8e676	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
cippurft	0x315000	0x1ae000	0x1ad400	11d34aa0c784965a37aa1c71500614be	False	0.9926368211269656	data	7.950859026244158	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
vcdmathy	0x4c3000	0x1000	0x400	3dca0fb7d06cf1a3c521fa0b826a0692	False	0.7587890625	data	6.008400388235224	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4c4000	0x3000	0x2200	5005f9ff2ed1ad6d699276831a85fbfb	False	0.06744025735294118	DOS executable (COM)	0.7981887477055756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x66460	0xea8	data			1.0029317697228144
RT_CURSOR	0x67308	0x8a8	data			1.0049638989169676
RT_CURSOR	0x67bb0	0x568	data			1.0079479768786128
RT_CURSOR	0x68118	0xea8	data			1.0029317697228144
RT_CURSOR	0x68fc0	0x8a8	data			1.0049638989169676
RT_CURSOR	0x69868	0x568	data			0.5206521739130435
RT_ICON	0x4bee1c	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	India	0.7557603686635944
RT_ICON	0x4bee1c	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	Sri Lanka	0.7557603686635944
RT_ICON	0x4bf4e4	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Tamil	India	0.6829875518672199
RT_ICON	0x4bf4e4	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Tamil	Sri Lanka	0.6829875518672199
RT_ICON	0x4c1a8c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Tamil	India	0.8058510638297872
RT_ICON	0x4c1a8c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Tamil	Sri Lanka	0.8058510638297872
RT_STRING	0x6cea8	0x252	empty	Tamil	India	0
RT_STRING	0x6cea8	0x252	empty	Tamil	Sri Lanka	0
RT_STRING	0x6d0fc	0x396	empty	Tamil	India	0
RT_STRING	0x6d0fc	0x396	empty	Tamil	Sri Lanka	0
RT_STRING	0x6d494	0x520	empty	Tamil	India	0
RT_STRING	0x6d494	0x520	empty	Tamil	Sri Lanka	0
RT_STRING	0x6d9b4	0x3ee	empty	Tamil	India	0
RT_STRING	0x6d9b4	0x3ee	empty	Tamil	Sri Lanka	0
RT_ACCELERATOR	0x6dda4	0x58	empty	Tamil	India	0
RT_ACCELERATOR	0x6dda4	0x58	empty	Tamil	Sri Lanka	0
RT_GROUP_CURSOR	0x6ddfc	0x30	empty			0
RT_GROUP_CURSOR	0x6de2c	0x30	empty			0
RT_GROUP_ICON	0x4c1ef4	0x30	data	Tamil	India	0.9375
RT_GROUP_ICON	0x4c1ef4	0x30	data	Tamil	Sri Lanka	0.9375
RT_VERSION	0x4c1f24	0x254	data			0.5436241610738255
RT_MANIFEST	0x4c2178	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
Tamil	India
Tamil	Sri Lanka

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 30, 2024 13:50:58.861622095 CET	49730	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:50:58.981722116 CET	80	49730	185.156.72.65	192.168.2.4
Nov 30, 2024 13:50:58.981813908 CET	49730	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:50:58.982016087 CET	49730	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:50:59.101989985 CET	80	49730	185.156.72.65	192.168.2.4
Nov 30, 2024 13:51:20.961652994 CET	80	49730	185.156.72.65	192.168.2.4
Nov 30, 2024 13:51:20.961720943 CET	49730	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:51:20.961838961 CET	49730	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:51:21.081727982 CET	80	49730	185.156.72.65	192.168.2.4
Nov 30, 2024 13:51:23.973067999 CET	49737	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:51:24.093346119 CET	80	49737	185.156.72.65	192.168.2.4
Nov 30, 2024 13:51:24.093436003 CET	49737	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:51:24.093640089 CET	49737	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:51:24.213660955 CET	80	49737	185.156.72.65	192.168.2.4
Nov 30, 2024 13:51:46.071523905 CET	80	49737	185.156.72.65	192.168.2.4
Nov 30, 2024 13:51:46.071630001 CET	49737	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:51:46.071716070 CET	49737	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:51:46.191739082 CET	80	49737	185.156.72.65	192.168.2.4
Nov 30, 2024 13:51:49.084491014 CET	49738	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:51:49.205034018 CET	80	49738	185.156.72.65	192.168.2.4
Nov 30, 2024 13:51:49.205132008 CET	49738	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:51:49.205323935 CET	49738	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:51:49.325320005 CET	80	49738	185.156.72.65	192.168.2.4
Nov 30, 2024 13:51:57.207779884 CET	49738	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:52:00.225203037 CET	49746	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:52:00.345340014 CET	80	49746	185.156.72.65	192.168.2.4
Nov 30, 2024 13:52:00.351130962 CET	49746	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:52:00.351347923 CET	49746	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:52:00.471234083 CET	80	49746	185.156.72.65	192.168.2.4
Nov 30, 2024 13:52:22.275265932 CET	80	49746	185.156.72.65	192.168.2.4
Nov 30, 2024 13:52:22.275402069 CET	49746	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:52:22.451685905 CET	49746	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:52:22.572339058 CET	80	49746	185.156.72.65	192.168.2.4
Nov 30, 2024 13:52:25.460973978 CET	49802	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:52:25.581233025 CET	80	49802	185.156.72.65	192.168.2.4
Nov 30, 2024 13:52:25.585403919 CET	49802	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:52:25.585403919 CET	49802	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:52:25.705533981 CET	80	49802	185.156.72.65	192.168.2.4
Nov 30, 2024 13:52:47.572606087 CET	80	49802	185.156.72.65	192.168.2.4
Nov 30, 2024 13:52:47.574140072 CET	49802	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:52:47.574265957 CET	49802	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:52:47.694185972 CET	80	49802	185.156.72.65	192.168.2.4
Nov 30, 2024 13:52:50.587126970 CET	49858	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:52:50.707456112 CET	80	49858	185.156.72.65	192.168.2.4
Nov 30, 2024 13:52:50.707537889 CET	49858	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:52:50.707751036 CET	49858	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:52:50.827682018 CET	80	49858	185.156.72.65	192.168.2.4
Nov 30, 2024 13:53:12.641942978 CET	80	49858	185.156.72.65	192.168.2.4
Nov 30, 2024 13:53:12.641999006 CET	49858	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:53:12.642245054 CET	49858	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:53:12.762222052 CET	80	49858	185.156.72.65	192.168.2.4
Nov 30, 2024 13:53:15.649194002 CET	49912	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:53:15.769603968 CET	80	49912	185.156.72.65	192.168.2.4
Nov 30, 2024 13:53:15.769798994 CET	49912	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:53:15.773116112 CET	49912	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:53:15.893094063 CET	80	49912	185.156.72.65	192.168.2.4
Nov 30, 2024 13:53:37.698534012 CET	80	49912	185.156.72.65	192.168.2.4
Nov 30, 2024 13:53:37.698594093 CET	49912	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:53:37.698892117 CET	49912	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:53:37.818815947 CET	80	49912	185.156.72.65	192.168.2.4
Nov 30, 2024 13:53:40.714103937 CET	49968	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:53:40.834227085 CET	80	49968	185.156.72.65	192.168.2.4
Nov 30, 2024 13:53:40.834340096 CET	49968	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:53:40.834578037 CET	49968	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:53:40.954474926 CET	80	49968	185.156.72.65	192.168.2.4
Nov 30, 2024 13:54:02.761421919 CET	80	49968	185.156.72.65	192.168.2.4
Nov 30, 2024 13:54:02.761487007 CET	49968	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:54:02.791908026 CET	49968	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:54:02.914076090 CET	80	49968	185.156.72.65	192.168.2.4
Nov 30, 2024 13:54:05.833141088 CET	50010	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:54:05.953269958 CET	80	50010	185.156.72.65	192.168.2.4
Nov 30, 2024 13:54:05.961144924 CET	50010	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:54:06.029354095 CET	50010	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:54:06.149507046 CET	80	50010	185.156.72.65	192.168.2.4
Nov 30, 2024 13:54:27.878072977 CET	80	50010	185.156.72.65	192.168.2.4
Nov 30, 2024 13:54:27.879211903 CET	50010	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:54:27.883130074 CET	50010	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:54:28.003077030 CET	80	50010	185.156.72.65	192.168.2.4
Nov 30, 2024 13:54:30.900934935 CET	50011	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:54:31.020848989 CET	80	50011	185.156.72.65	192.168.2.4
Nov 30, 2024 13:54:31.020929098 CET	50011	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:54:31.021220922 CET	50011	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:54:31.141073942 CET	80	50011	185.156.72.65	192.168.2.4
Nov 30, 2024 13:54:48.847842932 CET	50011	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:54:51.867111921 CET	50012	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:54:51.987261057 CET	80	50012	185.156.72.65	192.168.2.4
Nov 30, 2024 13:54:51.991251945 CET	50012	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:54:51.991610050 CET	50012	80	192.168.2.4	185.156.72.65
Nov 30, 2024 13:54:52.111536026 CET	80	50012	185.156.72.65	192.168.2.4

HTTP Request Dependency Graph

185.156.72.65

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.156.72.65	80	5796	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 13:50:58.982016087 CET	416	OUT	GET /add?substr=mixtwo&s=three&sub=nosub HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	185.156.72.65	80	5796	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 13:51:24.093640089 CET	416	OUT	GET /add?substr=mixtwo&s=three&sub=nosub HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	185.156.72.65	80	5796	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 13:51:49.205323935 CET	416	OUT	GET /add?substr=mixtwo&s=three&sub=nosub HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49746	185.156.72.65	80	5796	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 13:52:00.351347923 CET	416	OUT	GET /add?substr=mixtwo&s=three&sub=nosub HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49802	185.156.72.65	80	5796	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 13:52:25.585403919 CET	416	OUT	GET /add?substr=mixtwo&s=three&sub=nosub HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49858	185.156.72.65	80	5796	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 13:52:50.707751036 CET	416	OUT	GET /add?substr=mixtwo&s=three&sub=nosub HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49912	185.156.72.65	80	5796	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 13:53:15.773116112 CET	416	OUT	GET /add?substr=mixtwo&s=three&sub=nosub HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49968	185.156.72.65	80	5796	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 13:53:40.834578037 CET	416	OUT	GET /add?substr=mixtwo&s=three&sub=nosub HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	50010	185.156.72.65	80	5796	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 13:54:06.029354095 CET	416	OUT	GET /add?substr=mixtwo&s=three&sub=nosub HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	50011	185.156.72.65	80	5796	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 13:54:31.021220922 CET	416	OUT	GET /add?substr=mixtwo&s=three&sub=nosub HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	50012	185.156.72.65	80	5796	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 30, 2024 13:54:51.991610050 CET	416	OUT	GET /add?substr=mixtwo&s=three&sub=nosub HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache

Target ID:	0
Start time:	07:50:54
Start date:	30/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	2'029'568 bytes
MD5 hash:	C54023B84D77E5CE72A48EDA24BBC227
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.4101686121.00000000047A0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000000.00000003.1656980225.0000000004A40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	1.6%
Dynamic/Decrypted Code Coverage:	5.3%
Signature Coverage:	3.5%
Total number of Nodes:	566
Total number of Limit Nodes:	5

Executed Functions

Function 00403D40 Relevance: 57.8, APIs: 25, Strings: 7, Instructions: 1839sleepcomCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000104,?,73BDA22C,74DF0F00,00000000), ref: 00403DAA
CreateDirectoryA.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?), ref: 00403F39
Sleep.KERNEL32(000003E8), ref: 00403F42
__Init_thread_footer.LIBCMT ref: 00404517
__Init_thread_footer.LIBCMT ref: 004046DD
SHGetFolderPathA.SHELL32(00000000,00000000,00000000,00000000,?,00000000,?,00406AC1,0041D835,0042D9B8,0042D9B9,?,00000000,00000000,0042DB70,0042DB71), ref: 004048E7
__Init_thread_footer.LIBCMT ref: 00404975
__Init_thread_footer.LIBCMT ref: 00404BDE
CoInitialize.OLE32(00000000), ref: 00404C5F
CoCreateInstance.OLE32(0041F290,00000000,00000001,0041F260,?,?,00406AC1,0041D835,0042D9B8,0042D9B9,?,00000000,00000000,0042DB70,0042DB71), ref: 00404C7A
__Init_thread_footer.LIBCMT ref: 004050DD
Sleep.KERNEL32(00000BB8,00000000,?,00406AA1,0041D8D0,0042DBDC,0042DBDD), ref: 004052F5
__Init_thread_footer.LIBCMT ref: 004053EB
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000104,?,00406AC1,0041D835,0042D9B8,0042D9B9,?,00000000,00000000,0042DB70,0042DB71), ref: 00404CE8

Part of subcall function 00410822: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,00405A9F,00000000,73BDA22C), ref: 00410837
Part of subcall function 00410822: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00410856

CoUninitialize.OLE32(?,00406AC1,0041D835,0042D9B8,0042D9B9,?,00000000,00000000,0042DB70,0042DB71,?,?,?,?,00000000,0042D9A0), ref: 00404D21
CoUninitialize.OLE32(?,?,0042DB71,?,?,?,?,00000000,0042D9A0,0042D9A1), ref: 00404DE4
CoUninitialize.OLE32(?,?,?,?,?,0042DB71,?,?,?,?,00000000,0042D9A0,0042D9A1), ref: 00404E65
__Init_thread_footer.LIBCMT ref: 00404046

Part of subcall function 00409C7B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401089,0042DBF4,0041DCC0), ref: 00409C85
Part of subcall function 00409C7B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401089,0042DBF4,0041DCC0), ref: 00409CB8
Part of subcall function 00409C7B: RtlWakeAllConditionVariable.NTDLL ref: 00409D2F

Part of subcall function 00402220: CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 00402256
Part of subcall function 00402220: WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402277
Part of subcall function 00402220: CloseHandle.KERNEL32(00000000), ref: 0040227E

__Init_thread_footer.LIBCMT ref: 00404222

Part of subcall function 00409CC5: EnterCriticalSection.KERNEL32(0042D064,?,?,?,0040104A,0042DBF4), ref: 00409CD0
Part of subcall function 00409CC5: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,0040104A,0042DBF4), ref: 00409D0D

Strings

rmBK, xrefs: 004048FA
get, xrefs: 00405EB1
Y@BA, xrefs: 00404660
SUB=, xrefs: 00405AB8
O@K\, xrefs: 00404904
185.156.72.65, xrefs: 0040601B, 00406034
ZK\., xrefs: 00404B8B

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Init_thread_footer$CriticalSection$CreateFileUninitialize$EnterLeavePathSleepTime$ByteCharCloseConditionDirectoryFolderHandleInitializeInstanceMultiSystemTempUnothrow_t@std@@@VariableWakeWideWrite__ehfuncinfo$??2@
String ID: 185.156.72.65$O@K\$SUB=$Y@BA$ZK\.$get$rmBK
API String ID: 995133137-3578497191
Opcode ID: ce9b54ea2defedab38e7e3161f400f5d63c440566f465774b986bf57360a8c7f
Instruction ID: 6a8ba5f9be4b72ae1469cca8882757b6bc7ac7481bdf7cf44a4378d84f27710c
Opcode Fuzzy Hash: ce9b54ea2defedab38e7e3161f400f5d63c440566f465774b986bf57360a8c7f
Instruction Fuzzy Hash: 44F2DFB0E042549BDB24DF24DC48B9EBBB0EF45304F5442E9E5097B2D2DB78AA84CF59

Function 00404F70 Relevance: 45.4, APIs: 16, Strings: 9, Instructions: 1645
sleepregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410822: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,00405A9F,00000000,73BDA22C), ref: 00410837
Part of subcall function 00410822: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00410856

Part of subcall function 00409CC5: EnterCriticalSection.KERNEL32(0042D064,?,?,?,0040104A,0042DBF4), ref: 00409CD0
Part of subcall function 00409CC5: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,0040104A,0042DBF4), ref: 00409D0D

__Init_thread_footer.LIBCMT ref: 004050DD
Sleep.KERNEL32(00000BB8,00000000,?,00406AA1,0041D8D0,0042DBDC,0042DBDD), ref: 004052F5
__Init_thread_footer.LIBCMT ref: 004053EB
Sleep.KERNEL32(000007D0), ref: 00405755
Sleep.KERNEL32(000007D0), ref: 0040576F
CoUninitialize.OLE32(?,?,0042DC19,?,?,?,?,?,?,?,?,?,?,00000000,0042DBDD), ref: 004057A5
CoUninitialize.OLE32(?,?,?,?,?,0042DC19,?,?,?,?,?,?,?), ref: 004057D1
RegCreateKeyExA.ADVAPI32(80000001,?,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00405923
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020006,?), ref: 00405945
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?), ref: 0040596D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00405976
Sleep.KERNEL32(000003E8), ref: 00405AB0

Strings

get, xrefs: 00405EB1
updateSW, xrefs: 0040567B
SUB=, xrefs: 00405AB8
mixone, xrefs: 00406239
185.156.72.65, xrefs: 00406AB2
u%, xrefs: 00406936
185.156.72.65, xrefs: 00406A82
@BAO, xrefs: 0040537C
185.156.72.65, xrefs: 0040601B, 00406034, 004068FA

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Sleep$CriticalInit_thread_footerSectionTimeUninitialize$CloseCreateEnterFileLeaveOpenSystemUnothrow_t@std@@@Value__ehfuncinfo$??2@
String ID: 185.156.72.65$185.156.72.65$185.156.72.65$@BAO$SUB=$get$mixone$updateSW$u%
API String ID: 606935701-1501174972
Opcode ID: 33f59ebd4ed12ef44d3d881ceef11d19fae5b435b75ea3b5b89dac7f8ecb6f99
Instruction ID: 5b15cd53af07887682d130406d81e99ec93c25d434b47868d83c22c89ba1756f
Opcode Fuzzy Hash: 33f59ebd4ed12ef44d3d881ceef11d19fae5b435b75ea3b5b89dac7f8ecb6f99
Instruction Fuzzy Hash: BBD20271D001149BDB18EB24CD49BAEBB75AF01304F5441BEE8097B2D2DB78AE85CF99

Function 047A8464 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 047A848C
Module32First.KERNEL32(00000000,00000224), ref: 047A84AC

Memory Dump Source

Source File: 00000000.00000002.4101686121.00000000047A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_47a0000_file.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 5dc7c83e20f23cc8e33816e0c8d348b8f7c13a94c26d9eda38bb56e96fa06e4a
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 8DF09635100711AFE7203FF59C8CB6EB6E8BF89725F110728E642952C0DB74F8554AA2

Function 004087E0 Relevance: 2.5, Strings: 2, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

mixtwo, xrefs: 004087FD
nosub, xrefs: 004087EE

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: mixtwo$nosub
API String ID: 3472027048-187875987
Opcode ID: ab4f70d645e5df1053a7a44eb3d24a53cf0cacacc672b73b3debad2563601ef3
Instruction ID: d051705d2d3a1196041d610bae506d61a1e8aa88cf060e84ab2565e50524cdd9
Opcode Fuzzy Hash: ab4f70d645e5df1053a7a44eb3d24a53cf0cacacc672b73b3debad2563601ef3
Instruction Fuzzy Hash: AAD05286F0420822C00031BE2E0FA1C3A18064262EFA0122AE820226C3B8882A2489EF

Function 00706806 Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,00706802,00000004), ref: 0070689B

Memory Dump Source

Source File: 00000000.00000002.4100040646.0000000000706000.00000040.00000001.01000000.00000003.sdmp, Offset: 00706000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_706000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 4cb6c183d43e8fc2288822a573204162e5b2453ecf25750f029c2e2cbfc3349c
Instruction ID: 52e027221de22c384212c66738c7f7a9fc369a946723064524be019914ce5a2d
Opcode Fuzzy Hash: 4cb6c183d43e8fc2288822a573204162e5b2453ecf25750f029c2e2cbfc3349c
Instruction Fuzzy Hash: BAF0A7B2908115FEEB10DF409530ABE3AF8EB85B30F30C715F806C65C1D2695C74A665

Function 00401830 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 106
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 004018A3
HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 004018C9
HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 004018EF

Part of subcall function 004024A0: Concurrency::cancel_current_task.LIBCPMT ref: 004025C9

HttpAddRequestHeadersA.WININET(?,00000000,00000000,20000000), ref: 00401915

Strings

text, xrefs: 00401B8F
Accept-Language: ru-RU,ru;q=0.9,en;q=0.8, xrefs: 004018A7
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0, xrefs: 004018F3
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1, xrefs: 00401862
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1, xrefs: 004018CD
http://, xrefs: 00401EF4, 004021D3
GET, xrefs: 004020E7

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: HeadersHttpRequest$Concurrency::cancel_current_task
String ID: Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1$Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0$Accept-Language: ru-RU,ru;q=0.9,en;q=0.8$Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1$GET$http://$text
API String ID: 2146599340-4172842843
Opcode ID: 422d38bf1008db8560859125de3d0501a6bdee6f1042d5366f80bf11e058982a
Instruction ID: 7e6d5c8cd7aa1cabae0cdc9af9d1d54ef5f059dc9231cd92a953cd594aab5962
Opcode Fuzzy Hash: 422d38bf1008db8560859125de3d0501a6bdee6f1042d5366f80bf11e058982a
Instruction Fuzzy Hash: 05314371E00109EBEB14DBA9CC95FEEB7B9EB08714FA0812AE511735D0C7789945CBA4

Function 0495003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 0495024D

Strings

cess, xrefs: 0495018D
kernel32.dll, xrefs: 0495008F, 04950095

Memory Dump Source

Source File: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, Offset: 04950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4950000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: e66cd634b46ade7cedf94661ff97dd16c42cd12a520f0e41bcf94499f40e58ad
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: F2526D74A01229DFDB64CF58C985BACBBB5BF09304F1480E9E94DA7361DB30AA85DF14

Function 00405A50 Relevance: 11.2, APIs: 2, Strings: 5, Instructions: 678
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00410822: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,00405A9F,00000000,73BDA22C), ref: 00410837
Part of subcall function 00410822: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00410856

Sleep.KERNEL32(000003E8), ref: 00405AB0

Strings

get, xrefs: 00405EB1
SUB=, xrefs: 00405AB8
u%, xrefs: 00406936
185.156.72.65, xrefs: 00406A82
185.156.72.65, xrefs: 0040601B, 00406034, 004068FA

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Time$FileSleepSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: 185.156.72.65$185.156.72.65$SUB=$get$u%
API String ID: 2563648476-311857291
Opcode ID: 664b2517046e8848212832c9034c49cb43a53afe8dead0a995ac38afe4edbc90
Instruction ID: 73809eb16a5d3869ae15fb7337a890a5b139b8f1a0f0395b135ebc5315de088a
Opcode Fuzzy Hash: 664b2517046e8848212832c9034c49cb43a53afe8dead0a995ac38afe4edbc90
Instruction Fuzzy Hash: 03326571D001189ACB19FB76C95AAEE73785F14308F10817FF846771D2EE7C6A48CAA9

Function 00401E50 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

http://, xrefs: 004021D3

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: http://
API String ID: 0-1121587658
Opcode ID: 62fa76301f8a52dd516a2f10eda550d712df552a2e5fa503cadb94ab45312fa8
Instruction ID: 283a115399ec50033446259c01340d37f537f7c1e1c45d518ea9d7f2bb9a556a
Opcode Fuzzy Hash: 62fa76301f8a52dd516a2f10eda550d712df552a2e5fa503cadb94ab45312fa8
Instruction Fuzzy Hash: 11519071E002099FDF14CFA9C985BEEB7B9EB08304F10812EE915B76C1D7796944CB94

Function 00606B4B Relevance: 4.6, APIs: 3, Instructions: 114
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 0060A8E7
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 0060A90E
GetNativeSystemInfo.KERNEL32(?), ref: 0060A965

Memory Dump Source

Source File: 00000000.00000002.4100040646.0000000000603000.00000040.00000001.01000000.00000003.sdmp, Offset: 00603000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_603000_file.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID:
API String ID: 1247124224-0
Opcode ID: 36d5b6e9c21d8abcd7cdcef39b8a262e8012dc77a26b304ac3de0961534107f5
Instruction ID: 2d8d8014c43a29e3b9b4aa2dbdcbd777084760f71e58c0f7fb8591dc87ca9cc7
Opcode Fuzzy Hash: 36d5b6e9c21d8abcd7cdcef39b8a262e8012dc77a26b304ac3de0961534107f5
Instruction Fuzzy Hash: BF41817115420EDFEF25DFA0CD85BEF3BA6EB05340F110526D981C2A80DB764CA5CB5A

Function 00706839 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 61
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,00706802,00000004), ref: 0070689B

Strings

T@}, xrefs: 00706861

Memory Dump Source

Source File: 00000000.00000002.4100040646.0000000000706000.00000040.00000001.01000000.00000003.sdmp, Offset: 00706000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_706000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID: T@}
API String ID: 544645111-1245257210
Opcode ID: 7f1163518c9d8ce7789f66fff99b1fa5f3d38663bcc5c5ff9879b8fdc1499778
Instruction ID: dedbfc5a40b337e1f3d924e5b04ea25b93734d45fa281e4edb1c8bcf8f83545b
Opcode Fuzzy Hash: 7f1163518c9d8ce7789f66fff99b1fa5f3d38663bcc5c5ff9879b8fdc1499778
Instruction Fuzzy Hash: AA01F96A50D291DFD702CF6085715EA7FF0DE1B720B24C6A7E846CB5C3C2184C2AE762

Function 00413CB9 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?,5(@,?,0040AD5B,?,5(@,185.156.72.65,?,?,004035B7,?,?,5(@), ref: 00413CEB

Strings

5(@, xrefs: 00413CBE

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: 5(@
API String ID: 1279760036-4133491027
Opcode ID: 0317c977ae3de03b4a355117f1d18651feb64bc701aa808cd4791dde922aff94
Instruction ID: 6b8e07f77369cee0563c76895a616f9db891ca7c172fe53b45855655e8c042ba
Opcode Fuzzy Hash: 0317c977ae3de03b4a355117f1d18651feb64bc701aa808cd4791dde922aff94
Instruction Fuzzy Hash: 10E0E5322002115BD6213F669C05BDB7A5C9B417A2F140137FC56F62D0EA6DCDC241ED

Function 04950E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32(00000400,?,?,04950223,?,?), ref: 04950E19
SetErrorMode.KERNEL32(00000000,?,?,04950223,?,?), ref: 04950E1E

Memory Dump Source

Source File: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, Offset: 04950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4950000_file.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: 43bafc9d913032364e66eb76556220aff11c3ffb76751d3d3a00cc89f2821bfa
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 3ED0123114512877D7002A94DC0DBCD7B1CDF05B62F108021FB0DD9080C770954047E5

Function 00605DF2 Relevance: 1.6, APIs: 1, Instructions: 59
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 0060960D

Memory Dump Source

Source File: 00000000.00000002.4100040646.0000000000603000.00000040.00000001.01000000.00000003.sdmp, Offset: 00603000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_603000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b7ac928487658b8f3f8aaea6754729709319a5004d6850eeddc60fd3a76e234a
Instruction ID: a947152b9f66a0b3fd12702b7aa342d05c8d836f6efe1d9095b4b76eca72415a
Opcode Fuzzy Hash: b7ac928487658b8f3f8aaea6754729709319a5004d6850eeddc60fd3a76e234a
Instruction Fuzzy Hash: E9116DB291C220AFD305AF28C84567AB7E9EF58720F1A482DEAC9D7340E2315C509BD3

Function 0070681F Relevance: 1.5, APIs: 1, Instructions: 30
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,00706802,00000004), ref: 0070689B

Memory Dump Source

Source File: 00000000.00000002.4100040646.0000000000706000.00000040.00000001.01000000.00000003.sdmp, Offset: 00706000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_706000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 441b078b58ba90b658bc68aca70dc28478d87110c4cd5696fab324390f46118a
Instruction ID: e5fc2831fdd356470ea524ab0c1703fa2738362d58fc0d70fe36ec8eefc9282a
Opcode Fuzzy Hash: 441b078b58ba90b658bc68aca70dc28478d87110c4cd5696fab324390f46118a
Instruction Fuzzy Hash: 4AF0A072908155FFE710CF109930AAE3BE4EB45720F34C606F806835C1C2289C65A625

Function 00706888 Relevance: 1.5, APIs: 1, Instructions: 10
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,00706802,00000004), ref: 0070689B

Memory Dump Source

Source File: 00000000.00000002.4100040646.0000000000706000.00000040.00000001.01000000.00000003.sdmp, Offset: 00706000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_706000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 7823b62450591213b8f6a08348e639a68a2700acade68dba85eb105d53817ac8
Instruction ID: a65902617783ac2e57b6638db24795b00ab0a47438640e92303edb50415b6834
Opcode Fuzzy Hash: 7823b62450591213b8f6a08348e639a68a2700acade68dba85eb105d53817ac8
Instruction Fuzzy Hash: 7DD0127245826DADDF11DF5448157CE7E24EB19700F148144FC0501992D6661824C705

Function 047A8123 Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000040), ref: 047A8174

Memory Dump Source

Source File: 00000000.00000002.4101686121.00000000047A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_47a0000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: b7ee4685b3560880c722a87af921d37dd854d14b97f1e34b5c59a131e3db5e88
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: B5113C79A00208EFDB01DF98C989E98BBF5EF08350F058094F9489B361D371EA50DF81

Function 00706F6A Relevance: 1.3, APIs: 1, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00706FF0

Memory Dump Source

Source File: 00000000.00000002.4100040646.0000000000706000.00000040.00000001.01000000.00000003.sdmp, Offset: 00706000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_706000_file.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 35438392d5f74c6afd304e3771089eb33d598f1ed56aa19d2479f0a468280af7
Instruction ID: 0e2640394576cb740f1f3895bb9228d68199dc944fe15f2cba5b7b3438a78847
Opcode Fuzzy Hash: 35438392d5f74c6afd304e3771089eb33d598f1ed56aa19d2479f0a468280af7
Instruction Fuzzy Hash: EBF0272190D545CED3082F25456417DFFE5AF02300FB54BAFD4C19A2D2D1299989D302

Function 00706FC3 Relevance: 1.3, APIs: 1, Instructions: 29sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00706FF0

Memory Dump Source

Source File: 00000000.00000002.4100040646.0000000000706000.00000040.00000001.01000000.00000003.sdmp, Offset: 00706000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_706000_file.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: d367178d4dd3184ec2ace5532265be73a72373fdaa781de8a491b2fdc268bb30
Instruction ID: 376118c96778d3a7b4bf910704dfb80aeac680cac646707968ad09269c396678
Opcode Fuzzy Hash: d367178d4dd3184ec2ace5532265be73a72373fdaa781de8a491b2fdc268bb30
Instruction Fuzzy Hash: ECF0BEF5A0C646EFE3096F388410379BFE0FB95301F214A6A84C19A1C3E2389959DB02

Non-executed Functions

Function 04953FA7 Relevance: 45.6, APIs: 20, Strings: 5, Instructions: 1839sleepcomCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000104,?,0042C014,0041F068,00000000), ref: 04954011
Sleep.KERNEL32(000003E8), ref: 049541A9
__Init_thread_footer.LIBCMT ref: 0495477E
__Init_thread_footer.LIBCMT ref: 04954944
SHGetFolderPathA.SHELL32(00000000,00000000,00000000,00000000,?,00000000,?,04956D28,0041D835,0042D9B8,0042D9B9,?,00000000,00000000,0042DB70,0042DB71), ref: 04954B4E
__Init_thread_footer.LIBCMT ref: 04954BDC
__Init_thread_footer.LIBCMT ref: 04954E45
CoInitialize.OLE32(00000000), ref: 04954EC6
CoCreateInstance.COMBASE(0041F290,00000000,00000001,0041F260,?), ref: 04954EE1
__Init_thread_footer.LIBCMT ref: 04955344
Sleep.KERNEL32(00000BB8,00000000,?,04956D08,0041D8D0,0042DBDC,0042DBDD), ref: 0495555C
__Init_thread_footer.LIBCMT ref: 04955652
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000104,?,04956D28,0041D835,0042D9B8,0042D9B9,?,00000000,00000000,0042DB70,0042DB71), ref: 04954F4F

Part of subcall function 04960A89: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,04955D06,00000000,0042C014), ref: 04960A9E
Part of subcall function 04960A89: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04960ABD

__Init_thread_footer.LIBCMT ref: 049542AD

Part of subcall function 04959EE2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04959EEC
Part of subcall function 04959EE2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04959F1F

Part of subcall function 04952487: CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000), ref: 049524BD
Part of subcall function 04952487: WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 049524DE
Part of subcall function 04952487: CloseHandle.KERNEL32(00000000), ref: 049524E5

__Init_thread_footer.LIBCMT ref: 04954489

Part of subcall function 04959F2C: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04959F37
Part of subcall function 04959F2C: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04959F74

Strings

O@K\, xrefs: 04954B6B
Y@BA, xrefs: 049548C7
rmBK, xrefs: 04954B61
ZK\., xrefs: 04954DF2
185.156.72.65, xrefs: 04956282, 0495629B

Memory Dump Source

Source File: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, Offset: 04950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4950000_file.jbxd

Yara matches

Similarity

API ID: Init_thread_footer$CriticalSection$File$CreateEnterLeavePathSleepTime$ByteCharCloseFolderHandleInitializeInstanceMultiSystemTempUnothrow_t@std@@@WideWrite__ehfuncinfo$??2@
String ID: 185.156.72.65$O@K\$Y@BA$ZK\.$rmBK
API String ID: 529012138-2214808123
Opcode ID: 80f03fce48ad90c555d326397e9bffadaef10e10c65fa4ab2e04da8cea0e0d82
Instruction ID: 175f9b9b8e5e0ed6967ab2b4efcc17d5098a5b891e341e984bef65d0d0da54a3
Opcode Fuzzy Hash: 80f03fce48ad90c555d326397e9bffadaef10e10c65fa4ab2e04da8cea0e0d82
Instruction Fuzzy Hash: 52F2D1B0D042549FEB24CF24DC48BADBBB4AF44308F6442E8E8096B2A1D775BAC5CF55

Function 00402EE0 Relevance: 33.7, APIs: 11, Strings: 8, Instructions: 454COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000000D), ref: 00402F02
SetLastError.KERNEL32(000000C1), ref: 00402F44

Strings

FileHeader.Machine != HOST_MACHINE!, xrefs: 00402FB3
Size is not valid!, xrefs: 00402F08
DOS header size is not valid!, xrefs: 00402F71
ERROR_OUTOFMEMORY!, xrefs: 00403062
Section alignment invalid!, xrefs: 00402FC7
Signature != IMAGE_NT_SIGNATURE!, xrefs: 00402FA1
DOS header is not valid!, xrefs: 00402F32
alignedImageSize != AlignValueUp!, xrefs: 0040302C

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast
String ID: DOS header is not valid!$DOS header size is not valid!$ERROR_OUTOFMEMORY!$FileHeader.Machine != HOST_MACHINE!$Section alignment invalid!$Signature != IMAGE_NT_SIGNATURE!$Size is not valid!$alignedImageSize != AlignValueUp!
API String ID: 1452528299-2436911586
Opcode ID: 969231b7725f6e648ae7b53270e343726ac677e9ab86d7066b7749be6261437e
Instruction ID: feefb59cb084f329bf9f2ee3fcaf904be4f7c95626e3fbc9d9f9d2488596d2a7
Opcode Fuzzy Hash: 969231b7725f6e648ae7b53270e343726ac677e9ab86d7066b7749be6261437e
Instruction Fuzzy Hash: C3F1AC71B00205ABCB10CF69D985BAAB7B4BF48705F14407AE909EB6C1D779ED11CB98

Function 004035D0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 225encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,?,00000018,F0000000,73BDA22C), ref: 00403650
CryptCreateHash.ADVAPI32(?,0000800C,00000000,00000000,?), ref: 00403674
CryptHashData.ADVAPI32(?,00000000,?,00000000), ref: 004036DE
GetLastError.KERNEL32 ref: 004036E8
CryptDeriveKey.ADVAPI32(?,0000660E,?,00000000,?), ref: 00403710
GetLastError.KERNEL32 ref: 0040371A
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040372A
CryptDecrypt.ADVAPI32(?,00000000,00000000,00000000,?,00000000), ref: 004037EC
CryptDestroyKey.ADVAPI32(?), ref: 0040385E

Strings

Microsoft Enhanced RSA and AES Cryptographic Provider, xrefs: 0040362C

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Crypt$ContextErrorHashLast$AcquireCreateDataDecryptDeriveDestroyRelease
String ID: Microsoft Enhanced RSA and AES Cryptographic Provider
API String ID: 3761881897-63410773
Opcode ID: d367fb143b6554c856abbd5ed66d5e96836dac5444f5810d3b21dde5d4a3622d
Instruction ID: 2781db946ec69ebb5a82e2500c6cd73aae13b8bfd69ebbb4ddbc14150c00f762
Opcode Fuzzy Hash: d367fb143b6554c856abbd5ed66d5e96836dac5444f5810d3b21dde5d4a3622d
Instruction Fuzzy Hash: DF819F71A00218AFEF209F25CC45B9ABBB9FF49300F1481BAF50DA7291DB359E858F55

Function 04953837 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 225encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,?,00000018,F0000000,0042C014), ref: 049538B7
CryptCreateHash.ADVAPI32(?,0000800C,00000000,00000000,?), ref: 049538DB
CryptHashData.ADVAPI32(?,00000000,?,00000000), ref: 04953945
GetLastError.KERNEL32 ref: 0495394F
CryptDeriveKey.ADVAPI32(?,0000660E,?,00000000,?), ref: 04953977
GetLastError.KERNEL32 ref: 04953981
CryptReleaseContext.ADVAPI32(?,00000000), ref: 04953991
CryptDecrypt.ADVAPI32(?,00000000,00000000,00000000,?,00000000), ref: 04953A53
CryptDestroyKey.ADVAPI32(?), ref: 04953AC5

Strings

Microsoft Enhanced RSA and AES Cryptographic Provider, xrefs: 04953893

Memory Dump Source

Source File: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, Offset: 04950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4950000_file.jbxd

Yara matches

Similarity

API ID: Crypt$ContextErrorHashLast$AcquireCreateDataDecryptDeriveDestroyRelease
String ID: Microsoft Enhanced RSA and AES Cryptographic Provider
API String ID: 3761881897-63410773
Opcode ID: 6e6210ff55f32b3241f3b0da8e138babaf92a1c0b82018977fa48d91ab2d5297
Instruction ID: 59e7dc52144a8d82591a686373c6de8e293fa5690d896e85b7fa2fa1b2dd26a3
Opcode Fuzzy Hash: 6e6210ff55f32b3241f3b0da8e138babaf92a1c0b82018977fa48d91ab2d5297
Instruction Fuzzy Hash: FD816171A002189FEB24DF24CC45B9ABBB5EF45340F1481B9E94DE72A1DB31AE858F51

Function 00402A50 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 113memorywindowCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 00402AF8
GetLastError.KERNEL32(00000400,?,00000000,00000000,?,?,?,?), ref: 00402B0D
FormatMessageA.KERNEL32(00001300,00000000,00000000,?,?,?,?), ref: 00402B1B
LocalAlloc.KERNEL32(00000040,?,?,?,?,?), ref: 00402B36
OutputDebugStringA.KERNEL32(00000000,?,?), ref: 00402B55
LocalFree.KERNEL32(00000000), ref: 00402B62
LocalFree.KERNEL32(?), ref: 00402B67

Strings

Error protecting memory page, xrefs: 00402B41
%s: %s, xrefs: 00402B46

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Local$Free$AllocDebugErrorFormatLastMessageOutputProtectStringVirtual
String ID: %s: %s$Error protecting memory page
API String ID: 839691724-1484484497
Opcode ID: 9750dd737f677cfe2bf35afdb918f3e7736876f76d8ddec4ee516f8fc37c3b4c
Instruction ID: 7115b4f99f47229cfead79ad45df677009e1c347b6b4b41756aa32ea0cb5f428
Opcode Fuzzy Hash: 9750dd737f677cfe2bf35afdb918f3e7736876f76d8ddec4ee516f8fc37c3b4c
Instruction Fuzzy Hash: A0311431B00104AFDB10DF58DD45FAAB7A8EF48704F4541BAE905EB2D2DB79AD06CB98

Function 049551D7 Relevance: 12.9, APIs: 5, Strings: 2, Instructions: 621sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 04960A89: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,04955D06,00000000,0042C014), ref: 04960A9E
Part of subcall function 04960A89: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04960ABD

Part of subcall function 04959F2C: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04959F37
Part of subcall function 04959F2C: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04959F74

__Init_thread_footer.LIBCMT ref: 04955344
Sleep.KERNEL32(00000BB8,00000000,?,04956D08,0041D8D0,0042DBDC,0042DBDD), ref: 0495555C
__Init_thread_footer.LIBCMT ref: 04955652
Sleep.KERNEL32(000007D0), ref: 049559BC
Sleep.KERNEL32(000007D0), ref: 049559D6

Strings

@BAO, xrefs: 049555E3
updateSW, xrefs: 049558E2

Memory Dump Source

Source File: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, Offset: 04950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4950000_file.jbxd

Yara matches

Similarity

API ID: Sleep$CriticalInit_thread_footerSectionTime$EnterFileLeaveSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: @BAO$updateSW
API String ID: 3554146954-956047173
Opcode ID: 459a83f2fd3c5c07858fe4c4e2d786a264afa78a17bbb4541cda9f244f9323ee
Instruction ID: cb50f06d884e9880f0ef62a95241579db65518dc8b806f430c65bdc54610dab4
Opcode Fuzzy Hash: 459a83f2fd3c5c07858fe4c4e2d786a264afa78a17bbb4541cda9f244f9323ee
Instruction Fuzzy Hash: 953213B0D00254DBEB28DF24CC987ADBBB4AF40314F6542F9D8096B2A6D775AE84CF45

Function 005F2856 Relevance: 11.6, Strings: 8, Instructions: 1617COMMON

Download Yara Rule

Strings

CGm?, xrefs: 005F2E5A
m*}W, xrefs: 005F2DA2
0?_, xrefs: 005F37D0
`"7/, xrefs: 005F351A
zU5o, xrefs: 005F3678
3^u, xrefs: 005F356C
m*}W, xrefs: 005F2DB7
{!~, xrefs: 005F2B13

Memory Dump Source

Source File: 00000000.00000002.4100040646.0000000000470000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID:
String ID: 3^u$CGm?$`"7/$m*}W$m*}W$zU5o${!~$0?_
API String ID: 0-2384424205
Opcode ID: afd952f234d7271102e859ae948797e2556ca1c02ebc3e84fc726e221d42abc4
Instruction ID: 4013883d88a73e5b6520d87992df2cebf0f17af308c9d41ba8685c21f9fa18b1
Opcode Fuzzy Hash: afd952f234d7271102e859ae948797e2556ca1c02ebc3e84fc726e221d42abc4
Instruction Fuzzy Hash: 8BB206F3A0C204AFE304AE2DEC8567AB7E9EB94720F16493DE6C5C3344EA7558058797

Function 005E33A6 Relevance: 10.4, Strings: 7, Instructions: 1614COMMON

Download Yara Rule

Strings

I5j, xrefs: 005E46C4
6Ny, xrefs: 005E34A6
RQ{, xrefs: 005E38F5
%D~, xrefs: 005E3833
a^k, xrefs: 005E3970
[J?, xrefs: 005E380B
Zg>, xrefs: 005E377E

Memory Dump Source

Source File: 00000000.00000002.4100040646.0000000000470000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID:
String ID: %D~$6Ny$Zg>$a^k$I5j$RQ{$[J?
API String ID: 0-459213770
Opcode ID: 89f570901e7719fe201a3a117d68dd54fd798d9a09b20606662acf34cb720e90
Instruction ID: 8d1767224888694120d6a5540c9b07b2ad4c33f72c85a3b4b1470dba54728fba
Opcode Fuzzy Hash: 89f570901e7719fe201a3a117d68dd54fd798d9a09b20606662acf34cb720e90
Instruction Fuzzy Hash: 83B20BF3A0C200AFE3146E2DEC8566AFBE9EF94720F1A453DEAC4C7344E67558058697

Function 005DAE72 Relevance: 10.3, Strings: 7, Instructions: 1598COMMON

Download Yara Rule

Strings

![, xrefs: 005DB49A
H\y>, xrefs: 005DB420
|7Y, xrefs: 005DBA78
~-}}, xrefs: 005DC0D1
});m, xrefs: 005DB78F
y);m, xrefs: 005DB78A
Y>, xrefs: 005DB0BA

Memory Dump Source

Source File: 00000000.00000002.4100040646.0000000000470000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID:
String ID: ![$H\y>$Y>$y);m$|7Y$});m$~-}}
API String ID: 0-232953881
Opcode ID: 3f2f09719ffa588a0edf1897c12d3bd9ee24ca63a5ac162775867729e27907f5
Instruction ID: b762b5635f0e52cb7a0e838c8b5f0c3cd80ae4209574182c4148ca3ef704b97a
Opcode Fuzzy Hash: 3f2f09719ffa588a0edf1897c12d3bd9ee24ca63a5ac162775867729e27907f5
Instruction Fuzzy Hash: 18B2F6F360C204AFE3046E2DEC8567ABBE9EF94320F1A493DE6C4C7744E63598458697

Function 005DE398 Relevance: 10.3, Strings: 7, Instructions: 1580COMMON

Download Yara Rule

Strings

7PF0, xrefs: 005DF39D
(_b}, xrefs: 005DF5C0
aFw], xrefs: 005DEBA3
sw, xrefs: 005DED65
~]6, xrefs: 005DF3E2
DF7, xrefs: 005DF131
wAi|, xrefs: 005DF645

Memory Dump Source

Source File: 00000000.00000002.4100040646.0000000000470000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID:
String ID: sw$(_b}$7PF0$DF7$aFw]$wAi|$~]6
API String ID: 0-1941313218
Opcode ID: b5f01af9574a2a6797d2bde44680c9cba9d7e2a6b77ab59fc755cd842447e046
Instruction ID: a880e8de71da56c785919ca546602f02c341b51a446c823c736bfd513c4acae5
Opcode Fuzzy Hash: b5f01af9574a2a6797d2bde44680c9cba9d7e2a6b77ab59fc755cd842447e046
Instruction Fuzzy Hash: 5EB2F6F360C200AFE704AE29EC8567AFBE9EF94720F16493DEAC5C3744E63558058697

Function 0041A346 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1473COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0041A55D

Strings

1#IND, xrefs: 0041A44B
1#SNAN, xrefs: 0041A452
1#INF, xrefs: 0041A47C
1#QNAN, xrefs: 0041A459

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 55dd87499faf8fcf66fe19d6c791e996a87d6224a05bf9275e3249bc6ed21a11
Instruction ID: 4ec5cfcd79f9b81e0d104b8321146cba3f0ab1dc6500a030f703b9c7425dc3b2
Opcode Fuzzy Hash: 55dd87499faf8fcf66fe19d6c791e996a87d6224a05bf9275e3249bc6ed21a11
Instruction Fuzzy Hash: E8D21671E092288FDB65CE28DD807EAB7B5EB44305F1441EAD80DE7240E778AEC58F85

Function 005E693F Relevance: 9.1, Strings: 6, Instructions: 1638COMMON

Download Yara Rule

Strings

Qo, xrefs: 005E755C
4r:, xrefs: 005E724B
* y, xrefs: 005E7691
7}?, xrefs: 005E7ACB
kA_l, xrefs: 005E6B5F
ms}, xrefs: 005E7C91

Memory Dump Source

Source File: 00000000.00000002.4100040646.0000000000470000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID:
String ID: * y$7}?$kA_l$ms}$4r:$Qo
API String ID: 0-4085897978
Opcode ID: bf61598a84acb3130223c529e839d831bb01eb6edb27b8ce8f3d1a2b25a3f166
Instruction ID: fc6d4b9ca8a0f7999302a354d88e6c925fe07561f431ad9a02f5155270e6ec87
Opcode Fuzzy Hash: bf61598a84acb3130223c529e839d831bb01eb6edb27b8ce8f3d1a2b25a3f166
Instruction Fuzzy Hash: 35B2F9F390C2149FE3046E2DEC8567AFBE9EF94320F1A493DEAC487744EA7558018697

Function 00401970 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 293networkfileCOMMON

Download Yara Rule

APIs

InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 00401A05
InternetReadFile.WININET(?,00000000,000003E8,00000000), ref: 00401A28

Strings

text, xrefs: 00401B8F

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: FileInternet$PointerRead
String ID: text
API String ID: 3197321146-999008199
Opcode ID: 0d5891a278ce307004780994f853f58be742df4ecfdd0caad83694c416481f12
Instruction ID: 56e9ac6e571947bcf275884445d614b5348a2aaf1a2f7cc802118cd3fea156c2
Opcode Fuzzy Hash: 0d5891a278ce307004780994f853f58be742df4ecfdd0caad83694c416481f12
Instruction Fuzzy Hash: 10C13970A002189FDB24DF54CC85BE9B7B5EF49304F1041EAE409B72A1DB78AE95CF99

Function 005F0D31 Relevance: 7.9, Strings: 5, Instructions: 1674COMMON

Download Yara Rule

Strings

_~V, xrefs: 005F138F
*o, xrefs: 005F1AC7
`\~, xrefs: 005F1541
\xj, xrefs: 005F2024
dW}, xrefs: 005F0F69

Memory Dump Source

Source File: 00000000.00000002.4100040646.0000000000470000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID:
String ID: *o$\xj$_~V$`\~$dW}
API String ID: 0-1921357365
Opcode ID: 083c5c5b5ea82cd5ffa2e399e4c3be096146a88cf63fd4682e5a69f895f786f8
Instruction ID: 4bb03231a9a9e63b18b54833a49d383c3477b7e37ac134fccbf049556ab4bdcd
Opcode Fuzzy Hash: 083c5c5b5ea82cd5ffa2e399e4c3be096146a88cf63fd4682e5a69f895f786f8
Instruction Fuzzy Hash: 05B24AF360C2049FE3046E2DEC8567AFBE9EF94720F1A4A3DE6C5C3744E93598058696

Function 005ED5B7 Relevance: 7.9, Strings: 5, Instructions: 1663COMMON

Download Yara Rule

Strings

l}, xrefs: 005EE502
l}, xrefs: 005EE507
un}, xrefs: 005EE7B2
&H', xrefs: 005EE24D
\{u, xrefs: 005EE81E

Memory Dump Source

Source File: 00000000.00000002.4100040646.0000000000470000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID:
String ID: &H'$\{u$un}$l}$l}
API String ID: 0-3622401908
Opcode ID: 4fc0e92ec8c05b8f6eca42772c44f93c7fd9dc5cc04dd4dda4165a25b4bc2374
Instruction ID: da5c9db1c343fe53876a42dd7d99665beed30825b237f2a1ac31962b93e441b5
Opcode Fuzzy Hash: 4fc0e92ec8c05b8f6eca42772c44f93c7fd9dc5cc04dd4dda4165a25b4bc2374
Instruction Fuzzy Hash: 45B227F3A0C2149FE3046E2DEC8567AFBE9EF94620F16493DEAC5C3744EA3558058686

Function 005E189C Relevance: 7.9, Strings: 5, Instructions: 1622COMMON

Download Yara Rule

Strings

D$|, xrefs: 005E29AB
J+?, xrefs: 005E1BE0
i\, xrefs: 005E24EC
+}}, xrefs: 005E245B
JaZy, xrefs: 005E1996

Memory Dump Source

Source File: 00000000.00000002.4100040646.0000000000470000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID:
String ID: i\$ +}}$J+?$JaZy$D$|
API String ID: 0-3057257673
Opcode ID: 593fd618999ae1259ec00dcc3c82449d218b6844ccbf74fadebf70f0710ae03e
Instruction ID: 195ae45339d34056b23e3e2e2a29690d35ab20019a2ab0a7fab5c43a051d4008
Opcode Fuzzy Hash: 593fd618999ae1259ec00dcc3c82449d218b6844ccbf74fadebf70f0710ae03e
Instruction Fuzzy Hash: 30B217F360C2009FE304AE2DEC4567ABBE9EFD4720F16893DEAC5C7744EA3558058696

Function 005EB99E Relevance: 6.7, Strings: 4, Instructions: 1666COMMON

Download Yara Rule

Strings

S]_, xrefs: 005EC486
rgs, xrefs: 005EC5B0
h}, xrefs: 005EBB38
Z#t, xrefs: 005EC65D

Memory Dump Source

Source File: 00000000.00000002.4100040646.0000000000470000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID:
String ID: S]_$Z#t$rgs$h}
API String ID: 0-3028630491
Opcode ID: 12406312f79cfc89fa1ff026b9006e9479cb960c914d1c568c1c4cd2bcb1dafc
Instruction ID: f8217922c7bacf8ebbfeb13f92c6951cbec0f44e983773b4e059446c9adb6132
Opcode Fuzzy Hash: 12406312f79cfc89fa1ff026b9006e9479cb960c914d1c568c1c4cd2bcb1dafc
Instruction Fuzzy Hash: DBB249F3A082149FE3046E2DEC4567AFBEAEFD4720F1A453DEAC4C3744EA7558058692

Function 005E4E3C Relevance: 6.6, Strings: 4, Instructions: 1622COMMON

Download Yara Rule

Strings

d~?, xrefs: 005E5683
3ls, xrefs: 005E5BE9
k~o, xrefs: 005E5E66
?w, xrefs: 005E55E4

Memory Dump Source

Source File: 00000000.00000002.4100040646.0000000000470000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID:
String ID: 3ls$d~?$k~o$?w
API String ID: 0-3332638578
Opcode ID: f4d99b3f20039f576654e02166e551df6a0cb7d91120f46cc344ec541debc090
Instruction ID: 72aa684079d14f332a87d903c6ee37ea6236e0bc24cd0f77ccdacb065fcfd147
Opcode Fuzzy Hash: f4d99b3f20039f576654e02166e551df6a0cb7d91120f46cc344ec541debc090
Instruction Fuzzy Hash: 61B207F3A0C6049FE3046E2DEC8567ABBE9EF94360F1A493DE6C4C7744E93598018697

Function 005DFDBE Relevance: 6.6, Strings: 4, Instructions: 1597COMMON

Download Yara Rule

Strings

&9, xrefs: 005E0942
V-{, xrefs: 005E0BD7
0a~, xrefs: 005E038E
`_, xrefs: 005DFED2

Memory Dump Source

Source File: 00000000.00000002.4100040646.0000000000470000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID:
String ID: 0a~$V-{$`_$&9
API String ID: 0-206834471
Opcode ID: 341dd9a8f07342429fba5594d5ce52745aa20e4d583540084d68bcc3a6b14ea2
Instruction ID: da2a8b3af6208d4fa3e55b34b048d5161070769707f5485453acec5f56707fef
Opcode Fuzzy Hash: 341dd9a8f07342429fba5594d5ce52745aa20e4d583540084d68bcc3a6b14ea2
Instruction Fuzzy Hash: B4B2D4F350C2009FE704AE2DEC8567ABBE9EF94720F16893DEAC4C3744EA3558458697

Function 00410940 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3970a8edb598ee4cdd642c6aadd71a51f2b27cb13145b691a5b3c246aa97f6e8
Instruction ID: 78ffdd1b1e8fbf681df67024148688f8aa54f57810aac3ba8850cddb3c6bfb2a
Opcode Fuzzy Hash: 3970a8edb598ee4cdd642c6aadd71a51f2b27cb13145b691a5b3c246aa97f6e8
Instruction Fuzzy Hash: 87024D71E002199BDF14CFA9D9806EEBBB1FF48314F24826AE519E7340D775A981CB94

Function 04960BA7 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, Offset: 04950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4950000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3970a8edb598ee4cdd642c6aadd71a51f2b27cb13145b691a5b3c246aa97f6e8
Instruction ID: 5870f6e88b346de3dd458830fb0bab3246a4d891899ac372411a492dd1262dbd
Opcode Fuzzy Hash: 3970a8edb598ee4cdd642c6aadd71a51f2b27cb13145b691a5b3c246aa97f6e8
Instruction Fuzzy Hash: B9022D71E012199FDF14CFA8D9D0AAEBBB5FF48314F248269D91AEB340D731A941CB90

Function 0040A58A Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,00181B20), ref: 0040A596
IsDebuggerPresent.KERNEL32 ref: 0040A662
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040A682
UnhandledExceptionFilter.KERNEL32(?), ref: 0040A68C

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: b44e0052ca5400530e688fbbb916524e737d0e21bc499905028a740eb104beb1
Instruction ID: e2fd69841e347503e8527ce1becac27b78df2bbd7224e42b4cf7edbda655d181
Opcode Fuzzy Hash: b44e0052ca5400530e688fbbb916524e737d0e21bc499905028a740eb104beb1
Instruction Fuzzy Hash: 04313A75D4131CDBDB10DFA5D989BCDBBB8BF08304F1080AAE408A7290EB759E858F49

Function 0495A7F1 Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,00181B20), ref: 0495A7FD
IsDebuggerPresent.KERNEL32 ref: 0495A8C9
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0495A8E9
UnhandledExceptionFilter.KERNEL32(?), ref: 0495A8F3

Memory Dump Source

Source File: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, Offset: 04950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4950000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: b44e0052ca5400530e688fbbb916524e737d0e21bc499905028a740eb104beb1
Instruction ID: d80dbb66706cfd000b64b7993774e351344232ebf29181e0be46c47f672497d0
Opcode Fuzzy Hash: b44e0052ca5400530e688fbbb916524e737d0e21bc499905028a740eb104beb1
Instruction Fuzzy Hash: 9931E975D0521DDBDB10DFA4D9497CCBBB8BF08304F2041AAE509A7250EB715A858F49

Function 0040CDE3 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0040CEDB
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 0040CEE5
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 0040CEF2

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: e436a8829045c153a86cd1f8a8b118e982bc3228d08815e2757f6e40e94fe856
Instruction ID: c8210cab332152a7f303cacbc0cae8b9100ca1fc91568f2564f16f954c9570b7
Opcode Fuzzy Hash: e436a8829045c153a86cd1f8a8b118e982bc3228d08815e2757f6e40e94fe856
Instruction Fuzzy Hash: 3331D574941218EBCB21DF65D8897CDBBB4BF08314F5082EAE81CA7291E7749F858F49

Function 0495D04A Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,04952AA0), ref: 0495D142
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,04952AA0), ref: 0495D14C
UnhandledExceptionFilter.KERNEL32(0495277A,?,?,?,?,?,04952AA0), ref: 0495D159

Memory Dump Source

Source File: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, Offset: 04950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4950000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: eab9de89e4f223b0e8801f8ff3c4edb53ba30b9f948264c96fa02635900acdf3
Instruction ID: c2750cbfe8e65d27d420d393e087f44d5dc05252f40ce80360e105cbb7549b49
Opcode Fuzzy Hash: eab9de89e4f223b0e8801f8ff3c4edb53ba30b9f948264c96fa02635900acdf3
Instruction Fuzzy Hash: 1C31CA749012289BCB21DF64DC897CCB7B8BF48310F6081EAE80CA7260E7709F858F44

Function 0495092B Relevance: 3.8, Strings: 3, Instructions: 90COMMON

Download Yara Rule

Strings

., xrefs: 0495095F
GetProcAddress., xrefs: 049509DC, 049509DF, 049509E4
l, xrefs: 04950966

Memory Dump Source

Source File: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, Offset: 04950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4950000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: dda99c21e20aebc667b716420b59f138b9c13632cd9a7e34b5f863dc2035b6ef
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: F1315CB6900609DFDB10CF99C880AADBBF9FF48324F24445AD941A7324D771FA45CBA4

Function 005DCE53 Relevance: 3.7, Strings: 2, Instructions: 1185COMMON

Download Yara Rule

Strings

;w, xrefs: 005DD05F
1, xrefs: 005DD2AF

Memory Dump Source

Source File: 00000000.00000002.4100040646.0000000000470000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID:
String ID: ;w$1
API String ID: 0-108674526
Opcode ID: 3874811a65247e7d34884d56ab4ce35eca912a81577f5a4d6a56dfc25c6f3f00
Instruction ID: 26c08f444f8588f85b53b2250f92c420ee66300784c86592664296fe51d632c1
Opcode Fuzzy Hash: 3874811a65247e7d34884d56ab4ce35eca912a81577f5a4d6a56dfc25c6f3f00
Instruction Fuzzy Hash: 8682F7F36082049FE704AE2DEC8567AB7E9EF94720F1A893DE6C4C7744E63598018797

Function 00410822 Relevance: 3.0, APIs: 2, Instructions: 44timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,00405A9F,00000000,73BDA22C), ref: 00410837
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00410856

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Time$FileSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 1518329722-0
Opcode ID: e180163b605ce24ec50b538605d54e7015c692564284d471828b5f4d87c2059b
Instruction ID: 1c50189d93918816d196ec70bd43d3640a511bc00310eef3747ee1678f9f3f9c
Opcode Fuzzy Hash: e180163b605ce24ec50b538605d54e7015c692564284d471828b5f4d87c2059b
Instruction Fuzzy Hash: 09F0F9B1E002147B8724AF6EC8049DFBEE9EEC5770725465AE809D3340D5B4CD8182D4

Function 00473403 Relevance: 2.9, Strings: 2, Instructions: 352COMMON

Download Yara Rule

Strings

v<$, xrefs: 004738B7
fL7\, xrefs: 004738AD

Memory Dump Source

Source File: 00000000.00000002.4100040646.0000000000470000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID:
String ID: fL7\$v<$
API String ID: 0-2707060157
Opcode ID: f8dedf35010372872426d5024d7ea2a25893735c50a06fc81145123572ac7d07
Instruction ID: db780dbcbae02cc774bbb627e0ade9812e5844f189ba0ed455342c5d2533001e
Opcode Fuzzy Hash: f8dedf35010372872426d5024d7ea2a25893735c50a06fc81145123572ac7d07
Instruction Fuzzy Hash: 18B120F3F155244BF3045928DC68376BA96DBE4320F2B823D9E89A73C5E87E5C0A4385

Function 0041572E Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00415729,?,?,00000008,?,?,0041C68A,00000000), ref: 0041595B

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: e03884c1b799fb46ae45e907d4085e80ad0ec7257463db2e47aeebe4ac254d4e
Instruction ID: 6715a78ad53a010e1f654acf6738d2326510568a7b3af97ced4f43bd22a978ec
Opcode Fuzzy Hash: e03884c1b799fb46ae45e907d4085e80ad0ec7257463db2e47aeebe4ac254d4e
Instruction Fuzzy Hash: 02B17E71520A08DFD714CF28C486BE57BE0FF85364F298659E899CF2A1C339D992CB45

Function 04965995 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,04965990,?,?,00000008,?,?,0496C8F1,00000000), ref: 04965BC2

Memory Dump Source

Source File: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, Offset: 04950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4950000_file.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: e03884c1b799fb46ae45e907d4085e80ad0ec7257463db2e47aeebe4ac254d4e
Instruction ID: 37b66c8a5b174f84119a405ac626fca93bf80b2d5222919d4895e9e067cff068
Opcode Fuzzy Hash: e03884c1b799fb46ae45e907d4085e80ad0ec7257463db2e47aeebe4ac254d4e
Instruction Fuzzy Hash: 95B14C31610609EFD715CF28D48AB657BE5FF45364F2A8668E89ACF2A1C335E981CB40

Function 0040A2EC Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0040A302

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 0087427e5fec96f3a69268fd39bcd2ddcdf30d7205d75486cccbac6015e6632e
Instruction ID: 655f466d2002f1984def2d585099db1cc9528c498776e59a8b59a497753dfce5
Opcode Fuzzy Hash: 0087427e5fec96f3a69268fd39bcd2ddcdf30d7205d75486cccbac6015e6632e
Instruction Fuzzy Hash: 4C5136B1E10315CFDB24CF95D8857AABBF0FB48314F24803AD905EB3A1D37899568B99

Function 0047389F Relevance: 1.6, Strings: 1, Instructions: 345COMMON

Download Yara Rule

Strings

v<$, xrefs: 004738B7

Memory Dump Source

Source File: 00000000.00000002.4100040646.0000000000470000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID:
String ID: v<$
API String ID: 0-886278330
Opcode ID: 19bc08acd7d28a0be8f05b8474ca366c08e2a8aba44e896ddc8ca298ab951423
Instruction ID: 4431215af7ce5e5fb1c8159ca28c46b157777210fce38e70d80fd920e910dc3a
Opcode Fuzzy Hash: 19bc08acd7d28a0be8f05b8474ca366c08e2a8aba44e896ddc8ca298ab951423
Instruction Fuzzy Hash: 63B1F0B3F155244BF3045929DC68776BA96DBE0320F2B823D9E89A73C5D87E5C0A4285

Function 0040EF09 Relevance: 1.6, Strings: 1, Instructions: 333COMMON

Download Yara Rule

Strings

0, xrefs: 0040F079

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 8470d482166b29df0f0bdf2b707670bb0d2149d7074c5d4c6b8b9bc3646ec2c9
Instruction ID: a862614980e7782cfb360a41e62bb903fc37a91afa162c473b4857922a947482
Opcode Fuzzy Hash: 8470d482166b29df0f0bdf2b707670bb0d2149d7074c5d4c6b8b9bc3646ec2c9
Instruction Fuzzy Hash: DDC1EE309006079ECB34CE69C584A7BBBB1AB45304F144A7FD856B7BD2C339AD0ACB59

Function 0495F170 Relevance: 1.6, Strings: 1, Instructions: 333COMMON

Download Yara Rule

Strings

0, xrefs: 0495F2E0

Memory Dump Source

Source File: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, Offset: 04950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4950000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 8eb8cff735118d4cdf18e48b5e4fd70e4005089286b1f543a5e77019ad8e0901
Instruction ID: c95cf3e44fa5be73fa5546c9f640b65e0a252bf705298eeb8bd518642b659b28
Opcode Fuzzy Hash: 8eb8cff735118d4cdf18e48b5e4fd70e4005089286b1f543a5e77019ad8e0901
Instruction Fuzzy Hash: 44C1F1746006068FDB24DF68C584A7ABBBABF85324F344A39DC529B6B8D330B945CB11

Function 0040EBC7 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 0040ED4B

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 0c5b649a34a28a7901ced7402a87d0ab1891e4bc7ca1eda254f1c36e1c86cddc
Instruction ID: c83ad001e3c04e1f23fe5313526111bf351830610e2bf169758c16327f184a9c
Opcode Fuzzy Hash: 0c5b649a34a28a7901ced7402a87d0ab1891e4bc7ca1eda254f1c36e1c86cddc
Instruction Fuzzy Hash: 3EB1E47090460B8BDB248E6AC555ABFB7A1AF41304F140E3FD452B77C1C73EAD268B89

Function 0495EE2E Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 0495EFB2

Memory Dump Source

Source File: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, Offset: 04950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4950000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 879cce724f58335765498cd27df84c01b4e50fca817c5947501d6afb968e75ec
Instruction ID: edf423b0465f1d23475e2251ffc5719d895b757c228e9e29fdb9d76060ca5e65
Opcode Fuzzy Hash: 879cce724f58335765498cd27df84c01b4e50fca817c5947501d6afb968e75ec
Instruction Fuzzy Hash: 6CB1E570A0460A8BDF24DF68C958ABEB7A9EF44314F34063DDC52976B4DB32B605CB51

Function 0040A720 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0000A72C,0040A0A4), ref: 0040A725

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f7f15cac9e9bf66a9e2158eab73941a450ed06a429c5457dfeeb9365a06e4f3f
Instruction ID: 2e9130e8fabf2091f020550841097bdee3684dee1eb7d8ffdadd4873c3d8fa43
Opcode Fuzzy Hash: f7f15cac9e9bf66a9e2158eab73941a450ed06a429c5457dfeeb9365a06e4f3f
Instruction Fuzzy Hash:

Function 0495A987 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(0040A72C,0495A30B), ref: 0495A98C

Memory Dump Source

Source File: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, Offset: 04950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4950000_file.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f7f15cac9e9bf66a9e2158eab73941a450ed06a429c5457dfeeb9365a06e4f3f
Instruction ID: 2e9130e8fabf2091f020550841097bdee3684dee1eb7d8ffdadd4873c3d8fa43
Opcode Fuzzy Hash: f7f15cac9e9bf66a9e2158eab73941a450ed06a429c5457dfeeb9365a06e4f3f
Instruction Fuzzy Hash:

Function 004CAA28 Relevance: 1.4, Strings: 1, Instructions: 171COMMON

Download Yara Rule

Strings

F, xrefs: 004CAA59

Memory Dump Source

Source File: 00000000.00000002.4100040646.0000000000470000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID:
String ID: F
API String ID: 0-1304234792
Opcode ID: d3f9bbbef49f457496a5eb7220fb80fcac0c0ce233f7d966a3f3981da193df12
Instruction ID: dbd6c139b32866210b096a28a816bf10a6ce8a84abce6eefe7beafa0d268f343
Opcode Fuzzy Hash: d3f9bbbef49f457496a5eb7220fb80fcac0c0ce233f7d966a3f3981da193df12
Instruction Fuzzy Hash: 6251F4B3F112254BF3504E38CC543617693DB99325F3E827C8A189B7D9DA7E5C4A8384

Function 00418592 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00418592

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 7769912fe868597113bc2185a5bbbb46458ecd65f2a9e081601031a621f49aa8
Instruction ID: 3c2d4b823819c0ef79fadcf046fefbcb2a87197a19d2065c9f8a0fe70da1ab12
Opcode Fuzzy Hash: 7769912fe868597113bc2185a5bbbb46458ecd65f2a9e081601031a621f49aa8
Instruction Fuzzy Hash: 80A02230B00200CF83208F32EE0830C3EF8FB8C2C0300C038A000C0232EB3880828B08

Function 00415E59 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bed945026c03525ca9e6f99888b728c839f34034abb34f6e91111b4f97e8ed69
Instruction ID: 2119cb9e33fec53289003fbb8559c0bd9e138a5c3f232e450aa7d4159409e329
Opcode Fuzzy Hash: bed945026c03525ca9e6f99888b728c839f34034abb34f6e91111b4f97e8ed69
Instruction Fuzzy Hash: 91320331E29F014DD7239A34D922336A649AFB73D4F56D737E819B5AA9EF28C4C34108

Function 005CB6D5 Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4100040646.0000000000470000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a75f97766c45e66a0b66a70d73656ed0e602064f891330c7fd0213bd175e3bc8
Instruction ID: 885c4469d014df6c7757d4f2505356eb08d9732e4303c17f48b9bc268dcdecd2
Opcode Fuzzy Hash: a75f97766c45e66a0b66a70d73656ed0e602064f891330c7fd0213bd175e3bc8
Instruction Fuzzy Hash: BC5107F39187049FF300AE28DC8576BB7D6EB98320F1B463CEAD497784DA3858058796

Function 004A2702 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4100040646.0000000000470000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b67daa46d0d8681e244ce9ec364437f02626930302321754f7114ee15dda274
Instruction ID: 6d5bdddc093de907d5141f8de640c428d08ab17739a8e91388ea38c82af7e7f1
Opcode Fuzzy Hash: 7b67daa46d0d8681e244ce9ec364437f02626930302321754f7114ee15dda274
Instruction Fuzzy Hash: 665118F3A0C6049FE3506E1DDC8576ABBD6EBD4320F2B493DDAC497745E63558018682

Function 0054828B Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4100040646.0000000000470000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbc02d151a17d9ba7cb71315f529ac408a8e24f3016a08a5def29229a22e1b34
Instruction ID: 078b44d9f28eccabe59eab6eea0bf25df57e27ba9d63e85483898e5ae6b0b042
Opcode Fuzzy Hash: dbc02d151a17d9ba7cb71315f529ac408a8e24f3016a08a5def29229a22e1b34
Instruction Fuzzy Hash: 78515AF3E48218ABE3005D39DD44776BBD5DB90360F1B863DEE88A7B84E93A580446C2

Function 00480C4B Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4100040646.0000000000470000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30426a83901797fedcdeebba221aaf85410923300e17f338ef93c4b1ef865551
Instruction ID: 03ff96d96e193190bde4a6d85ad41127784d7488d5bf054fb6a4a69d4263f895
Opcode Fuzzy Hash: 30426a83901797fedcdeebba221aaf85410923300e17f338ef93c4b1ef865551
Instruction Fuzzy Hash: 885106F3E482149BF3102929EC457BABBD6DB90324F1B453DDB9893780D97E4C0646C6

Function 0050C9D4 Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4100040646.0000000000470000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c07e47112c8b6f5cabd9c025e67e0ac0921ced310a35a996d91162bdf65d7e6
Instruction ID: 46583ba4d93d441b407ff36689c94ccf39daefd5dcdc00afec575cadef95212d
Opcode Fuzzy Hash: 9c07e47112c8b6f5cabd9c025e67e0ac0921ced310a35a996d91162bdf65d7e6
Instruction Fuzzy Hash: 7D51E7F3A091109FE7046E2DDC4576AFAE7EBD8320F2B853DDAC493344E93958158786

Function 00552E31 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4100040646.0000000000470000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d0267002f90c66333d7d1825960100aaeeb8f435373ac0cbd095dc85852dcee
Instruction ID: b71f8c50ce0dd72571a0ca5e8b3d2aa1de8da5bf2e161ce718b9c77d89f93982
Opcode Fuzzy Hash: 9d0267002f90c66333d7d1825960100aaeeb8f435373ac0cbd095dc85852dcee
Instruction Fuzzy Hash: 215125F3E082205FE3146E6CDC8577ABBD8EB54710F1A453DEA88D7780E975980483C6

Function 0070230E Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4100040646.0000000000603000.00000040.00000001.01000000.00000003.sdmp, Offset: 00603000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_603000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7c83f90df1a05efb0d6b7abcee46baed5b29b77c8ae93b11639095b19dc477f
Instruction ID: 66307d3d0f649762204a05ad1280219598c4186c2c3f8199dd6a88820f2843bb
Opcode Fuzzy Hash: c7c83f90df1a05efb0d6b7abcee46baed5b29b77c8ae93b11639095b19dc477f
Instruction Fuzzy Hash: DC5105B391C600DFD3056E28DC4953AF7E4EB54720F264E2DE9D683782D6399841AB83

Function 005624E1 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4100040646.0000000000470000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b17eda27734f431733a89b0efedabcc721bf5373e751bd84014a0a1be3d6a66
Instruction ID: 51e5d7bb09a33c559f4eda56f00f3e769762b2fba68a2913c8f31a6eac990a79
Opcode Fuzzy Hash: 6b17eda27734f431733a89b0efedabcc721bf5373e751bd84014a0a1be3d6a66
Instruction Fuzzy Hash: 4B415AF3A081005BE3005E2DDC4576BBBDAEFD4720F1B853DEAC4D7B44EA7999068296

Function 006C72A1 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4100040646.0000000000603000.00000040.00000001.01000000.00000003.sdmp, Offset: 00603000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_603000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51a321f5081bcab23ddb1e56e6c7e940a84ca53432526b138f8c9bcd35899eee
Instruction ID: b8ae7250014d7a60a09f4a4d8bbf48f59db212a0cf37f5946624da84e277c4d9
Opcode Fuzzy Hash: 51a321f5081bcab23ddb1e56e6c7e940a84ca53432526b138f8c9bcd35899eee
Instruction Fuzzy Hash: 46214FB250C308AFE716BE59DC857AAFBE5EF58310F05492DE7D483710E631A9108A97

Function 0040B6D0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: ca795268159c21d128c013142cdfc2d9b79cbc1da2bbaf958516ecc3655a5718
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 39113DBB24014243D614873DD9F49B7A395EBC5320B2D437BD1416B7D4D33AE9459A8C

Function 0495B937 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, Offset: 04950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4950000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 31093a781ad63aed303cabcd308a4e0756b12fe3fa5f3aaf202d1ed763eb6600
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: D91127B720018247D655CA3ED4B42B6E79DEFC6329B3C477AD8858B77AD222B144D700

Function 00688132 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4100040646.0000000000603000.00000040.00000001.01000000.00000003.sdmp, Offset: 00603000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_603000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e30c0d5435bd2ebdc3ca0cbaf8467a403c747bbf48d72ae2cddbf857c5e0048
Instruction ID: acc1b72413786fd9169f0ea31a990889d17b8f776d8ca64ff04e059f412f7394
Opcode Fuzzy Hash: 1e30c0d5435bd2ebdc3ca0cbaf8467a403c747bbf48d72ae2cddbf857c5e0048
Instruction Fuzzy Hash: 74114CB150D602DFE359BF29C89523AB7E6EB94310F628A2D92C6C7254EE304443DB96

Function 047A7D41 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4101686121.00000000047A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 047A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_47a0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 08771eb7056d114c5da39982fe0a0733143f4f69ed40c61d8a9fd9b91280a921
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 8C1182723401009FD754DF65DC90FA673EAEBC9220B198156ED04CB315E675FC11C760

Function 04950D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, Offset: 04950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4950000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: cacfbc0c46e98c86a351d82b4132ac5c712cceccaeed7baca1d735253631f30a
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: 3401A276A006049FDF21CF24C818BAA33E9EB86316F6544B5ED0A9B291E774B9458F90

Function 00409BDD Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(0042D064,00000FA0,?,?,00409BBB), ref: 00409BE9
GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,00409BBB), ref: 00409BF4
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00409BBB), ref: 00409C05
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00409C17
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00409C25
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00409BBB), ref: 00409C48
DeleteCriticalSection.KERNEL32(0042D064,00000007,?,?,00409BBB), ref: 00409C64
CloseHandle.KERNEL32(00000000,?,?,00409BBB), ref: 00409C74

Strings

SleepConditionVariableCS, xrefs: 00409C11
kernel32.dll, xrefs: 00409C00
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00409BEF
WakeAllConditionVariable, xrefs: 00409C1D

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2565136772-3242537097
Opcode ID: 4fb7e18995e5e2f02b724b68456555f771a33f70ab985dbad30083c91c8ea3bd
Instruction ID: 8f8b07cbf63392261d8dc325579aef03bb655b7cde116df0e27078c5153b7531
Opcode Fuzzy Hash: 4fb7e18995e5e2f02b724b68456555f771a33f70ab985dbad30083c91c8ea3bd
Instruction Fuzzy Hash: 6F015271F48711ABE7205BB4BD09F562BD8AB49705B554032BA05E22A2DB78CC068A6C

Function 0041C3CF Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,0041CECF), ref: 0041C3E8

Strings

log10, xrefs: 0041C42A, 0041C439
asin, xrefs: 0041C515
exp, xrefs: 0041C467, 0041C4CC
acos, xrefs: 0041C51E
log, xrefs: 0041C445, 0041C454
pow, xrefs: 0041C486, 0041C530, 0041C57D
sqrt, xrefs: 0041C527

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 15d817c9b1d0a4fbb0458c9f351412a41f7c6c9a49760990de8b925fd3443d3a
Instruction ID: a42e5d16fde1fbafe1f90c690df07fce043cce1a805407c3827f836c313506d5
Opcode Fuzzy Hash: 15d817c9b1d0a4fbb0458c9f351412a41f7c6c9a49760990de8b925fd3443d3a
Instruction Fuzzy Hash: 2D51AD7198022AEBCB108F58EE8C1FE7F72FB44304F908057D481A6654C7BC99A6CB9D

Function 0040BCFB Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0040BE1A
___TypeMatch.LIBVCRUNTIME ref: 0040BF28
_UnwindNestedFrames.LIBCMT ref: 0040C07A
CallUnexpected.LIBVCRUNTIME ref: 0040C095

Strings

csm, xrefs: 0040BE51
csm, xrefs: 0040BD38
csm, xrefs: 0040BDA5

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction ID: 33f924a654f9d1b13218269df17d2698b0e91053480f28ff55db22427738ff3f
Opcode Fuzzy Hash: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction Fuzzy Hash: 38B1767180020AEFCF24DFA5C9819AEB7B5EF04314B14426BE9057B292D739EA51CFD9

Function 0495BF62 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0495C081
___TypeMatch.LIBVCRUNTIME ref: 0495C18F
_UnwindNestedFrames.LIBCMT ref: 0495C2E1
CallUnexpected.LIBVCRUNTIME ref: 0495C2FC

Strings

csm, xrefs: 0495C0B8
csm, xrefs: 0495BF9F
csm, xrefs: 0495C00C

Memory Dump Source

Source File: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, Offset: 04950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4950000_file.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction ID: 49a077c02193fad4963031e610288ab3dde81cabf894039e6f2048b220070edb
Opcode Fuzzy Hash: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction Fuzzy Hash: 9DB11671800309AFDF29DFA4D8809AEBBB9BF44314F24456AEC156B221D771FA91CB91

Function 004058F0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 122registrysleepCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,?,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00405923
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020006,?), ref: 00405945
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?), ref: 0040596D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00405976
Sleep.KERNEL32(000003E8), ref: 00405AB0

Strings

mixone, xrefs: 00406239
185.156.72.65, xrefs: 00406AB2
185.156.72.65, xrefs: 0040601B, 00406034, 004068FA

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CloseCreateOpenSleepValue
String ID: 185.156.72.65$185.156.72.65$mixone
API String ID: 4111408922-485810328
Opcode ID: 76a0eb9b053f2720e41b6ddde5d1263b2dfbe59c6a58b35459c5c5341c7fd760
Instruction ID: d5f4d92326b12601678bd67615438d10f3376d08b80102dff59a3baec9f40a0a
Opcode Fuzzy Hash: 76a0eb9b053f2720e41b6ddde5d1263b2dfbe59c6a58b35459c5c5341c7fd760
Instruction Fuzzy Hash: 14419271210108AFEB08CF64DC95BEE7B65EF49300F90822DF916A66D2D778E9848F58

Function 04959E44 Relevance: 12.1, APIs: 8, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(0042D064,00000FA0,?,?,04959E22), ref: 04959E50
GetModuleHandleW.KERNEL32(0041FFC8,?,?,04959E22), ref: 04959E5B
GetModuleHandleW.KERNEL32(0042000C,?,?,04959E22), ref: 04959E6C
GetProcAddress.KERNEL32(00000000,00420028), ref: 04959E7E
GetProcAddress.KERNEL32(00000000,00420044), ref: 04959E8C
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,04959E22), ref: 04959EAF
RtlDeleteCriticalSection.NTDLL(0042D064), ref: 04959ECB
CloseHandle.KERNEL32(0042D060,?,?,04959E22), ref: 04959EDB

Memory Dump Source

Source File: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, Offset: 04950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4950000_file.jbxd

Yara matches

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin
String ID:
API String ID: 2565136772-0
Opcode ID: 4fb7e18995e5e2f02b724b68456555f771a33f70ab985dbad30083c91c8ea3bd
Instruction ID: f95af81ad5315ca355b259ccfb780d6e2e4be1318cf8d3b911b16a674888c97b
Opcode Fuzzy Hash: 4fb7e18995e5e2f02b724b68456555f771a33f70ab985dbad30083c91c8ea3bd
Instruction Fuzzy Hash: C0015271F40711EBE7209BB4BC0DB9B3AECAB48705B604135BD05E2171DB78D80B8B68

Function 00413E0C Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00413E92

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 1d05eccc710d275396565a7ca4ce4cb03c32f9e64a227524f8538adb25869953
Instruction ID: 59a992c9e9a8f6180de132557df0e6155a9c37934bf91f888a5cd2673cffff64
Opcode Fuzzy Hash: 1d05eccc710d275396565a7ca4ce4cb03c32f9e64a227524f8538adb25869953
Instruction Fuzzy Hash: 11B14572900355AFDB118E25CC81BEFBFA5EF99310F144167E904AB382D3789982C7A9

Function 04964073 Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 049640F9

Memory Dump Source

Source File: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, Offset: 04950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4950000_file.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: f7094994ec903abcce49a6c1a655cc9da7e5ebab3a0cb20de3e6a5e810294d9f
Instruction ID: 79f55e3a299b863bd512580f25b7e7a2d94f51e119f061a2853a0a3e81ce9c19
Opcode Fuzzy Hash: f7094994ec903abcce49a6c1a655cc9da7e5ebab3a0cb20de3e6a5e810294d9f
Instruction Fuzzy Hash: BCB16B32A00365AFEB11CF98CC81FAE7BA9EF95314F154175E906AF281D274B901CBA5

Function 00401600 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 162COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00401605

Part of subcall function 00409882: std::invalid_argument::invalid_argument.LIBCONCRT ref: 0040988E

MultiByteToWideChar.KERNEL32(00000000,00000000,?,00181B20,00000000,00000000,?,?,185.156.72.65,?,?,?,185.156.72.65,185.156.72.65), ref: 0040163B
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00181B20,00000000,?,185.156.72.65,?,?,?,185.156.72.65,185.156.72.65), ref: 00401672
Concurrency::cancel_current_task.LIBCPMT ref: 00401787

Strings

string too long, xrefs: 00401600
185.156.72.65, xrefs: 00401616

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$Concurrency::cancel_current_taskXinvalid_argumentstd::_std::invalid_argument::invalid_argument
String ID: 185.156.72.65$string too long
API String ID: 2123813255-2459586365
Opcode ID: bdd389315b9d1b711b57ef1d46861381343838d65b71c4066379a5609bf0971b
Instruction ID: 7f9c58fd2461fef3fc504d3e16d536ba0f8addf4ce568e9544afc24d4b31befa
Opcode Fuzzy Hash: bdd389315b9d1b711b57ef1d46861381343838d65b71c4066379a5609bf0971b
Instruction Fuzzy Hash: 2E4129B1A00300ABD7149F759C8179BB6F8EF04354F24063AF91AE73D1E7759D0487A9

Function 0040B800 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0040B837
___except_validate_context_record.LIBVCRUNTIME ref: 0040B83F
_ValidateLocalCookies.LIBCMT ref: 0040B8C8
__IsNonwritableInCurrentImage.LIBCMT ref: 0040B8F3
_ValidateLocalCookies.LIBCMT ref: 0040B948

Strings

csm, xrefs: 0040B8DD

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 2a817a1480194b9b32cfb7907dea545d9bb946fea234306998335fac64bc32e7
Instruction ID: 37170cc5a13740ac021db770265e436928f7f71c6dcd02e9963277d07105fea9
Opcode Fuzzy Hash: 2a817a1480194b9b32cfb7907dea545d9bb946fea234306998335fac64bc32e7
Instruction Fuzzy Hash: 5741A575A00218DBCF10DF69C884A9E7BB5EF44318F14817AE8147B3E2D7399905CBD9

Function 00413379 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00413488,004035B7,?,00000000,?,?,?,00413601,00000022,FlsSetValue,00422950,00422958,?), ref: 0041343A

Strings

ext-ms-, xrefs: 004133E4
api-ms-, xrefs: 004133D0

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: b8c7e483e8ea991eea5b44eb111e182d5bd336103010429673e37ca0c8998616
Instruction ID: afc4e2dc9a6310a4111bfadf7e5574d8da4adc5d781dab4b07345c405b9fe202
Opcode Fuzzy Hash: b8c7e483e8ea991eea5b44eb111e182d5bd336103010429673e37ca0c8998616
Instruction Fuzzy Hash: 5D210531B01211EBC732DF21EC44ADB7B68AB41765B254132ED05A7391E738EE46C6D8

Function 0040B9C4 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0040B9BB,0040AF5F,0040A770), ref: 0040B9D2
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0040B9E0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0040B9F9
SetLastError.KERNEL32(00000000,0040B9BB,0040AF5F,0040A770), ref: 0040BA4B

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction ID: eb4c4ba290695b81d2d53517126189b774af9dd69cdf091561ca3954f11cb9c7
Opcode Fuzzy Hash: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction Fuzzy Hash: 24019E323196119EE63427B9BCC6A6B3AA5EB05779720023BF120B51E3EF7D480256CC

Function 0495BC2B Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0495BC22,0495B1C6,0495A9D7), ref: 0495BC39
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0495BC47
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0495BC60
SetLastError.KERNEL32(00000000,0495BC22,0495B1C6,0495A9D7), ref: 0495BCB2

Memory Dump Source

Source File: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, Offset: 04950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4950000_file.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction ID: fa83bc30c76dc1b346922600d2384d1d63f280bec9cd6f43eb71c9ca7c8fbf1c
Opcode Fuzzy Hash: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction Fuzzy Hash: 1901B5322097119EB735ABBCFCC5A5B2A68EB4167C3704239ED24950F1EF5178055348

Function 04951867 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0495186C

Part of subcall function 04959AE9: std::invalid_argument::invalid_argument.LIBCONCRT ref: 04959AF5

MultiByteToWideChar.KERNEL32(00000000,00000000,?,00181B20,00000000,00000000,?,?,185.156.72.65,?,?,?,185.156.72.65,185.156.72.65), ref: 049518A2
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00181B20,00000000,?,185.156.72.65,?,?,?,185.156.72.65,185.156.72.65), ref: 049518D9
Concurrency::cancel_current_task.LIBCPMT ref: 049519EE

Strings

185.156.72.65, xrefs: 0495187D

Memory Dump Source

Source File: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, Offset: 04950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4950000_file.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$Concurrency::cancel_current_taskXinvalid_argumentstd::_std::invalid_argument::invalid_argument
String ID: 185.156.72.65
API String ID: 2123813255-1765470537
Opcode ID: 69ccd53acc2a7afa4ebe84e379714041f14f87e59b53a70bcc90546bd568d79b
Instruction ID: a7ed5558de41f27cae143ab3c72e322dddedd3e6f85bbaf2a4dca6a38d894550
Opcode Fuzzy Hash: 69ccd53acc2a7afa4ebe84e379714041f14f87e59b53a70bcc90546bd568d79b
Instruction Fuzzy Hash: 1941D7B1E00301EBE724DF64AC86B5AB6F8EF44214F300639ED5AD72A0E771B944C7A1

Function 004105C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,73BDA22C,?,?,00000000,0041DAAB,000000FF,?,0041059C,?,?,00410570,00000016), ref: 004105F5
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00410607
FreeLibrary.KERNEL32(00000000,?,00000000,0041DAAB,000000FF,?,0041059C,?,?,00410570,00000016), ref: 00410629

Strings

CorExitProcess, xrefs: 004105FF
mscoree.dll, xrefs: 004105EE

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 4cd190c7c455c60d919dcec500e21cbf2ecb46ce251512cda49bfcc6e71cbce3
Instruction ID: ae467a28d40358befcebc9227983d24377640bf1eed1e12363a062fa79a5df9f
Opcode Fuzzy Hash: 4cd190c7c455c60d919dcec500e21cbf2ecb46ce251512cda49bfcc6e71cbce3
Instruction Fuzzy Hash: E701D631A54625EFDB118F80DC05BEEBBB8FB48B10F004536F811A22A0DBB8AC44CB5C

Function 00415050 Relevance: 7.7, APIs: 5, Instructions: 197COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 004150D5
__alloca_probe_16.LIBCMT ref: 0041519E
__freea.LIBCMT ref: 00415205

Part of subcall function 00413CB9: RtlAllocateHeap.NTDLL(00000000,?,5(@,?,0040AD5B,?,5(@,185.156.72.65,?,?,004035B7,?,?,5(@), ref: 00413CEB

__freea.LIBCMT ref: 00415218
__freea.LIBCMT ref: 00415225

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: c6d75d848bc7a9be22250e28ca9a699f36b8dee5fa0a29534bade35fe4989d48
Instruction ID: 0a96ed905c827a5c292ca8e68d33c0be9e05a90d5fda14ab984eef2cdbaa63a4
Opcode Fuzzy Hash: c6d75d848bc7a9be22250e28ca9a699f36b8dee5fa0a29534bade35fe4989d48
Instruction Fuzzy Hash: AA51C372600606EFDB215FA1EC81EFB77A9EFC5714B15046EFD04D6251EB39CC908AA8

Function 04952CB7 Relevance: 7.6, APIs: 5, Instructions: 113memorywindowCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 04952D5F
GetLastError.KERNEL32(00000400,?,00000000,00000000,?,?,?,?), ref: 04952D74
FormatMessageA.KERNEL32(00001300,00000000,00000000,?,?,?,?), ref: 04952D82
LocalAlloc.KERNEL32(00000040,?,?,?,?,?), ref: 04952D9D
OutputDebugStringA.KERNEL32(00000000,?,?), ref: 04952DBC

Memory Dump Source

Source File: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, Offset: 04950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4950000_file.jbxd

Yara matches

Similarity

API ID: AllocDebugErrorFormatLastLocalMessageOutputProtectStringVirtual
String ID:
API String ID: 2509773233-0
Opcode ID: 135e4059f0a8e16b6c40cfe3354c74ba5c0e8907b24caca148f615c37fe0627b
Instruction ID: ad75ccc773eceebc192db8fb39c2314cbaead7f3e8e0fd29d23a60f79af1df4f
Opcode Fuzzy Hash: 135e4059f0a8e16b6c40cfe3354c74ba5c0e8907b24caca148f615c37fe0627b
Instruction Fuzzy Hash: 9131E532B00104AFEB14DF58DC40FAAB7B8EF48700F6541F9ED059B2A2DB31A916CB94

Function 00401330 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 00409CC5: EnterCriticalSection.KERNEL32(0042D064,?,?,?,0040104A,0042DBF4), ref: 00409CD0
Part of subcall function 00409CC5: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,0040104A,0042DBF4), ref: 00409D0D

__Init_thread_footer.LIBCMT ref: 004013BB

Part of subcall function 00409C7B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401089,0042DBF4,0041DCC0), ref: 00409C85
Part of subcall function 00409C7B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401089,0042DBF4,0041DCC0), ref: 00409CB8
Part of subcall function 00409C7B: RtlWakeAllConditionVariable.NTDLL ref: 00409D2F

Strings

BAOJ, xrefs: 0040138A
185.156.72.65/files/download, xrefs: 0040138D, 004013CD, 004013E4, 004013F0, 004013FD, 0040142C, 0040142D
JAY@, xrefs: 00401350

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: 185.156.72.65/files/download$BAOJ$JAY@
API String ID: 2296764815-3011832937
Opcode ID: 8afcb876ddc2999c1ba0bad2701e5863db79a9b1fdbf3493768d7342b1c45fce
Instruction ID: cf4989964709d5cf6b10aa031a618c24b72f45a9210e311b945b03c0b8b43901
Opcode Fuzzy Hash: 8afcb876ddc2999c1ba0bad2701e5863db79a9b1fdbf3493768d7342b1c45fce
Instruction Fuzzy Hash: E5217170F002848AD730DF39E8467AAB7A0FB15304F90423AE8456B2B2DBB81981CB0D

Function 04951597 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 04959F2C: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04959F37
Part of subcall function 04959F2C: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04959F74

__Init_thread_footer.LIBCMT ref: 04951622

Part of subcall function 04959EE2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04959EEC
Part of subcall function 04959EE2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04959F1F

Strings

185.156.72.65/files/download, xrefs: 049515F4, 0495164B, 04951664, 04951693, 04951694
BAOJ, xrefs: 049515F1
JAY@, xrefs: 049515B7

Memory Dump Source

Source File: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, Offset: 04950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4950000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: 185.156.72.65/files/download$BAOJ$JAY@
API String ID: 4132704954-3011832937
Opcode ID: 6a6592139864edd19948d288d5ea32045136f2484dc71c592f5547b1ee2d657f
Instruction ID: f2a4a027ef8a0ee0b3476cacc3b775bdd46468fee5a2291894e2f4cb192b192f
Opcode Fuzzy Hash: 6a6592139864edd19948d288d5ea32045136f2484dc71c592f5547b1ee2d657f
Instruction Fuzzy Hash: 2F2146B0F00244DAE730DF29E8467A9B3A0FB55308FB48279DC455B271DBB52986CB09

Function 0040CAD7 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,0040CA88,00000000,?,0042D0F8,?,?,?,0040CC2B,00000004,InitializeCriticalSectionEx,00420B18,InitializeCriticalSectionEx), ref: 0040CAE4
GetLastError.KERNEL32(?,0040CA88,00000000,?,0042D0F8,?,?,?,0040CC2B,00000004,InitializeCriticalSectionEx,00420B18,InitializeCriticalSectionEx,00000000,?,0040C876), ref: 0040CAEE
LoadLibraryExW.KERNEL32(00000000,00000000,00000000), ref: 0040CB16

Strings

api-ms-, xrefs: 0040CAFB

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 6ea35a358fe08483aaca9864d5c7ce1afea2c26e9c9286d7bdd8822d2b58ffa3
Instruction ID: 25d742bb915314b1e6f169ce4c8bc34e4efbfc99aed270fc8c56fe9432a01067
Opcode Fuzzy Hash: 6ea35a358fe08483aaca9864d5c7ce1afea2c26e9c9286d7bdd8822d2b58ffa3
Instruction Fuzzy Hash: 1BE0ED30740208F6DA201B61FD4AB5A3E69AB51B84F508131FD09A81E2E675A8159548

Function 004196CC Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(73BDA22C,00000000,00000000,00000000), ref: 0041972F

Part of subcall function 00414F98: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,004151FB,?,00000000,-00000008), ref: 00414FF9

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00419981
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 004199C7
GetLastError.KERNEL32 ref: 00419A6A

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: d5159c83dd231617a998158a8310f21f7752f689ca9b76bea25e341def0ffdac
Instruction ID: 69433146677377e8d20fe438975eb5a03bdcbd81a3ae5f82b6e9dde0de1db5be
Opcode Fuzzy Hash: d5159c83dd231617a998158a8310f21f7752f689ca9b76bea25e341def0ffdac
Instruction Fuzzy Hash: 55D18EB5E002489FCF15CFA8C8909EEBBB5FF49304F28416AE456EB351D634AD86CB54

Function 04969933 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(0042C014,00000000,00000000,00000000), ref: 04969996

Part of subcall function 049651FF: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,04965462,?,00000000,-00000008), ref: 04965260

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 04969BE8
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 04969C2E
GetLastError.KERNEL32 ref: 04969CD1

Memory Dump Source

Source File: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, Offset: 04950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4950000_file.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: c5b85f2605b1a4877e753edebb94315cfcd19b1be6e7f59515690ef87a323643
Instruction ID: 090ace3839b3da5c97d2318d0a6ade9401a9e7bae4a9c71c157b85b3dba30f2d
Opcode Fuzzy Hash: c5b85f2605b1a4877e753edebb94315cfcd19b1be6e7f59515690ef87a323643
Instruction Fuzzy Hash: F3D16BB5E002489FCF15CFE8D8809ADBBF9FF49314F28456AE45AEB351D630A946CB50

Function 04951BD7 Relevance: 6.3, APIs: 4, Instructions: 293networkfileCOMMON

Download Yara Rule

APIs

InternetSetFilePointer.WININET(?,00000000,00000000,00000000,00000000), ref: 04951C6C
InternetReadFile.WININET(?,00000000,000003E8,00000000), ref: 04951C8F

Memory Dump Source

Source File: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, Offset: 04950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4950000_file.jbxd

Yara matches

Similarity

API ID: FileInternet$PointerRead
String ID:
API String ID: 3197321146-0
Opcode ID: 2d5a771e8380d636b867b6a84e5d92fd6be66219798d598553b184485cedc64d
Instruction ID: eb7b93129c0bd39a399fa667d664963be0dca8c4f381e32a02064f17c29549db
Opcode Fuzzy Hash: 2d5a771e8380d636b867b6a84e5d92fd6be66219798d598553b184485cedc64d
Instruction Fuzzy Hash: E2C14B70900218DFEB24DF64CC85BE9B7B9EF49304F2041E9E909A72A0D775BA84CF95

Function 0040BAA4 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0040BB6B
___AdjustPointer.LIBCMT ref: 0040BB8E
___AdjustPointer.LIBCMT ref: 0040BC2A

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 01068ac1bdd0bc194ede9399adb2a85647f6cc07d9d95ab1ae95c0d7b664a8e0
Instruction ID: 427e8739ad2fdfd1bc337791267323dcfa727258f99cd262dc66f5b8a014dc51
Opcode Fuzzy Hash: 01068ac1bdd0bc194ede9399adb2a85647f6cc07d9d95ab1ae95c0d7b664a8e0
Instruction Fuzzy Hash: 8551BC72600206AFDB299F15C881B6AB7B4EF40314F14453FE80267AD9E739AC91DBDD

Function 0495BD0B Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0495BDD2
___AdjustPointer.LIBCMT ref: 0495BDF5
___AdjustPointer.LIBCMT ref: 0495BE91

Memory Dump Source

Source File: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, Offset: 04950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4950000_file.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 01068ac1bdd0bc194ede9399adb2a85647f6cc07d9d95ab1ae95c0d7b664a8e0
Instruction ID: 5cc4e608ba870c86061b251413a45c7d5df544701d674f89a2be05a2e5113e03
Opcode Fuzzy Hash: 01068ac1bdd0bc194ede9399adb2a85647f6cc07d9d95ab1ae95c0d7b664a8e0
Instruction Fuzzy Hash: AE51A2B2601606AFEB29DF14D889BBA77A9EF40314F38453DDE054B6B0E731B954CB90

Function 004174E4 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00414F98: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,004151FB,?,00000000,-00000008), ref: 00414FF9

GetLastError.KERNEL32 ref: 00417548
__dosmaperr.LIBCMT ref: 0041754F
GetLastError.KERNEL32(?,?,?,?), ref: 00417589
__dosmaperr.LIBCMT ref: 00417590

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: fff5e27c2a9c5f498cd8e37e9d2e5b67da44c55886b9eb81921f36740ae9eac4
Instruction ID: 13998406a9580c806f698d28beb46a1cfe6368519752a94925d3c074931ab18b
Opcode Fuzzy Hash: fff5e27c2a9c5f498cd8e37e9d2e5b67da44c55886b9eb81921f36740ae9eac4
Instruction Fuzzy Hash: 0921C871608205BFDB20AF62C840CABB7BAFF44368710853BF92997651D739ED818768

Function 0496774B Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 049651FF: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,04965462,?,00000000,-00000008), ref: 04965260

GetLastError.KERNEL32 ref: 049677AF
__dosmaperr.LIBCMT ref: 049677B6
GetLastError.KERNEL32(?,?,?,?), ref: 049677F0
__dosmaperr.LIBCMT ref: 049677F7

Memory Dump Source

Source File: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, Offset: 04950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4950000_file.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: fff5e27c2a9c5f498cd8e37e9d2e5b67da44c55886b9eb81921f36740ae9eac4
Instruction ID: 89fbce9ef6911b3f7a181470303265efeba8fc05d8566701dc68da8c1070cfd8
Opcode Fuzzy Hash: fff5e27c2a9c5f498cd8e37e9d2e5b67da44c55886b9eb81921f36740ae9eac4
Instruction Fuzzy Hash: 1E216271600605AFEB11EFA598C0C6BB7ADFF842AC7108579E91B97250E735FC50CBA0

Function 0041121B Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daefbb992f6e98e82da9deec0440fc20cde4ea8490cf1120197b10a32be04fa6
Instruction ID: 7177a7605b41648a86b30584ce86508c4f97125f369475c71d892394931dc7de
Opcode Fuzzy Hash: daefbb992f6e98e82da9deec0440fc20cde4ea8490cf1120197b10a32be04fa6
Instruction Fuzzy Hash: CF21CC31600205AFDF20AF62CC40DEB776DAF54368B10456FFA15E76A1D738DC818768

Function 04961482 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, Offset: 04950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4950000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daefbb992f6e98e82da9deec0440fc20cde4ea8490cf1120197b10a32be04fa6
Instruction ID: df6395ff5d616979d49be4c64c05c387649a92e6d41db2ca51b23fd16f764d07
Opcode Fuzzy Hash: daefbb992f6e98e82da9deec0440fc20cde4ea8490cf1120197b10a32be04fa6
Instruction Fuzzy Hash: E6218E71204205AFAB20EF659C8197AB7AEEF842A87108935F91BDB160E730FC4087A0

Function 00418485 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0041848D

Part of subcall function 00414F98: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,004151FB,?,00000000,-00000008), ref: 00414FF9

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 004184C5
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 004184E5

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: f25717e6bd25f80c70edce058ac37b14eb42a5c51d25e47d03568e648881f521
Instruction ID: 3124dd8456e489f230558b3eb58c4822848d10064887246f2ffea9b448aa8e9c
Opcode Fuzzy Hash: f25717e6bd25f80c70edce058ac37b14eb42a5c51d25e47d03568e648881f521
Instruction Fuzzy Hash: 6311C8B6511515BEA7112BB69C8ACEF7A5EDF89398711002EF50191201FE7CDF82417E

Function 049635E0 Relevance: 6.1, APIs: 4, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,049636EF,0495381E,?,00000000,04952AA0,04952AA2,?,04963868,00000022,00420B0C,00422950,00422958,04952AA0), ref: 049636A1

Memory Dump Source

Source File: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, Offset: 04950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4950000_file.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: b8c7e483e8ea991eea5b44eb111e182d5bd336103010429673e37ca0c8998616
Instruction ID: 067c916b0eb0639cacaf8424bae5b75bf55862140bc37f4bcbf575502e0cae7c
Opcode Fuzzy Hash: b8c7e483e8ea991eea5b44eb111e182d5bd336103010429673e37ca0c8998616
Instruction Fuzzy Hash: 6B21D231B01610BBCB319F65EC42B9A3B6D9B427A4B254235ED07A73A1EB30FD05C6D4

Function 049686EC Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 049686F4

Part of subcall function 049651FF: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,04965462,?,00000000,-00000008), ref: 04965260

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0496872C
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0496874C

Memory Dump Source

Source File: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, Offset: 04950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4950000_file.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: f25717e6bd25f80c70edce058ac37b14eb42a5c51d25e47d03568e648881f521
Instruction ID: feb1a02ec53880696c5514432aa90a6bf02a22c72f3534a569fecb4c0ca89810
Opcode Fuzzy Hash: f25717e6bd25f80c70edce058ac37b14eb42a5c51d25e47d03568e648881f521
Instruction Fuzzy Hash: 0611C4B66125197E77217B765CC8CAF3DADCEC91A87010534F90792100FA60FE0282B6

Function 0041CC28 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,0041C89F,00000000,00000001,?,00000000,?,00419ABE,00000000,00000000,00000000), ref: 0041CC3F
GetLastError.KERNEL32(?,0041C89F,00000000,00000001,?,00000000,?,00419ABE,00000000,00000000,00000000,00000000,00000000,?,0041A061,?), ref: 0041CC4B

Part of subcall function 0041CC11: CloseHandle.KERNEL32(FFFFFFFE,0041CC5B,?,0041C89F,00000000,00000001,?,00000000,?,00419ABE,00000000,00000000,00000000,00000000,00000000), ref: 0041CC21

___initconout.LIBCMT ref: 0041CC5B

Part of subcall function 0041CBD3: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0041CC02,0041C88C,00000000,?,00419ABE,00000000,00000000,00000000,00000000), ref: 0041CBE6

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,0041C89F,00000000,00000001,?,00000000,?,00419ABE,00000000,00000000,00000000,00000000), ref: 0041CC70

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: e3757025193b1f655bc0a77c3c1a7d52d6e2513ac00293883d9defc3f3400d05
Instruction ID: 7cbbc293f9202e5c3ba5059a923030a343761d0fd9452bc47cab7a7a002841ff
Opcode Fuzzy Hash: e3757025193b1f655bc0a77c3c1a7d52d6e2513ac00293883d9defc3f3400d05
Instruction Fuzzy Hash: 34F03036580218BBCF221FD5EC45ADE3F26FF497A0B404031FA0D96131D6328C619BD8

Function 0496CE8F Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,0496CB06,00000000,00000001,?,00000000,?,04969D25,00000000,00000000,00000000), ref: 0496CEA6
GetLastError.KERNEL32(?,0496CB06,00000000,00000001,?,00000000,?,04969D25,00000000,00000000,00000000,00000000,00000000,?,0496A2C8,?), ref: 0496CEB2

Part of subcall function 0496CE78: CloseHandle.KERNEL32(0042CA30,0496CEC2,?,0496CB06,00000000,00000001,?,00000000,?,04969D25,00000000,00000000,00000000,00000000,00000000), ref: 0496CE88

___initconout.LIBCMT ref: 0496CEC2

Part of subcall function 0496CE3A: CreateFileW.KERNEL32(00428728,40000000,00000003,00000000,00000003,00000000,00000000,0496CE69,0496CAF3,00000000,?,04969D25,00000000,00000000,00000000,00000000), ref: 0496CE4D

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,0496CB06,00000000,00000001,?,00000000,?,04969D25,00000000,00000000,00000000,00000000), ref: 0496CED7

Memory Dump Source

Source File: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, Offset: 04950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4950000_file.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: e3757025193b1f655bc0a77c3c1a7d52d6e2513ac00293883d9defc3f3400d05
Instruction ID: 525149c5109c89400660402c7a5a91214a4283679d32bd0e85d18a4c906a30fe
Opcode Fuzzy Hash: e3757025193b1f655bc0a77c3c1a7d52d6e2513ac00293883d9defc3f3400d05
Instruction Fuzzy Hash: 18F0AC36540158BBCF225F95EC08A9A7F36FF496A1B458030FA5A96120D732AC219BD4

Function 00409D4D Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00409CEA,00000064), ref: 00409D70
LeaveCriticalSection.KERNEL32(0042D064,0040104A,?,00409CEA,00000064,?,?,?,0040104A,0042DBF4), ref: 00409D7A
WaitForSingleObjectEx.KERNEL32(0040104A,00000000,?,00409CEA,00000064,?,?,?,0040104A,0042DBF4), ref: 00409D8B
EnterCriticalSection.KERNEL32(0042D064,?,00409CEA,00000064,?,?,?,0040104A,0042DBF4), ref: 00409D92

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: 203c7f3a807ec8057ea0aa5072313220b9e23051332dfe18f360eb7747514d6b
Instruction ID: ff8beb748e1eb1f5c5e1e2cf8612c53580035ff8934018e5237f3a6b450dea6c
Opcode Fuzzy Hash: 203c7f3a807ec8057ea0aa5072313220b9e23051332dfe18f360eb7747514d6b
Instruction Fuzzy Hash: 99E0ED31A85624FBCB111B60FC09AD97F25AF09B59F508032F90576171C7755D039BDD

Function 00410F1D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00410FAD

Strings

pow, xrefs: 00410F85, 00410FA2

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 31403c08627a7049c2df153d0248aecbd7cedb7773a1804d7f4783afb4547b5b
Instruction ID: 84ba177bd0b46390de2483f8fdd39171a32ac8a21a9604072373650434c829d0
Opcode Fuzzy Hash: 31403c08627a7049c2df153d0248aecbd7cedb7773a1804d7f4783afb4547b5b
Instruction Fuzzy Hash: 96515B71A0820196CB217B14DA023EB6BA0DB40751F618E6FF095453E8DBBDCCD7DA4E

Function 004095D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 183COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0040970E
std::_Xinvalid_argument.LIBCPMT ref: 00409725

Strings

vector too long, xrefs: 00409720

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_taskXinvalid_argumentstd::_
String ID: vector too long
API String ID: 3646673767-2873823879
Opcode ID: fa5d083a05728e905f1c3c49002d69253fe8fe1330e477015a8c99b2aef7f032
Instruction ID: 3420b24d6a7003b5252f74598cccc6f366c2f3b22bc1f833b28caab4f548f479
Opcode Fuzzy Hash: fa5d083a05728e905f1c3c49002d69253fe8fe1330e477015a8c99b2aef7f032
Instruction Fuzzy Hash: B05104B2E002159BCB14DF6CD8406AEB7A5EF84314F14067EE805FB382EB75AE408BD5

Function 0495BA67 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0495BAA6
__IsNonwritableInCurrentImage.LIBCMT ref: 0495BB5A

Strings

csm, xrefs: 0495BB44

Memory Dump Source

Source File: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, Offset: 04950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4950000_file.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 2a817a1480194b9b32cfb7907dea545d9bb946fea234306998335fac64bc32e7
Instruction ID: 0e7c3944bde18a15751221af0c1f39edf172653e307827899b3639b505ec047c
Opcode Fuzzy Hash: 2a817a1480194b9b32cfb7907dea545d9bb946fea234306998335fac64bc32e7
Instruction Fuzzy Hash: 6C41A134E00219AFDF10DF68C884AAEBBF5AF45328F248175EC14AB365D771BA05CB91

Function 0040C0A0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 0040C0C5

Strings

MOC, xrefs: 0040C0D7
RCC, xrefs: 0040C0DF

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: dec2c1a8c1fc86745a31a1a2a9fa5c906894c1295ee00ff621ec7b5f648f62df
Instruction ID: 8859d5309be3b2406ffac81c3508a23779d2d647c67c70ddfd5e45ce13346e89
Opcode Fuzzy Hash: dec2c1a8c1fc86745a31a1a2a9fa5c906894c1295ee00ff621ec7b5f648f62df
Instruction Fuzzy Hash: 89415A72900209EFCF15DF94CD81AAEBBB5BF48304F18816AF905BA292D3399951DF58

Function 0495C307 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0495C32C

Strings

RCC, xrefs: 0495C346
MOC, xrefs: 0495C33E

Memory Dump Source

Source File: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, Offset: 04950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4950000_file.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: dec2c1a8c1fc86745a31a1a2a9fa5c906894c1295ee00ff621ec7b5f648f62df
Instruction ID: 469ca81cc88efd7d276d9fe38d2634b47bf2dc2cc48431cd51c1df6cbec78555
Opcode Fuzzy Hash: dec2c1a8c1fc86745a31a1a2a9fa5c906894c1295ee00ff621ec7b5f648f62df
Instruction Fuzzy Hash: BD412872900209AFDF16DF98C981EEEBBB9BF48304F248169FD15A7225D335A950DF50

Function 00401000 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 00409CC5: EnterCriticalSection.KERNEL32(0042D064,?,?,?,0040104A,0042DBF4), ref: 00409CD0
Part of subcall function 00409CC5: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,0040104A,0042DBF4), ref: 00409D0D

__Init_thread_footer.LIBCMT ref: 00401084

Part of subcall function 00409C7B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401089,0042DBF4,0041DCC0), ref: 00409C85
Part of subcall function 00409C7B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401089,0042DBF4,0041DCC0), ref: 00409CB8
Part of subcall function 00409C7B: RtlWakeAllConditionVariable.NTDLL ref: 00409D2F

Strings

185.156.72.65, xrefs: 0040106C, 004010A0, 004010AD, 004010DC, 004010DD
185.156.72.65, xrefs: 004010B2, 004010E2

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: 185.156.72.65$185.156.72.65
API String ID: 2296764815-2656946096
Opcode ID: 5c5045922954c3457701567e6a6c9e3e1ad7be9ff9027362e03c1bac20b5626a
Instruction ID: 35b52d446d861aa170816ff75a143a42135cfe1fbea8b7bbecd3f4fad1973d83
Opcode Fuzzy Hash: 5c5045922954c3457701567e6a6c9e3e1ad7be9ff9027362e03c1bac20b5626a
Instruction Fuzzy Hash: E32137B0F002859EDB14EFA4D9557A97BB0EB01308F90017EE4457B3A2D7B85985CB5D

Function 00401110 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 00409CC5: EnterCriticalSection.KERNEL32(0042D064,?,?,?,0040104A,0042DBF4), ref: 00409CD0
Part of subcall function 00409CC5: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,0040104A,0042DBF4), ref: 00409D0D

__Init_thread_footer.LIBCMT ref: 00401194

Part of subcall function 00409C7B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401089,0042DBF4,0041DCC0), ref: 00409C85
Part of subcall function 00409C7B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401089,0042DBF4,0041DCC0), ref: 00409CB8
Part of subcall function 00409C7B: RtlWakeAllConditionVariable.NTDLL ref: 00409D2F

Strings

185.156.72.65, xrefs: 0040117C, 004011B0, 004011BD, 004011EC, 004011ED
185.156.72.65, xrefs: 004011C2, 004011F2

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: 185.156.72.65$185.156.72.65
API String ID: 2296764815-2656946096
Opcode ID: d4edda98fe8d358c67ce7c8865cf0bbf8e120b8e7e0123c9594653d9c3c5ac19
Instruction ID: 080c8299786e9307901dd30be4a7bf730519a23c54167f024b5206933e891779
Opcode Fuzzy Hash: d4edda98fe8d358c67ce7c8865cf0bbf8e120b8e7e0123c9594653d9c3c5ac19
Instruction Fuzzy Hash: 5E217CB0F002409ACB24EFA4E8257A97BB0FF04308F50027EE5056B3D2D7B82945CB5D

Function 00401220 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 00409CC5: EnterCriticalSection.KERNEL32(0042D064,?,?,?,0040104A,0042DBF4), ref: 00409CD0
Part of subcall function 00409CC5: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,0040104A,0042DBF4), ref: 00409D0D

__Init_thread_footer.LIBCMT ref: 004012A4

Part of subcall function 00409C7B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401089,0042DBF4,0041DCC0), ref: 00409C85
Part of subcall function 00409C7B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401089,0042DBF4,0041DCC0), ref: 00409CB8
Part of subcall function 00409C7B: RtlWakeAllConditionVariable.NTDLL ref: 00409D2F

Strings

185.156.72.65, xrefs: 0040128C, 004012C0, 004012CD, 004012FC, 004012FD
185.156.72.65, xrefs: 004012D2, 00401302

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: 185.156.72.65$185.156.72.65
API String ID: 2296764815-2656946096
Opcode ID: 03769d53c3af616b68b676de3282a5896e4960c6caaa03750b9c6d119f5d353c
Instruction ID: f3bdde1b4a8bc64e2f46b2d629ea0fd90e9d23492dc14d44f4e24dc008f4330a
Opcode Fuzzy Hash: 03769d53c3af616b68b676de3282a5896e4960c6caaa03750b9c6d119f5d353c
Instruction Fuzzy Hash: BA212274F002459ADB14FFA8E8157A97BB0BB00308F9041BED512BB2E2D7786901CB5D

Function 04951487 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 04959F2C: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04959F37
Part of subcall function 04959F2C: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04959F74

__Init_thread_footer.LIBCMT ref: 0495150B

Part of subcall function 04959EE2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04959EEC
Part of subcall function 04959EE2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04959F1F

Strings

185.156.72.65, xrefs: 04951539, 04951569
185.156.72.65, xrefs: 049514F3, 04951534, 04951563, 04951564

Memory Dump Source

Source File: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, Offset: 04950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4950000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: 185.156.72.65$185.156.72.65
API String ID: 4132704954-2656946096
Opcode ID: be6c719825c284f158df54f744c121145a8f163f6f071af473cd966bd4c0dd79
Instruction ID: b68f67b4c00690e181e770163d78a84ca3d00b31a65fe517a41e0cacc1b0a450
Opcode Fuzzy Hash: be6c719825c284f158df54f744c121145a8f163f6f071af473cd966bd4c0dd79
Instruction Fuzzy Hash: 6521D4B4F002059AEB24EFB8E9157A87BB0AF05308FA141B9C9239B2B1D7756506CB59

Function 04951267 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 04959F2C: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04959F37
Part of subcall function 04959F2C: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04959F74

__Init_thread_footer.LIBCMT ref: 049512EB

Part of subcall function 04959EE2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04959EEC
Part of subcall function 04959EE2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04959F1F

Strings

185.156.72.65, xrefs: 049512D3, 04951314, 04951343, 04951344
185.156.72.65, xrefs: 04951319, 04951349

Memory Dump Source

Source File: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, Offset: 04950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4950000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: 185.156.72.65$185.156.72.65
API String ID: 4132704954-2656946096
Opcode ID: 7e78777c7f8c15a49dcdc04fede0bd4176c739fbcff90974db9594e6dc6bcbe4
Instruction ID: 9e702a3d0036c6607689573dba1b7483ecbe6d04646fe19d8000a92ab8bf8a80
Opcode Fuzzy Hash: 7e78777c7f8c15a49dcdc04fede0bd4176c739fbcff90974db9594e6dc6bcbe4
Instruction Fuzzy Hash: 5A2137B0F00245DEEB14EFA8E9167A87BB0EB01308FA00179D84567360D7B56549CB5D

Function 04951377 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 04959F2C: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04959F37
Part of subcall function 04959F2C: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04959F74

__Init_thread_footer.LIBCMT ref: 049513FB

Part of subcall function 04959EE2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04959EEC
Part of subcall function 04959EE2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04959F1F

Strings

185.156.72.65, xrefs: 049513E3, 04951424, 04951453, 04951454
185.156.72.65, xrefs: 04951429, 04951459

Memory Dump Source

Source File: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, Offset: 04950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4950000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: 185.156.72.65$185.156.72.65
API String ID: 4132704954-2656946096
Opcode ID: 8a8fe8d317b662227fd327a90130799ce29107c4e0518a32c3058f42c24412ec
Instruction ID: a02c709b0203582cfdba942107a8ff52fd0862dd8be4265b390dd0447ed87fa5
Opcode Fuzzy Hash: 8a8fe8d317b662227fd327a90130799ce29107c4e0518a32c3058f42c24412ec
Instruction Fuzzy Hash: 9321F5B0F00244DAEB24EFA4E9257A87BB0EF41308FA002B9DC055B260D7B56545CB59

Function 00408480 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 00409CC5: EnterCriticalSection.KERNEL32(0042D064,?,?,?,0040104A,0042DBF4), ref: 00409CD0
Part of subcall function 00409CC5: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,0040104A,0042DBF4), ref: 00409D0D

__Init_thread_footer.LIBCMT ref: 004084EE

Part of subcall function 00409C7B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401089,0042DBF4,0041DCC0), ref: 00409C85
Part of subcall function 00409C7B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401089,0042DBF4,0041DCC0), ref: 00409CB8
Part of subcall function 00409C7B: RtlWakeAllConditionVariable.NTDLL ref: 00409D2F

Strings

[@G_, xrefs: 00408497
G@ZK, xrefs: 004084A0

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: G@ZK$[@G_
API String ID: 2296764815-2338778587
Opcode ID: 83c89cb96f0188348aa664fe5a3b9a2307e547b5dfc0b364f734f744eaf6d0b1
Instruction ID: 2d9fbaa08c13fc83b2f5e0005e6d1fa5ae776f13101647786266d8808d8cc77d
Opcode Fuzzy Hash: 83c89cb96f0188348aa664fe5a3b9a2307e547b5dfc0b364f734f744eaf6d0b1
Instruction Fuzzy Hash: F501DB70F00285DFC710EBB9AD41969B7A0A719310BA1417EE526BB3D2EA79AC01CB4D

Function 00407E80 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 00409CC5: EnterCriticalSection.KERNEL32(0042D064,?,?,?,0040104A,0042DBF4), ref: 00409CD0
Part of subcall function 00409CC5: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,0040104A,0042DBF4), ref: 00409D0D

__Init_thread_footer.LIBCMT ref: 00407EEE

Part of subcall function 00409C7B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401089,0042DBF4,0041DCC0), ref: 00409C85
Part of subcall function 00409C7B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401089,0042DBF4,0041DCC0), ref: 00409CB8
Part of subcall function 00409C7B: RtlWakeAllConditionVariable.NTDLL ref: 00409D2F

Strings

[@G_, xrefs: 00407E97
G@ZK, xrefs: 00407EA0

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: G@ZK$[@G_
API String ID: 2296764815-2338778587
Opcode ID: 9d937272391ced5062343f2fa694021c1e821d7a0b24c59750c86be7e58ed2ae
Instruction ID: 86c78c31387f24dba649c5f85d45a7e4d1f1fe09f4149f0eb9c238fce71b3fdb
Opcode Fuzzy Hash: 9d937272391ced5062343f2fa694021c1e821d7a0b24c59750c86be7e58ed2ae
Instruction Fuzzy Hash: D601D6F0F05244DBD720DBA9AC41A6AB7B0AB09304F9005BAF51977792DA396C41CB49

Function 049586E7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 04959F2C: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04959F37
Part of subcall function 04959F2C: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04959F74

__Init_thread_footer.LIBCMT ref: 04958755

Part of subcall function 04959EE2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04959EEC
Part of subcall function 04959EE2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04959F1F

Strings

G@ZK, xrefs: 04958707
[@G_, xrefs: 049586FE

Memory Dump Source

Source File: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, Offset: 04950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4950000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: G@ZK$[@G_
API String ID: 4132704954-2338778587
Opcode ID: c5541afd9278791e683032a0605f61e379c7bee72b326041da17bc8a9c68a871
Instruction ID: b6d9e5f69eea9796bea2d87498c86624bd5840650b0f6347fdc5e806259f9cb9
Opcode Fuzzy Hash: c5541afd9278791e683032a0605f61e379c7bee72b326041da17bc8a9c68a871
Instruction Fuzzy Hash: 4D01D6B0F00244DFDB10EFB8AC41969B7B0A759314BB00679D936AB2A0DB75B9058B45

Function 049580E7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 04959F2C: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04959F37
Part of subcall function 04959F2C: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04959F74

__Init_thread_footer.LIBCMT ref: 04958155

Part of subcall function 04959EE2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04959EEC
Part of subcall function 04959EE2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04959F1F

Strings

[@G_, xrefs: 049580FE
G@ZK, xrefs: 04958107

Memory Dump Source

Source File: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, Offset: 04950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4950000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: G@ZK$[@G_
API String ID: 4132704954-2338778587
Opcode ID: 3643e019afddb0ded186ab5a90822b7330a81e91dcde7fa05791cd6361697cb6
Instruction ID: 70e303a494107c807b5c4bbdc7990226a0e9e82326240ab6145931cc99123ab7
Opcode Fuzzy Hash: 3643e019afddb0ded186ab5a90822b7330a81e91dcde7fa05791cd6361697cb6
Instruction Fuzzy Hash: 0001D6F1F41204DBE720EFA8AC41A69B7B0AB59314FB006B9E91957370DB3568458B45

Function 00407830 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 00409CC5: EnterCriticalSection.KERNEL32(0042D064,?,?,?,0040104A,0042DBF4), ref: 00409CD0
Part of subcall function 00409CC5: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,0040104A,0042DBF4), ref: 00409D0D

__Init_thread_footer.LIBCMT ref: 00407899

Part of subcall function 00409C7B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401089,0042DBF4,0041DCC0), ref: 00409C85
Part of subcall function 00409C7B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401089,0042DBF4,0041DCC0), ref: 00409CB8
Part of subcall function 00409C7B: RtlWakeAllConditionVariable.NTDLL ref: 00409D2F

Strings

A@K., xrefs: 0040784D
@G@K, xrefs: 00407846

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: @G@K$A@K.
API String ID: 2296764815-2457859030
Opcode ID: 94f704d5fcaaa4a6a86cea28288e2267e04fc7853d895301023c40d4626a8c24
Instruction ID: 02867bdc75deabfbdae8ac7f1914e191d6f0b036ba1bc0e64f50d331b9525a60
Opcode Fuzzy Hash: 94f704d5fcaaa4a6a86cea28288e2267e04fc7853d895301023c40d4626a8c24
Instruction Fuzzy Hash: 94016271F042049BC710DF58E946A58B7B0EB48304F60417BE906A7392D779AE418B5D

Function 00407940 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 00409CC5: EnterCriticalSection.KERNEL32(0042D064,?,?,?,0040104A,0042DBF4), ref: 00409CD0
Part of subcall function 00409CC5: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,0040104A,0042DBF4), ref: 00409D0D

__Init_thread_footer.LIBCMT ref: 004079A9

Part of subcall function 00409C7B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401089,0042DBF4,0041DCC0), ref: 00409C85
Part of subcall function 00409C7B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401089,0042DBF4,0041DCC0), ref: 00409CB8
Part of subcall function 00409C7B: RtlWakeAllConditionVariable.NTDLL ref: 00409D2F

Strings

@G@K, xrefs: 00407956
ZYA., xrefs: 0040795D

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: @G@K$ZYA.
API String ID: 2296764815-4236202813
Opcode ID: 2083bbc37204df75ae5e3194cbdbfa2277e554d398516f573e64da7e7003365e
Instruction ID: d8be7bc43f2ac3a424769131d28bfe1308d6783f1b1820d008cdb8cd51ef09c0
Opcode Fuzzy Hash: 2083bbc37204df75ae5e3194cbdbfa2277e554d398516f573e64da7e7003365e
Instruction Fuzzy Hash: D3018174F04248DFCB24EFA8E992A5CBBB0AB04300F90417BE915A7392D6786D01CB5D

Function 00406DD0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 00409CC5: EnterCriticalSection.KERNEL32(0042D064,?,?,?,0040104A,0042DBF4), ref: 00409CD0
Part of subcall function 00409CC5: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,0040104A,0042DBF4), ref: 00409D0D

__Init_thread_footer.LIBCMT ref: 00406E39

Part of subcall function 00409C7B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401089,0042DBF4,0041DCC0), ref: 00409C85
Part of subcall function 00409C7B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401089,0042DBF4,0041DCC0), ref: 00409CB8
Part of subcall function 00409C7B: RtlWakeAllConditionVariable.NTDLL ref: 00409D2F

Strings

ZF\K, xrefs: 00406DE6
three, xrefs: 00406E1B, 00406E44

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: ZF\K$three
API String ID: 2296764815-3094064056
Opcode ID: d0f8a07ab7cfa26798f6e4e5872bddee28ed568160f4df47330400ac7d4580cc
Instruction ID: 29344792781c46cc919c6541bc41426b34b2da4dd82bbb0e7b349b67a9b0c42f
Opcode Fuzzy Hash: d0f8a07ab7cfa26798f6e4e5872bddee28ed568160f4df47330400ac7d4580cc
Instruction Fuzzy Hash: DF01D134F04204DBCB20DFA9E882B9CB3B0EB04314FA0017AED06A7391DA385D42DB4D

Function 04957037 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 04959F2C: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04959F37
Part of subcall function 04959F2C: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04959F74

__Init_thread_footer.LIBCMT ref: 049570A0

Part of subcall function 04959EE2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04959EEC
Part of subcall function 04959EE2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04959F1F

Strings

ZF\K, xrefs: 0495704D
three, xrefs: 04957082, 049570AB

Memory Dump Source

Source File: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, Offset: 04950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4950000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: ZF\K$three
API String ID: 4132704954-3094064056
Opcode ID: d97624d9c83104853a490e783dfff4d2631947f354aaa65fd626d83f5661df9f
Instruction ID: 60cf2a7dc68a29c70edabd6d98aedb78c32db83a2db6c897080f8ef949d90416
Opcode Fuzzy Hash: d97624d9c83104853a490e783dfff4d2631947f354aaa65fd626d83f5661df9f
Instruction Fuzzy Hash: BF016974F04208EBDB20DFE9E981B4CB3B0AB54754FB041BADD15A73A0D6746A06DB19

Function 04957A97 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 04959F2C: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04959F37
Part of subcall function 04959F2C: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04959F74

__Init_thread_footer.LIBCMT ref: 04957B00

Part of subcall function 04959EE2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04959EEC
Part of subcall function 04959EE2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04959F1F

Strings

@G@K, xrefs: 04957AAD
A@K., xrefs: 04957AB4

Memory Dump Source

Source File: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, Offset: 04950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4950000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: @G@K$A@K.
API String ID: 4132704954-2457859030
Opcode ID: a83cbf7a01367588a88915ca0a2ca858a472c895f782e2ee7495506aef916c1c
Instruction ID: 38221bc8e8a54746fba994961db8364b5d67c5f54a5ce43662c162bd3be8d830
Opcode Fuzzy Hash: a83cbf7a01367588a88915ca0a2ca858a472c895f782e2ee7495506aef916c1c
Instruction Fuzzy Hash: 320181B0F00204DFD720DFA8E946A5C77B0E749304FB001BADD16A73A0D775AA458B59

Function 04957BA7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 04959F2C: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04959F37
Part of subcall function 04959F2C: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04959F74

__Init_thread_footer.LIBCMT ref: 04957C10

Part of subcall function 04959EE2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04959EEC
Part of subcall function 04959EE2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04959F1F

Strings

@G@K, xrefs: 04957BBD
ZYA., xrefs: 04957BC4

Memory Dump Source

Source File: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, Offset: 04950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4950000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: @G@K$ZYA.
API String ID: 4132704954-4236202813
Opcode ID: e0e011dd5bc5313defc92a44cb7491cb40592dbe2e3934c573b23a31aa141d8c
Instruction ID: 1213575038c523a82ef544637b8d7b5647d95631f7cf84cebd34dcb3e32a8c94
Opcode Fuzzy Hash: e0e011dd5bc5313defc92a44cb7491cb40592dbe2e3934c573b23a31aa141d8c
Instruction Fuzzy Hash: CF018174F00304DFDB24EFA8E991A5C7BF0AB44314FA041BADD2557360D6757945CB49

Function 00406C40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00409CC5: EnterCriticalSection.KERNEL32(0042D064,?,?,?,0040104A,0042DBF4), ref: 00409CD0
Part of subcall function 00409CC5: LeaveCriticalSection.KERNEL32(0042D064,?,?,?,0040104A,0042DBF4), ref: 00409D0D

__Init_thread_footer.LIBCMT ref: 00406C99

Part of subcall function 00409C7B: EnterCriticalSection.KERNEL32(0042D064,?,?,00401089,0042DBF4,0041DCC0), ref: 00409C85
Part of subcall function 00409C7B: LeaveCriticalSection.KERNEL32(0042D064,?,?,00401089,0042DBF4,0041DCC0), ref: 00409CB8
Part of subcall function 00409C7B: RtlWakeAllConditionVariable.NTDLL ref: 00409D2F

Strings

CGV., xrefs: 00406C56
mix, xrefs: 00406C8A, 00406CA4

Memory Dump Source

Source File: 00000000.00000002.4099946963.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: CGV.$mix
API String ID: 2296764815-1644454629
Opcode ID: 748439c7c3e09b0f3fc712733e62b7b7dbd043bc03440ddc61534c02d70abd55
Instruction ID: 24033b3836d6b4f620cd462d172ded2aeb793c2235c3ef6269eb5d899298d204
Opcode Fuzzy Hash: 748439c7c3e09b0f3fc712733e62b7b7dbd043bc03440ddc61534c02d70abd55
Instruction Fuzzy Hash: 2AF062B0F082049BDB10EBA9E982E5877A0AB45314FA4017AE906A77D2D6386D418B5D

Function 04956EA7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 04959F2C: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04959F37
Part of subcall function 04959F2C: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04959F74

__Init_thread_footer.LIBCMT ref: 04956F00

Part of subcall function 04959EE2: RtlEnterCriticalSection.NTDLL(0042D064), ref: 04959EEC
Part of subcall function 04959EE2: RtlLeaveCriticalSection.NTDLL(0042D064), ref: 04959F1F

Strings

mix, xrefs: 04956EF1, 04956F0B
CGV., xrefs: 04956EBD

Memory Dump Source

Source File: 00000000.00000002.4101764872.0000000004950000.00000040.00001000.00020000.00000000.sdmp, Offset: 04950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4950000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer
String ID: CGV.$mix
API String ID: 4132704954-1644454629
Opcode ID: 5dae890d2176cd9c71f813253ec21c7a890b77e07cc8d6e19f72d9632b318c6d
Instruction ID: 0ace2dae8a327e575a5f5fe3e1d4c52e27c4eb285322fb79163cc70e8265dc82
Opcode Fuzzy Hash: 5dae890d2176cd9c71f813253ec21c7a890b77e07cc8d6e19f72d9632b318c6d
Instruction Fuzzy Hash: 70F096B0F44204DBDB10EFA8F942E5C77E0AB45324FF00175ED06973A0D63479458B59

Function 00501A0C Relevance: 5.1, Strings: 4, Instructions: 132COMMON

Download Yara Rule

Strings

kAW, xrefs: 00501AA1
HE1y, xrefs: 00501ACF
6~}, xrefs: 00501A4C
^gc., xrefs: 00501A28

Memory Dump Source

Source File: 00000000.00000002.4100040646.0000000000470000.00000040.00000001.01000000.00000003.sdmp, Offset: 00470000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_470000_file.jbxd

Similarity

API ID:
String ID: 6~}$HE1y$^gc.$kAW
API String ID: 0-3217522955
Opcode ID: f4503167a584a05d14af2ebeab9b4cf456da1b9aefabc1b9f74a0038b6a93745
Instruction ID: 8f6a285a24f091bb6219de6c5e6e6f2659b047165cad1918ac912a7f88a2084c
Opcode Fuzzy Hash: f4503167a584a05d14af2ebeab9b4cf456da1b9aefabc1b9f74a0038b6a93745
Instruction Fuzzy Hash: 6A4123B3B082045FE3045A7EEC5573ABBD9EBD4760F2B063DEA81C3B80E57698058756

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Nymaim

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Boot Survival

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

HTTP Request Dependency Graph

HTTP Packets

Windows Analysis Report
file.exe

Function 00404F70 Relevance: 45.4, APIs: 16, Strings: 9, Instructions: 1645
sleepregistryCOMMON

Function 047A8464 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Function 004087E0 Relevance: 2.5, Strings: 2, Instructions: 26
COMMON

Function 00706806 Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMON

Function 00401830 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 106
networkCOMMON

Function 0495003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Function 00405A50 Relevance: 11.2, APIs: 2, Strings: 5, Instructions: 678
sleepCOMMON

Function 00401E50 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 154
COMMON

Function 00606B4B Relevance: 4.6, APIs: 3, Instructions: 114
registryCOMMON

Function 00706839 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 61
memoryCOMMON

Function 00413CB9 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32
memoryCOMMON

Function 04950E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Function 00605DF2 Relevance: 1.6, APIs: 1, Instructions: 59
libraryCOMMON

Function 0070681F Relevance: 1.5, APIs: 1, Instructions: 30
memoryCOMMON

Function 00706888 Relevance: 1.5, APIs: 1, Instructions: 10
memoryCOMMON