Edit tour

Windows Analysis Report
94g4KHMj9B.exe

Overview

General Information

Sample name:	94g4KHMj9B.exe renamed because original name is a hash value
Original sample name:	bc9903cd12a6b359c28e16021909ccb3.exe
Analysis ID:	1579683
MD5:	bc9903cd12a6b359c28e16021909ccb3
SHA1:	1b444289d8df7755f1d779b9862c8e4995ee6d55
SHA256:	072e228bf10d03818ed7869a52bdc386d0bd437923044fb98e2a29ae2ff4591a
Tags:	exeuser-abuse_ch
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Potentially malicious time measurement code found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

AV process strings found (often used to terminate AV products)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Entry point lies outside standard sections

Found large amount of non-executed APIs

HTTP GET or POST without a user agent

IP address seen in connection with other malware

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Classification

Process Tree

System is w10x64

94g4KHMj9B.exe (PID: 3272 cmdline: "C:\Users\user\Desktop\94g4KHMj9B.exe" MD5: BC9903CD12A6B359C28E16021909CCB3)

WerFault.exe (PID: 1976 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 1136 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 94g4KHMj9B.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: 94g4KHMj9B.exe	Virustotal: Detection: 42%			Perma Link
Source: 94g4KHMj9B.exe	ReversingLabs: Detection: 68%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 94g4KHMj9B.exe

Joe Sandbox ML: detected

Source: 94g4KHMj9B.exe, 00000000.00000002.1650797309.0000000000AFD000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_d704cd38-0

Source: 94g4KHMj9B.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: global traffic

HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: */*

Source: Joe Sandbox View

IP Address: 34.226.108.155 34.226.108.155

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: */*

Source: global traffic	DNS traffic detected: DNS query: httpbin.org
Source: global traffic	DNS traffic detected: DNS query: home.fivetk5ht.top

Source: 94g4KHMj9B.exe, 00000000.00000002.1650797309.0000000000AFD000.00000040.00000001.01000000.00000003.sdmp, 94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: 94g4KHMj9B.exe, 00000000.00000002.1650797309.0000000000AFD000.00000040.00000001.01000000.00000003.sdmp, 94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: 94g4KHMj9B.exe, 00000000.00000002.1652230066.0000000001991000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.fivetk5ht.top/zldPR
Source: 94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv17
Source: 94g4KHMj9B.exe, 00000000.00000002.1652230066.000000000190E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851
Source: 94g4KHMj9B.exe, 00000000.00000002.1652230066.000000000190E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv17345798516963
Source: 94g4KHMj9B.exe, 00000000.00000002.1652230066.000000000190E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851fff::3
Source: 94g4KHMj9B.exe, 00000000.00000002.1650797309.0000000000AFD000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851http://home.fivetk5ht.top/zldPRFrmVFHTtKntGp
Source: 94g4KHMj9B.exe, 00000000.00000002.1650797309.0000000000AFD000.00000040.00000001.01000000.00000003.sdmp, 94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: Amcache.hve.4.dr	String found in binary or memory: http://upx.sf.net
Source: 94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: 94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: 94g4KHMj9B.exe, 00000000.00000002.1650797309.0000000000AFD000.00000040.00000001.01000000.00000003.sdmp, 94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: 94g4KHMj9B.exe, 00000000.00000002.1650797309.0000000000AFD000.00000040.00000001.01000000.00000003.sdmp, 94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/ip
Source: 94g4KHMj9B.exe, 00000000.00000002.1650797309.0000000000AFD000.00000040.00000001.01000000.00000003.sdmp, 94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/ipbefore

Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

System Summary

PE file contains section with special chars

Source: 94g4KHMj9B.exe	Static PE information: section name:
Source: 94g4KHMj9B.exe	Static PE information: section name: .idata
Source: 94g4KHMj9B.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\94g4KHMj9B.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 1136

Source: 94g4KHMj9B.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: 94g4KHMj9B.exe

Static PE information: Section: ibyjowhj ZLIB complexity 0.9943412810580681

Source: classification engine

Classification label: mal100.evad.winEXE@2/5@14/1

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3272
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Mutant created: \Sessions\1\BaseNamedObjects\My_mutex

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\58f3c164-3476-4b26-b8d6-aaf5d44af5ec

Jump to behavior

Source: C:\Users\user\Desktop\94g4KHMj9B.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\94g4KHMj9B.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: 94g4KHMj9B.exe	Virustotal: Detection: 42%
Source: 94g4KHMj9B.exe	ReversingLabs: Detection: 68%

Source: 94g4KHMj9B.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\94g4KHMj9B.exe "C:\Users\user\Desktop\94g4KHMj9B.exe"
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 1136

Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Section loaded: winrnr.dll	Jump to behavior

Source: 94g4KHMj9B.exe

Static file information: File size 4490240 > 1048576

Source: 94g4KHMj9B.exe	Static PE information: Raw size of is bigger than: 0x100000 < 0x284c00
Source: 94g4KHMj9B.exe	Static PE information: Raw size of ibyjowhj is bigger than: 0x100000 < 0x1bfc00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\94g4KHMj9B.exe

Unpacked PE file: 0.2.94g4KHMj9B.exe.520000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ibyjowhj:EW;mvafozls:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ibyjowhj:EW;mvafozls:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: 94g4KHMj9B.exe

Static PE information: real checksum: 0x45151d should be: 0x4497ae

Source: 94g4KHMj9B.exe	Static PE information: section name:
Source: 94g4KHMj9B.exe	Static PE information: section name: .idata
Source: 94g4KHMj9B.exe	Static PE information: section name:
Source: 94g4KHMj9B.exe	Static PE information: section name: ibyjowhj
Source: 94g4KHMj9B.exe	Static PE information: section name: mvafozls
Source: 94g4KHMj9B.exe	Static PE information: section name: .taggant

Source: 94g4KHMj9B.exe

Static PE information: section name: ibyjowhj entropy: 7.955270488785443

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\94g4KHMj9B.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 94g4KHMj9B.exe, 00000000.00000002.1650797309.0000000000AFD000.00000040.00000001.01000000.00000003.sdmp, 94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXE
Source: 94g4KHMj9B.exe, 00000000.00000002.1650797309.0000000000AFD000.00000040.00000001.01000000.00000003.sdmp, 94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: X64DBG.EXE
Source: 94g4KHMj9B.exe, 00000000.00000002.1650797309.0000000000AFD000.00000040.00000001.01000000.00000003.sdmp, 94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: WINDBG.EXE
Source: 94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SYSINTERNALSNUM_PROCESSORNUM_RAMNAMEALLFREEDRIVERSNUM_DISPLAYSRESOLUTION_XRESOLUTION_Y\RECENT_FILESPROCESSESUPTIME_MINUTESC:\WINDOWS\SYSTEM32\VBOX.DLL01VBOX_FIRSTSYSTEM\CONTROLSET001\SERVICES\VBOXSFVBOX_SECONDC:\USERS\PUBLIC\PUBLIC_CHECKWINDBG.EXEDBGWIRESHARK.EXEPROCMON.EXEX64DBG.EXEIDA.EXEDBG_SECDBG_THIRDYADROINSTALLED_APPSSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALLSOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL%D%S\%SDISPLAYNAMEAPP_NAMEINDEXCREATETOOLHELP32SNAPSHOT FAILED.
Source: 94g4KHMj9B.exe, 00000000.00000002.1650797309.0000000000AFD000.00000040.00000001.01000000.00000003.sdmp, 94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: DE709B second address: DE709F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: DE709F second address: DE70B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C53h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: DE70B6 second address: DE70C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 ja 00007F4D4CB43A26h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: DE7217 second address: DE7221 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F4D4CB41C46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: DE7221 second address: DE7250 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A2Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F4D4CB43A38h 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: DE7250 second address: DE7255 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: DE7255 second address: DE7269 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edi 0x00000004 pop edi 0x00000005 je 00007F4D4CB43A26h 0x0000000b pop ebx 0x0000000c jnc 00007F4D4CB43A2Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: DE73AA second address: DE73AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: DE73AF second address: DE73DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A2Ch 0x00000007 jmp 00007F4D4CB43A39h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: DE73DD second address: DE73E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: DE73E1 second address: DE73E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: DE73E5 second address: DE73EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: DE8C50 second address: DE8C54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: DE8C54 second address: DE8C5A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: DE8C5A second address: DE8C7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4D4CB43A37h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: DE8C7F second address: DE8C89 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4D4CB41C4Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: DE8C89 second address: DE8C97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: DE8C97 second address: DE8C9D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: DE8D42 second address: DE8DB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 xor dword ptr [esp], 22D911C8h 0x0000000c call 00007F4D4CB43A2Eh 0x00000011 adc edi, 0C17A5BFh 0x00000017 pop esi 0x00000018 push 00000003h 0x0000001a sbb esi, 03EB6F7Bh 0x00000020 push 00000000h 0x00000022 mov edi, eax 0x00000024 push 00000003h 0x00000026 jns 00007F4D4CB43A28h 0x0000002c mov esi, edi 0x0000002e push A0F78A52h 0x00000033 push eax 0x00000034 jno 00007F4D4CB43A28h 0x0000003a pop eax 0x0000003b xor dword ptr [esp], 60F78A52h 0x00000042 mov cl, bh 0x00000044 lea ebx, dword ptr [ebp+12450B91h] 0x0000004a jmp 00007F4D4CB43A2Fh 0x0000004f mov edx, edi 0x00000051 xchg eax, ebx 0x00000052 push eax 0x00000053 push edx 0x00000054 pushad 0x00000055 jne 00007F4D4CB43A26h 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: DE8DB4 second address: DE8DB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: DE8DB9 second address: DE8DBF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: DE8F18 second address: DE8F1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: DE8F1C second address: DE8F22 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: DE8F22 second address: DE8F3F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4D4CB41C51h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: DE8F3F second address: DE8FF8 instructions: 0x00000000 rdtsc 0x00000002 js 00007F4D4CB43A2Ch 0x00000008 ja 00007F4D4CB43A26h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push edi 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b pop edi 0x0000001c pop eax 0x0000001d xor dword ptr [ebp+122D2811h], edi 0x00000023 push 00000003h 0x00000025 ja 00007F4D4CB43A2Bh 0x0000002b push 00000000h 0x0000002d and esi, dword ptr [ebp+122D36EEh] 0x00000033 push 00000003h 0x00000035 call 00007F4D4CB43A33h 0x0000003a pushad 0x0000003b jnc 00007F4D4CB43A26h 0x00000041 push edx 0x00000042 pop eax 0x00000043 popad 0x00000044 pop edi 0x00000045 call 00007F4D4CB43A29h 0x0000004a jmp 00007F4D4CB43A2Ch 0x0000004f push eax 0x00000050 push ebx 0x00000051 push ebx 0x00000052 jmp 00007F4D4CB43A33h 0x00000057 pop ebx 0x00000058 pop ebx 0x00000059 mov eax, dword ptr [esp+04h] 0x0000005d jmp 00007F4D4CB43A33h 0x00000062 mov eax, dword ptr [eax] 0x00000064 jmp 00007F4D4CB43A30h 0x00000069 mov dword ptr [esp+04h], eax 0x0000006d push eax 0x0000006e push edx 0x0000006f pushad 0x00000070 push ecx 0x00000071 pop ecx 0x00000072 push eax 0x00000073 push edx 0x00000074 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: DE8FF8 second address: DE8FFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: DE8FFD second address: DE9008 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F4D4CB43A26h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E08E0A second address: E08E0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E08E0E second address: E08E14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E0937A second address: E09383 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E097F2 second address: E097F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E097F8 second address: E097FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E09A67 second address: E09A74 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F4D4CB43A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E09A74 second address: E09A7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E0172B second address: E01736 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E01736 second address: E0173A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E0173A second address: E0173E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E0173E second address: E01744 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E01744 second address: E0176B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4D4CB43A33h 0x00000009 jmp 00007F4D4CB43A30h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E09BE1 second address: E09BFD instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4D4CB41C54h 0x00000008 jmp 00007F4D4CB41C4Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edi 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E09BFD second address: E09C15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4D4CB43A32h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E0A433 second address: E0A437 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E12514 second address: E12539 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4D4CB43A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jng 00007F4D4CB43A26h 0x00000015 jmp 00007F4D4CB43A2Fh 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E12539 second address: E12540 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E12947 second address: E12952 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F4D4CB43A26h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E12952 second address: E1295C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F4D4CB41C46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E1295C second address: E12982 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pushad 0x00000010 popad 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E12AB2 second address: E12ACC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C52h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E12ACC second address: E12AF0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edi 0x00000009 jng 00007F4D4CB43A28h 0x0000000f pushad 0x00000010 popad 0x00000011 pop edi 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 jbe 00007F4D4CB43A32h 0x0000001c je 00007F4D4CB43A2Ch 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E12AF0 second address: E12AFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov eax, dword ptr [eax] 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E12AFB second address: E12AFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E12AFF second address: E12B03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E1147E second address: E11482 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E11482 second address: E11488 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E18B59 second address: E18B6C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A2Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E18B6C second address: E18B81 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C4Eh 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E18035 second address: E18039 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E18039 second address: E1803D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E18169 second address: E1816F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E1816F second address: E181A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F4D4CB41C46h 0x0000000a jmp 00007F4D4CB41C59h 0x0000000f popad 0x00000010 jmp 00007F4D4CB41C54h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E181A7 second address: E181EC instructions: 0x00000000 rdtsc 0x00000002 jg 00007F4D4CB43A2Eh 0x00000008 jp 00007F4D4CB43A26h 0x0000000e pushad 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 jmp 00007F4D4CB43A39h 0x00000018 push eax 0x00000019 push edx 0x0000001a push edi 0x0000001b pop edi 0x0000001c jmp 00007F4D4CB43A35h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E188B1 second address: E188B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E188B5 second address: E188B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E1935B second address: E193B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 xor dword ptr [esp], 019AB4AEh 0x0000000c push 00000000h 0x0000000e push eax 0x0000000f call 00007F4D4CB41C48h 0x00000014 pop eax 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 add dword ptr [esp+04h], 0000001Ah 0x00000021 inc eax 0x00000022 push eax 0x00000023 ret 0x00000024 pop eax 0x00000025 ret 0x00000026 add dword ptr [ebp+122D3455h], esi 0x0000002c mov dword ptr [ebp+122D59DBh], edx 0x00000032 call 00007F4D4CB41C49h 0x00000037 pushad 0x00000038 jmp 00007F4D4CB41C4Ah 0x0000003d push ecx 0x0000003e jns 00007F4D4CB41C46h 0x00000044 pop ecx 0x00000045 popad 0x00000046 push eax 0x00000047 push ebx 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b popad 0x0000004c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E193B8 second address: E193F1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jl 00007F4D4CB43A2Ah 0x00000011 mov eax, dword ptr [eax] 0x00000013 pushad 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007F4D4CB43A39h 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E195A6 second address: E195AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E19789 second address: E1979A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jp 00007F4D4CB43A26h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E1979A second address: E197A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E1984A second address: E1984E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E1A0C9 second address: E1A0FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 jp 00007F4D4CB41C50h 0x0000000e xchg eax, ebx 0x0000000f mov esi, 7E736626h 0x00000014 nop 0x00000015 jmp 00007F4D4CB41C4Dh 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E1A0FB second address: E1A100 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E1A100 second address: E1A106 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E1A325 second address: E1A32A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E1A544 second address: E1A55C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4D4CB41C54h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E1C42F second address: E1C435 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E1CC78 second address: E1CC8B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnc 00007F4D4CB41C46h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edi 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E1D935 second address: E1D93A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E1E317 second address: E1E38F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jno 00007F4D4CB41C4Ch 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f push esi 0x00000010 mov esi, dword ptr [ebp+122D36E2h] 0x00000016 pop edi 0x00000017 movzx edi, bx 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push ebp 0x0000001f call 00007F4D4CB41C48h 0x00000024 pop ebp 0x00000025 mov dword ptr [esp+04h], ebp 0x00000029 add dword ptr [esp+04h], 0000001Dh 0x00000031 inc ebp 0x00000032 push ebp 0x00000033 ret 0x00000034 pop ebp 0x00000035 ret 0x00000036 mov edi, dword ptr [ebp+122D39CAh] 0x0000003c push 00000000h 0x0000003e push 00000000h 0x00000040 push edi 0x00000041 call 00007F4D4CB41C48h 0x00000046 pop edi 0x00000047 mov dword ptr [esp+04h], edi 0x0000004b add dword ptr [esp+04h], 00000018h 0x00000053 inc edi 0x00000054 push edi 0x00000055 ret 0x00000056 pop edi 0x00000057 ret 0x00000058 mov edi, esi 0x0000005a xchg eax, ebx 0x0000005b push eax 0x0000005c push edx 0x0000005d push edx 0x0000005e push eax 0x0000005f pop eax 0x00000060 pop edx 0x00000061 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E1EF55 second address: E1EF65 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4D4CB43A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push esi 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E1E0FA second address: E1E100 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E1EC44 second address: E1EC4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E1F885 second address: E1F8A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4D4CB41C58h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E23E00 second address: E23E0A instructions: 0x00000000 rdtsc 0x00000002 js 00007F4D4CB43A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E24E44 second address: E24E4B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E24E4B second address: E24E61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jo 00007F4D4CB43A32h 0x0000000e jng 00007F4D4CB43A2Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E25E4D second address: E25E51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E25054 second address: E2505A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E25E51 second address: E25E69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 jmp 00007F4D4CB41C4Dh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E2505A second address: E2505E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E25E69 second address: E25E73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E260C4 second address: E260C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E27E40 second address: E27EA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push eax 0x0000000a call 00007F4D4CB41C48h 0x0000000f pop eax 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 add dword ptr [esp+04h], 0000001Ah 0x0000001c inc eax 0x0000001d push eax 0x0000001e ret 0x0000001f pop eax 0x00000020 ret 0x00000021 push 00000000h 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push edx 0x00000028 call 00007F4D4CB41C48h 0x0000002d pop edx 0x0000002e mov dword ptr [esp+04h], edx 0x00000032 add dword ptr [esp+04h], 00000014h 0x0000003a inc edx 0x0000003b push edx 0x0000003c ret 0x0000003d pop edx 0x0000003e ret 0x0000003f sbb edi, 792CBA64h 0x00000045 mov edi, 45D07DB3h 0x0000004a push eax 0x0000004b pushad 0x0000004c push eax 0x0000004d push edx 0x0000004e jmp 00007F4D4CB41C4Bh 0x00000053 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E27EA3 second address: E27EA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E270A0 second address: E270A6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E28EA1 second address: E28EB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop ebx 0x00000006 push eax 0x00000007 pushad 0x00000008 ja 00007F4D4CB43A28h 0x0000000e jl 00007F4D4CB43A2Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E2B63D second address: E2B660 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jns 00007F4D4CB41C4Ch 0x0000000d popad 0x0000000e push eax 0x0000000f jc 00007F4D4CB41C58h 0x00000015 push eax 0x00000016 push edx 0x00000017 je 00007F4D4CB41C46h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E29131 second address: E29136 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E2B660 second address: E2B6B5 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F4D4CB41C46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007F4D4CB41C48h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 00000015h 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 or bx, 828Eh 0x0000002a mov dword ptr [ebp+1247E3B2h], ecx 0x00000030 push 00000000h 0x00000032 mov bl, 4Ch 0x00000034 push 00000000h 0x00000036 movzx edi, di 0x00000039 push eax 0x0000003a pushad 0x0000003b jmp 00007F4D4CB41C54h 0x00000040 push ecx 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E29136 second address: E2913C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E2913C second address: E29165 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4D4CB41C46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007F4D4CB41C56h 0x00000013 pushad 0x00000014 push edi 0x00000015 pop edi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E2FC38 second address: E2FC7C instructions: 0x00000000 rdtsc 0x00000002 jl 00007F4D4CB43A2Ch 0x00000008 jno 00007F4D4CB43A26h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 mov edi, 4795E1C9h 0x00000018 push 00000000h 0x0000001a pushad 0x0000001b mov bx, di 0x0000001e mov dword ptr [ebp+122D1CB5h], eax 0x00000024 popad 0x00000025 push 00000000h 0x00000027 call 00007F4D4CB43A2Bh 0x0000002c mov bl, 16h 0x0000002e pop ebx 0x0000002f xchg eax, esi 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 jmp 00007F4D4CB43A2Ah 0x00000038 pop eax 0x00000039 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E2FC7C second address: E2FC82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E2FC82 second address: E2FC86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E2FC86 second address: E2FC8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E31B1C second address: E31B20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E31B20 second address: E31B24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E31B24 second address: E31B38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 pushad 0x00000009 jp 00007F4D4CB43A28h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E31BCA second address: E31BD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E2EDD6 second address: E2EDDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E2FDC5 second address: E2FDCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E30EF9 second address: E30EFF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E2FDCB second address: E2FDE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 pushad 0x00000008 jns 00007F4D4CB41C4Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E32C3B second address: E32C4E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 je 00007F4D4CB43A30h 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E30EFF second address: E30F06 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E2FDE3 second address: E2FDE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E30F06 second address: E30F13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E33C0D second address: E33C11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E33C11 second address: E33C27 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C4Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E33C27 second address: E33C8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007F4D4CB43A28h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 00000017h 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 movzx ebx, si 0x00000026 push 00000000h 0x00000028 mov edi, dword ptr [ebp+12480F75h] 0x0000002e push 00000000h 0x00000030 jmp 00007F4D4CB43A37h 0x00000035 push eax 0x00000036 push eax 0x00000037 push edx 0x00000038 ja 00007F4D4CB43A39h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E34C49 second address: E34C80 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C52h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a jne 00007F4D4CB41C46h 0x00000010 pop ecx 0x00000011 popad 0x00000012 push eax 0x00000013 pushad 0x00000014 pushad 0x00000015 jmp 00007F4D4CB41C53h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E33EAF second address: E33EB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E34E20 second address: E34E28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E35F25 second address: E35F2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E3D915 second address: E3D921 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 je 00007F4D4CB41C46h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E3D921 second address: E3D93B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f je 00007F4D4CB43A26h 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E3DC73 second address: E3DC9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4D4CB41C59h 0x00000008 pushad 0x00000009 popad 0x0000000a push esi 0x0000000b pop esi 0x0000000c push edx 0x0000000d pop edx 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jo 00007F4D4CB41C46h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E3DC9E second address: E3DCA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E3DDD3 second address: E3DDD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E3DDD9 second address: E3DDDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E3DDDE second address: E3DE08 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edx 0x00000006 jl 00007F4D4CB41C4Eh 0x0000000c jg 00007F4D4CB41C46h 0x00000012 pushad 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 jmp 00007F4D4CB41C4Fh 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E4485A second address: E448B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jmp 00007F4D4CB43A2Ah 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f pushad 0x00000010 jmp 00007F4D4CB43A30h 0x00000015 jmp 00007F4D4CB43A36h 0x0000001a popad 0x0000001b mov eax, dword ptr [eax] 0x0000001d jmp 00007F4D4CB43A2Ch 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 push eax 0x00000027 push edx 0x00000028 push esi 0x00000029 jbe 00007F4D4CB43A26h 0x0000002f pop esi 0x00000030 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E44968 second address: E4499B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edx 0x00000006 jmp 00007F4D4CB41C55h 0x0000000b pop edx 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F4D4CB41C53h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E4499B second address: E449B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E449B9 second address: E449BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E449BD second address: E449EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 jnp 00007F4D4CB43A3Ah 0x0000000f jmp 00007F4D4CB43A34h 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jp 00007F4D4CB43A26h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E449EE second address: E449FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E449FD second address: E44A02 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E4A7D5 second address: E4A7DF instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F4D4CB41C46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E4AADB second address: E4AAE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E4AC3D second address: E4AC5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F4D4CB41C56h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E4AC5B second address: E4AC5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E4B18E second address: E4B196 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E4B331 second address: E4B337 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E4B337 second address: E4B33C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E4B33C second address: E4B347 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 js 00007F4D4CB43A26h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E54D2A second address: E54D34 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4D4CB41C46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E54D34 second address: E54D49 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4D4CB43A2Eh 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E54D49 second address: E54D58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnp 00007F4D4CB41C46h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E54D58 second address: E54D5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E53AF9 second address: E53B04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E20B17 second address: E20B39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 nop 0x00000005 mov dword ptr [ebp+12450C88h], esi 0x0000000b lea eax, dword ptr [ebp+124888C6h] 0x00000011 mov ecx, dword ptr [ebp+122D2789h] 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jnl 00007F4D4CB43A28h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E20B39 second address: E0172B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4D4CB41C48h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007F4D4CB41C48h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 0000001Ch 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 adc di, 01E1h 0x0000002c call dword ptr [ebp+12456A9Dh] 0x00000032 jns 00007F4D4CB41C66h 0x00000038 jmp 00007F4D4CB41C4Dh 0x0000003d push esi 0x0000003e jmp 00007F4D4CB41C51h 0x00000043 pop esi 0x00000044 push eax 0x00000045 push edx 0x00000046 push edi 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E20C35 second address: E20C3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F4D4CB43A26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E20C3F second address: E20C60 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d pop eax 0x0000000e jmp 00007F4D4CB41C52h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E20C60 second address: E20C66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E20C66 second address: E20C6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E20FDF second address: E20FE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E2109B second address: E210D8 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4D4CB41C46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F4D4CB41C56h 0x0000000f popad 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F4D4CB41C55h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E210D8 second address: E210DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E2124E second address: E21264 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F4D4CB41C4Fh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E21264 second address: E212BD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, esi 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007F4D4CB43A28h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 0000001Dh 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 push ebx 0x00000023 pop ecx 0x00000024 jmp 00007F4D4CB43A2Bh 0x00000029 nop 0x0000002a jmp 00007F4D4CB43A37h 0x0000002f push eax 0x00000030 push eax 0x00000031 push edx 0x00000032 push edx 0x00000033 push ebx 0x00000034 pop ebx 0x00000035 pop edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E21601 second address: E21614 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C4Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E21614 second address: E21694 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4D4CB43A28h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d jmp 00007F4D4CB43A39h 0x00000012 sub dword ptr [ebp+122D1AA3h], esi 0x00000018 push 00000004h 0x0000001a push 00000000h 0x0000001c push eax 0x0000001d call 00007F4D4CB43A28h 0x00000022 pop eax 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 add dword ptr [esp+04h], 00000019h 0x0000002f inc eax 0x00000030 push eax 0x00000031 ret 0x00000032 pop eax 0x00000033 ret 0x00000034 nop 0x00000035 pushad 0x00000036 push edi 0x00000037 jmp 00007F4D4CB43A37h 0x0000003c pop edi 0x0000003d jmp 00007F4D4CB43A30h 0x00000042 popad 0x00000043 push eax 0x00000044 pushad 0x00000045 push eax 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E21A8B second address: E21ABE instructions: 0x00000000 rdtsc 0x00000002 je 00007F4D4CB41C4Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b jg 00007F4D4CB41C4Ch 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 push 0000001Eh 0x00000019 jc 00007F4D4CB41C49h 0x0000001f movsx edi, di 0x00000022 push eax 0x00000023 jc 00007F4D4CB41C54h 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c pop eax 0x0000002d rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E21E34 second address: E21E3E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E21E3E second address: E21E42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E21E42 second address: E21E50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E21E50 second address: E21E54 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E21E54 second address: E21E5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E21E5A second address: E02274 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F4D4CB41C4Fh 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007F4D4CB41C48h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 00000018h 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 mov ch, 75h 0x00000028 jnl 00007F4D4CB41C65h 0x0000002e call dword ptr [ebp+122D33B9h] 0x00000034 pushad 0x00000035 jmp 00007F4D4CB41C4Bh 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E02274 second address: E0227A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E0227A second address: E0227E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E53DA9 second address: E53DAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E53DAD second address: E53DDA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4D4CB41C59h 0x0000000b pop ecx 0x0000000c pushad 0x0000000d jng 00007F4D4CB41C48h 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E53DDA second address: E53DE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E540F4 second address: E540FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E540FA second address: E54105 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E54105 second address: E5410B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E5410B second address: E54111 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E54281 second address: E54299 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4D4CB41C54h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E54403 second address: E5442C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 jnp 00007F4D4CB43A26h 0x0000000f jmp 00007F4D4CB43A39h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E5442C second address: E54431 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E545A3 second address: E545B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F4D4CB43A2Ch 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E545B4 second address: E545EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C4Fh 0x00000007 jbe 00007F4D4CB41C48h 0x0000000d push esi 0x0000000e pop esi 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jnp 00007F4D4CB41C46h 0x0000001a pushad 0x0000001b popad 0x0000001c jmp 00007F4D4CB41C50h 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E5ECDD second address: E5ECE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jno 00007F4D4CB43A26h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E5D91F second address: E5D924 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E5D924 second address: E5D944 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F4D4CB43A38h 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E5D944 second address: E5D948 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E5D948 second address: E5D94C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E5DD40 second address: E5DD45 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E5D4F9 second address: E5D52F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A30h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F4D4CB43A32h 0x0000000f pushad 0x00000010 js 00007F4D4CB43A26h 0x00000016 je 00007F4D4CB43A26h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E64AA3 second address: E64ACA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jg 00007F4D4CB41C46h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E64ACA second address: E64ACE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E63856 second address: E6385A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E6385A second address: E6386E instructions: 0x00000000 rdtsc 0x00000002 jc 00007F4D4CB43A26h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E634FF second address: E63513 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F4D4CB41C4Ah 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E63513 second address: E63523 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 jnp 00007F4D4CB43A6Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E63523 second address: E63535 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4D4CB41C4Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E63535 second address: E63551 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A32h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E64277 second address: E64283 instructions: 0x00000000 rdtsc 0x00000002 js 00007F4D4CB41C46h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E64283 second address: E6428D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F4D4CB43A26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E67597 second address: E6759B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E6A06E second address: E6A074 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E6A074 second address: E6A078 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E6A078 second address: E6A081 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E6C4F4 second address: E6C4FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E6C4FD second address: E6C501 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E721E9 second address: E721EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E721EF second address: E721F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E721F3 second address: E7221F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F4D4CB41C46h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F4D4CB41C4Dh 0x00000012 push edx 0x00000013 pop edx 0x00000014 popad 0x00000015 pushad 0x00000016 jc 00007F4D4CB41C46h 0x0000001c jp 00007F4D4CB41C46h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E70ACA second address: E70ADA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jo 00007F4D4CB43A26h 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E70ADA second address: E70AF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4D4CB41C4Bh 0x00000009 jmp 00007F4D4CB41C4Dh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E70AF8 second address: E70B0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push esi 0x00000007 push eax 0x00000008 jnp 00007F4D4CB43A26h 0x0000000e pushad 0x0000000f popad 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E70B0D second address: E70B11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E70C74 second address: E70C9C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A2Bh 0x00000007 jmp 00007F4D4CB43A35h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edx 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E70E0D second address: E70E13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E70E13 second address: E70E17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E70E17 second address: E70E2B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007F4D4CB41C46h 0x0000000e ja 00007F4D4CB41C46h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E70F72 second address: E70F7A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E70F7A second address: E70F7F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E70F7F second address: E70F85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E70F85 second address: E70F8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E21A7C second address: E21A8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jl 00007F4D4CB43A28h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E21A95 second address: E21ABE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 jg 00007F4D4CB41C4Ch 0x0000000d push 0000001Eh 0x0000000f jc 00007F4D4CB41C49h 0x00000015 movsx edi, di 0x00000018 push eax 0x00000019 jc 00007F4D4CB41C54h 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 pop eax 0x00000023 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E7149E second address: E714A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E756F8 second address: E756FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E756FD second address: E7570B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F4D4CB43A26h 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E75AD1 second address: E75AD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E75AD6 second address: E75AF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F4D4CB43A34h 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jno 00007F4D4CB43A26h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E75AF8 second address: E75B41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C4Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e jmp 00007F4D4CB41C4Bh 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 pop esi 0x00000016 pushad 0x00000017 push esi 0x00000018 pop esi 0x00000019 jmp 00007F4D4CB41C57h 0x0000001e jns 00007F4D4CB41C46h 0x00000024 push ecx 0x00000025 pop ecx 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E75DF1 second address: E75E12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F4D4CB43A26h 0x0000000a jmp 00007F4D4CB43A35h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E75E12 second address: E75E2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 jmp 00007F4D4CB41C50h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E75E2C second address: E75E33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E79FD6 second address: E79FDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E79718 second address: E79722 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4D4CB43A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E79722 second address: E79740 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C54h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E79740 second address: E7974C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007F4D4CB43A26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E79A4F second address: E79A74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4D4CB41C58h 0x00000009 pop edx 0x0000000a jng 00007F4D4CB41C4Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E79A74 second address: E79A7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E79A7C second address: E79A86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F4D4CB41C46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E8093F second address: E80943 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E81F5D second address: E81F86 instructions: 0x00000000 rdtsc 0x00000002 js 00007F4D4CB41C46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jns 00007F4D4CB41C46h 0x00000011 jmp 00007F4D4CB41C56h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E81F86 second address: E81FAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F4D4CB43A39h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E81FAA second address: E81FAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E83E5C second address: E83E64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E89EBD second address: E89ECF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F4D4CB41C46h 0x0000000a push eax 0x0000000b push edx 0x0000000c jp 00007F4D4CB41C46h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E89ECF second address: E89EDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jns 00007F4D4CB43A26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E89EDB second address: E89EF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F4D4CB41C56h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E8D23E second address: E8D250 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4D4CB43A2Dh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E8D250 second address: E8D263 instructions: 0x00000000 rdtsc 0x00000002 js 00007F4D4CB41C4Eh 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E8D263 second address: E8D269 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E8D3D3 second address: E8D413 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F4D4CB41C4Ch 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e push edi 0x0000000f jmp 00007F4D4CB41C4Ch 0x00000014 pop edi 0x00000015 push eax 0x00000016 push edx 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 jmp 00007F4D4CB41C59h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E8D576 second address: E8D58F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F4D4CB43A30h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E8D6CA second address: E8D6D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F4D4CB41C46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E96F4F second address: E96F53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E94FFD second address: E95002 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E95002 second address: E9501F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4D4CB43A38h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E9501F second address: E95044 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F4D4CB41C50h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jg 00007F4D4CB41C46h 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E95044 second address: E95050 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jnc 00007F4D4CB43A26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E95050 second address: E95055 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E951CE second address: E951D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E951D2 second address: E951F7 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F4D4CB41C46h 0x00000008 jmp 00007F4D4CB41C57h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E951F7 second address: E951FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E951FB second address: E9520A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E9520A second address: E9520E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E9520E second address: E95218 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E95218 second address: E9521C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E9521C second address: E95222 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E95222 second address: E95240 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A32h 0x00000007 je 00007F4D4CB43A2Eh 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E958A2 second address: E958AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E958AA second address: E958AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E95A39 second address: E95A3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E95A3D second address: E95A54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4D4CB43A2Eh 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E96692 second address: E96696 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: E96696 second address: E966A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: EA991C second address: EA992A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: EA992A second address: EA992E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: EA9A7B second address: EA9A81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: EAE6A2 second address: EAE6E0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A34h 0x00000007 push edi 0x00000008 jnl 00007F4D4CB43A26h 0x0000000e pop edi 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 push edi 0x00000013 jmp 00007F4D4CB43A31h 0x00000018 pushad 0x00000019 popad 0x0000001a pop edi 0x0000001b je 00007F4D4CB43A2Ch 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: EAE7F4 second address: EAE7FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: EAE7FA second address: EAE808 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F4D4CB43A26h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: EAE808 second address: EAE837 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4D4CB41C4Fh 0x00000009 popad 0x0000000a pop ecx 0x0000000b push ebx 0x0000000c js 00007F4D4CB41C55h 0x00000012 jmp 00007F4D4CB41C4Fh 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: EAE837 second address: EAE83B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: EB0468 second address: EB046C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: EB046C second address: EB0470 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: EB72C4 second address: EB72DE instructions: 0x00000000 rdtsc 0x00000002 jo 00007F4D4CB41C46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jc 00007F4D4CB41C46h 0x00000011 push edx 0x00000012 pop edx 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: EBCB1E second address: EBCB3C instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F4D4CB43A26h 0x00000008 jmp 00007F4D4CB43A2Dh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: EC117F second address: EC1183 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: EC90B6 second address: EC90BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: EC90BE second address: EC90DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C54h 0x00000007 jg 00007F4D4CB41C52h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: EC9228 second address: EC924E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F4D4CB43A26h 0x0000000a jno 00007F4D4CB43A26h 0x00000010 popad 0x00000011 jmp 00007F4D4CB43A35h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: EC924E second address: EC9258 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F4D4CB41C46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: EC93B4 second address: EC93BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: EC93BF second address: EC93C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: EC94E3 second address: EC9500 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F4D4CB43A33h 0x0000000b popad 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: EC9500 second address: EC950A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: EC950A second address: EC951F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F4D4CB43A26h 0x0000000a popad 0x0000000b popad 0x0000000c push edx 0x0000000d jc 00007F4D4CB43A2Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: ECDCBD second address: ECDCD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4D4CB41C55h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: ECDCD9 second address: ECDCE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F4D4CB43A2Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: F0BEDB second address: F0BEE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: F0BEE1 second address: F0BEE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: F1AD61 second address: F1AD67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: F1C4E6 second address: F1C4EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: F1FA26 second address: F1FA35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 jo 00007F4D4CB41C52h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: F1FA35 second address: F1FA3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: F1FA3B second address: F1FA3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: F1FA3F second address: F1FA45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: F1FBC1 second address: F1FBE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4D4CB41C56h 0x00000009 popad 0x0000000a pushad 0x0000000b js 00007F4D4CB41C46h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: F1FBE5 second address: F1FC02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F4D4CB43A26h 0x0000000a jmp 00007F4D4CB43A32h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: F1FC02 second address: F1FC2C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jnl 00007F4D4CB41C46h 0x00000009 jmp 00007F4D4CB41C52h 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 jc 00007F4D4CB41C46h 0x00000017 jne 00007F4D4CB41C46h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: F24B0E second address: F24B12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: FE83B4 second address: FE83ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C53h 0x00000007 jmp 00007F4D4CB41C53h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jc 00007F4D4CB41C4Ch 0x00000014 jnp 00007F4D4CB41C46h 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: FE83ED second address: FE8403 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4D4CB43A30h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: FE8403 second address: FE8428 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4D4CB41C54h 0x00000009 popad 0x0000000a popad 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007F4D4CB41C46h 0x00000014 push esi 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: FE8428 second address: FE842C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: FE8576 second address: FE8580 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F4D4CB41C46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: FE8580 second address: FE858A instructions: 0x00000000 rdtsc 0x00000002 jns 00007F4D4CB43A26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: FE858A second address: FE8598 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F4D4CB41C4Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: FE86E3 second address: FE86F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: FE8CB9 second address: FE8CDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 jo 00007F4D4CB41C5Ah 0x0000000d jmp 00007F4D4CB41C54h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: FED46F second address: FED486 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F4D4CB43A2Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: FED6EC second address: FED6F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: FED6F0 second address: FED75A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A36h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007F4D4CB43A28h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 00000017h 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 mov dx, 325Bh 0x0000002a push 00000004h 0x0000002c call 00007F4D4CB43A37h 0x00000031 mov edx, dword ptr [ebp+122D28CAh] 0x00000037 pop edx 0x00000038 push 586BD477h 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 push esi 0x00000041 pop esi 0x00000042 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: FED75A second address: FED764 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 730013C second address: 7300158 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4D4CB43A38h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7300158 second address: 730016E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov edi, eax 0x0000000c mov edi, ecx 0x0000000e popad 0x0000000f xchg eax, ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 730016E second address: 7300172 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7300172 second address: 7300178 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7300178 second address: 7300208 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A36h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebx, dword ptr [eax+10h] 0x0000000c jmp 00007F4D4CB43A30h 0x00000011 xchg eax, esi 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F4D4CB43A2Eh 0x00000019 add ecx, 28A289D8h 0x0000001f jmp 00007F4D4CB43A2Bh 0x00000024 popfd 0x00000025 pushfd 0x00000026 jmp 00007F4D4CB43A38h 0x0000002b and ah, 00000038h 0x0000002e jmp 00007F4D4CB43A2Bh 0x00000033 popfd 0x00000034 popad 0x00000035 push eax 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007F4D4CB43A34h 0x0000003d rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7300208 second address: 730024D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a jmp 00007F4D4CB41C56h 0x0000000f mov esi, dword ptr [756006ECh] 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F4D4CB41C57h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 730024D second address: 7300252 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7300252 second address: 7300291 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b jmp 00007F4D4CB41C57h 0x00000010 jne 00007F4D4CB42A02h 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F4D4CB41C55h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7300291 second address: 7300297 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7300297 second address: 730029B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 730029B second address: 730029F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 730029F second address: 7300312 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 jmp 00007F4D4CB41C54h 0x0000000e mov dword ptr [esp], edi 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F4D4CB41C4Eh 0x00000018 add si, 0278h 0x0000001d jmp 00007F4D4CB41C4Bh 0x00000022 popfd 0x00000023 push esi 0x00000024 mov dx, 009Ah 0x00000028 pop ebx 0x00000029 popad 0x0000002a call dword ptr [755D0B60h] 0x00000030 mov eax, 7696E5E0h 0x00000035 ret 0x00000036 jmp 00007F4D4CB41C4Eh 0x0000003b push 00000044h 0x0000003d pushad 0x0000003e push ecx 0x0000003f mov edi, 0C89AEF0h 0x00000044 pop edx 0x00000045 mov eax, 189CC625h 0x0000004a popad 0x0000004b pop edi 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 popad 0x00000052 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7300312 second address: 7300316 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7300316 second address: 730031C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 730031C second address: 7300322 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7300322 second address: 7300346 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, edi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F4D4CB41C59h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7300346 second address: 730036C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F4D4CB43A2Ah 0x00000012 push eax 0x00000013 pop edi 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 730036C second address: 73003B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C57h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F4D4CB41C54h 0x00000011 adc cx, 1588h 0x00000016 jmp 00007F4D4CB41C4Bh 0x0000001b popfd 0x0000001c push eax 0x0000001d push edx 0x0000001e mov cx, D615h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 73003B5 second address: 73003D4 instructions: 0x00000000 rdtsc 0x00000002 mov dx, cx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 push dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4D4CB43A33h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 73003D4 second address: 73003EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4D4CB41C54h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 73004D8 second address: 73004DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 73004DE second address: 73004FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, cx 0x00000006 mov cx, 061Bh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esi], edi 0x0000000f pushad 0x00000010 mov si, 1D93h 0x00000014 mov dx, si 0x00000017 popad 0x00000018 mov dword ptr [esi+04h], eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 73004FF second address: 7300503 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7300503 second address: 7300509 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7300509 second address: 730050E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 730050E second address: 7300524 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edi, ecx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+08h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push ebx 0x00000010 pop esi 0x00000011 mov dx, DD48h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7300524 second address: 73005B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A2Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+0Ch], eax 0x0000000c pushad 0x0000000d mov esi, 40EBFB8Dh 0x00000012 jmp 00007F4D4CB43A2Ah 0x00000017 popad 0x00000018 mov eax, dword ptr [ebx+4Ch] 0x0000001b jmp 00007F4D4CB43A30h 0x00000020 mov dword ptr [esi+10h], eax 0x00000023 pushad 0x00000024 pushfd 0x00000025 jmp 00007F4D4CB43A2Eh 0x0000002a add cx, 1208h 0x0000002f jmp 00007F4D4CB43A2Bh 0x00000034 popfd 0x00000035 pushfd 0x00000036 jmp 00007F4D4CB43A38h 0x0000003b xor ch, 00000068h 0x0000003e jmp 00007F4D4CB43A2Bh 0x00000043 popfd 0x00000044 popad 0x00000045 mov eax, dword ptr [ebx+50h] 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b mov cx, di 0x0000004e movsx edx, ax 0x00000051 popad 0x00000052 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 73005B7 second address: 7300636 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4D4CB41C4Fh 0x00000009 and cx, 885Eh 0x0000000e jmp 00007F4D4CB41C59h 0x00000013 popfd 0x00000014 mov cx, 8127h 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b mov dword ptr [esi+14h], eax 0x0000001e jmp 00007F4D4CB41C4Ah 0x00000023 mov eax, dword ptr [ebx+54h] 0x00000026 pushad 0x00000027 mov bl, ah 0x00000029 push eax 0x0000002a push edx 0x0000002b pushfd 0x0000002c jmp 00007F4D4CB41C59h 0x00000031 or ax, 17F6h 0x00000036 jmp 00007F4D4CB41C51h 0x0000003b popfd 0x0000003c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7300636 second address: 730065B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esi+18h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4D4CB43A39h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 730065B second address: 7300677 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+58h] 0x0000000c pushad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7300677 second address: 730069E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F4D4CB43A34h 0x0000000a popad 0x0000000b mov dword ptr [esi+1Ch], eax 0x0000000e pushad 0x0000000f mov si, 4B6Dh 0x00000013 push eax 0x00000014 push edx 0x00000015 mov di, cx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 730069E second address: 73006D5 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 642ADAABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [ebx+5Ch] 0x0000000d jmp 00007F4D4CB41C4Eh 0x00000012 mov dword ptr [esi+20h], eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F4D4CB41C57h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 73006D5 second address: 73006DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 73006DB second address: 73006DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 73006DF second address: 73006E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 73006E3 second address: 73006F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebx+60h] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov bl, al 0x00000010 mov esi, edi 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 73006F6 second address: 7300724 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A2Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+24h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4D4CB43A37h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7300724 second address: 730075E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebx+64h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f call 00007F4D4CB41C53h 0x00000014 pop ecx 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 730075E second address: 730076D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4D4CB43A2Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 730076D second address: 73007C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esi+28h], eax 0x0000000e jmp 00007F4D4CB41C4Eh 0x00000013 mov eax, dword ptr [ebx+68h] 0x00000016 jmp 00007F4D4CB41C50h 0x0000001b mov dword ptr [esi+2Ch], eax 0x0000001e pushad 0x0000001f mov esi, 612C6FFDh 0x00000024 movzx esi, dx 0x00000027 popad 0x00000028 mov ax, word ptr [ebx+6Ch] 0x0000002c pushad 0x0000002d push eax 0x0000002e push edx 0x0000002f mov ecx, edi 0x00000031 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 73007C6 second address: 73008EE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F4D4CB43A39h 0x0000000c add ecx, 1F67C876h 0x00000012 jmp 00007F4D4CB43A31h 0x00000017 popfd 0x00000018 popad 0x00000019 mov word ptr [esi+30h], ax 0x0000001d jmp 00007F4D4CB43A2Eh 0x00000022 mov ax, word ptr [ebx+00000088h] 0x00000029 jmp 00007F4D4CB43A30h 0x0000002e mov word ptr [esi+32h], ax 0x00000032 pushad 0x00000033 pushfd 0x00000034 jmp 00007F4D4CB43A2Eh 0x00000039 or ch, FFFFFFF8h 0x0000003c jmp 00007F4D4CB43A2Bh 0x00000041 popfd 0x00000042 mov ch, F9h 0x00000044 popad 0x00000045 mov eax, dword ptr [ebx+0000008Ch] 0x0000004b jmp 00007F4D4CB43A2Bh 0x00000050 mov dword ptr [esi+34h], eax 0x00000053 jmp 00007F4D4CB43A36h 0x00000058 mov eax, dword ptr [ebx+18h] 0x0000005b jmp 00007F4D4CB43A30h 0x00000060 mov dword ptr [esi+38h], eax 0x00000063 jmp 00007F4D4CB43A30h 0x00000068 mov eax, dword ptr [ebx+1Ch] 0x0000006b pushad 0x0000006c mov edx, eax 0x0000006e mov bx, cx 0x00000071 popad 0x00000072 mov dword ptr [esi+3Ch], eax 0x00000075 jmp 00007F4D4CB43A34h 0x0000007a mov eax, dword ptr [ebx+20h] 0x0000007d jmp 00007F4D4CB43A30h 0x00000082 mov dword ptr [esi+40h], eax 0x00000085 push eax 0x00000086 push edx 0x00000087 jmp 00007F4D4CB43A37h 0x0000008c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 73008EE second address: 73008F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 73008F4 second address: 7300913 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b lea eax, dword ptr [ebx+00000080h] 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 mov dh, 6Ch 0x00000016 push eax 0x00000017 pop edi 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7300913 second address: 7300919 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7300919 second address: 730091D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 730091D second address: 73009C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push 00000001h 0x0000000d jmp 00007F4D4CB41C56h 0x00000012 nop 0x00000013 jmp 00007F4D4CB41C50h 0x00000018 push eax 0x00000019 pushad 0x0000001a mov dx, 5074h 0x0000001e pushfd 0x0000001f jmp 00007F4D4CB41C4Dh 0x00000024 jmp 00007F4D4CB41C4Bh 0x00000029 popfd 0x0000002a popad 0x0000002b nop 0x0000002c pushad 0x0000002d pushfd 0x0000002e jmp 00007F4D4CB41C54h 0x00000033 sub si, 4558h 0x00000038 jmp 00007F4D4CB41C4Bh 0x0000003d popfd 0x0000003e mov di, si 0x00000041 popad 0x00000042 lea eax, dword ptr [ebp-10h] 0x00000045 jmp 00007F4D4CB41C52h 0x0000004a nop 0x0000004b push eax 0x0000004c push edx 0x0000004d pushad 0x0000004e mov esi, edi 0x00000050 mov dx, 86FCh 0x00000054 popad 0x00000055 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 73009C4 second address: 73009CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 73009CA second address: 73009CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7300A13 second address: 7300ABE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, eax 0x0000000b jmp 00007F4D4CB43A2Eh 0x00000010 test edi, edi 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F4D4CB43A2Eh 0x00000019 sbb si, 5938h 0x0000001e jmp 00007F4D4CB43A2Bh 0x00000023 popfd 0x00000024 pushfd 0x00000025 jmp 00007F4D4CB43A38h 0x0000002a adc si, D398h 0x0000002f jmp 00007F4D4CB43A2Bh 0x00000034 popfd 0x00000035 popad 0x00000036 js 00007F4DBADC2663h 0x0000003c jmp 00007F4D4CB43A36h 0x00000041 mov eax, dword ptr [ebp-0Ch] 0x00000044 push eax 0x00000045 push edx 0x00000046 jmp 00007F4D4CB43A37h 0x0000004b rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7300ABE second address: 7300AD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4D4CB41C54h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7300AD6 second address: 7300ADA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7300ADA second address: 7300AF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esi+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4D4CB41C4Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7300AF1 second address: 7300BD6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4D4CB43A31h 0x00000009 or cx, 96A6h 0x0000000e jmp 00007F4D4CB43A31h 0x00000013 popfd 0x00000014 mov ch, D9h 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 lea eax, dword ptr [ebx+78h] 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007F4D4CB43A39h 0x00000023 sbb ah, FFFFFFB6h 0x00000026 jmp 00007F4D4CB43A31h 0x0000002b popfd 0x0000002c pushfd 0x0000002d jmp 00007F4D4CB43A30h 0x00000032 sub eax, 5ADF21D8h 0x00000038 jmp 00007F4D4CB43A2Bh 0x0000003d popfd 0x0000003e popad 0x0000003f push 00000001h 0x00000041 jmp 00007F4D4CB43A36h 0x00000046 nop 0x00000047 jmp 00007F4D4CB43A30h 0x0000004c push eax 0x0000004d jmp 00007F4D4CB43A2Bh 0x00000052 nop 0x00000053 jmp 00007F4D4CB43A36h 0x00000058 lea eax, dword ptr [ebp-08h] 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e push edx 0x0000005f jmp 00007F4D4CB43A2Ah 0x00000064 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7300BD6 second address: 7300BDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7300BDA second address: 7300BE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7300BE0 second address: 7300C0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C4Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4D4CB41C57h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7300C59 second address: 7300CE6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A32h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, eax 0x0000000b pushad 0x0000000c mov cl, 25h 0x0000000e mov cl, dh 0x00000010 popad 0x00000011 test edi, edi 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F4D4CB43A30h 0x0000001a adc eax, 596CB4D8h 0x00000020 jmp 00007F4D4CB43A2Bh 0x00000025 popfd 0x00000026 pushfd 0x00000027 jmp 00007F4D4CB43A38h 0x0000002c xor esi, 38E37F38h 0x00000032 jmp 00007F4D4CB43A2Bh 0x00000037 popfd 0x00000038 popad 0x00000039 js 00007F4DBADC2416h 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007F4D4CB43A35h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7300CE6 second address: 7300D04 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebp-04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7300D04 second address: 7300D08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7300D08 second address: 7300D0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7300D0E second address: 7300D91 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, ecx 0x00000005 pushfd 0x00000006 jmp 00007F4D4CB43A2Ch 0x0000000b add cl, 00000028h 0x0000000e jmp 00007F4D4CB43A2Bh 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov dword ptr [esi+08h], eax 0x0000001a pushad 0x0000001b mov si, C73Bh 0x0000001f mov dx, si 0x00000022 popad 0x00000023 lea eax, dword ptr [ebx+70h] 0x00000026 pushad 0x00000027 mov edx, eax 0x00000029 pushad 0x0000002a mov ah, 83h 0x0000002c push edx 0x0000002d pop esi 0x0000002e popad 0x0000002f popad 0x00000030 push 00000001h 0x00000032 jmp 00007F4D4CB43A39h 0x00000037 nop 0x00000038 pushad 0x00000039 mov bh, ch 0x0000003b popad 0x0000003c push eax 0x0000003d jmp 00007F4D4CB43A35h 0x00000042 nop 0x00000043 push eax 0x00000044 push edx 0x00000045 jmp 00007F4D4CB43A2Dh 0x0000004a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7300E92 second address: 7300ED7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007F4DBADC044Eh 0x0000000f jmp 00007F4D4CB41C4Eh 0x00000014 mov eax, dword ptr [ebp-14h] 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F4D4CB41C57h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7300ED7 second address: 7300EFC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7300EFC second address: 7300F00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7300F00 second address: 7300F04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7300F04 second address: 7300F0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7300F0A second address: 7300FD2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A32h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esi+0Ch], eax 0x0000000c pushad 0x0000000d pushad 0x0000000e movzx eax, dx 0x00000011 mov cx, bx 0x00000014 popad 0x00000015 mov si, di 0x00000018 popad 0x00000019 mov edx, 756006ECh 0x0000001e jmp 00007F4D4CB43A37h 0x00000023 sub eax, eax 0x00000025 pushad 0x00000026 mov di, 49F8h 0x0000002a pushfd 0x0000002b jmp 00007F4D4CB43A31h 0x00000030 or cx, BFE6h 0x00000035 jmp 00007F4D4CB43A31h 0x0000003a popfd 0x0000003b popad 0x0000003c lock cmpxchg dword ptr [edx], ecx 0x00000040 pushad 0x00000041 pushfd 0x00000042 jmp 00007F4D4CB43A33h 0x00000047 xor eax, 22F31B1Eh 0x0000004d jmp 00007F4D4CB43A39h 0x00000052 popfd 0x00000053 popad 0x00000054 pop edi 0x00000055 push eax 0x00000056 push edx 0x00000057 pushad 0x00000058 call 00007F4D4CB43A33h 0x0000005d pop ecx 0x0000005e mov cl, bl 0x00000060 popad 0x00000061 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7301110 second address: 730117B instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F4D4CB41C4Ch 0x00000008 add cx, 00D8h 0x0000000d jmp 00007F4D4CB41C4Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 mov dword ptr [edx+0Ch], eax 0x00000019 jmp 00007F4D4CB41C56h 0x0000001e mov eax, dword ptr [esi+10h] 0x00000021 jmp 00007F4D4CB41C50h 0x00000026 mov dword ptr [edx+10h], eax 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F4D4CB41C57h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 730117B second address: 73011BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop eax 0x00000005 pushfd 0x00000006 jmp 00007F4D4CB43A2Bh 0x0000000b sub ch, 0000005Eh 0x0000000e jmp 00007F4D4CB43A39h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov eax, dword ptr [esi+14h] 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F4D4CB43A2Dh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 73011BE second address: 7301203 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+14h], eax 0x0000000c pushad 0x0000000d mov ebx, esi 0x0000000f jmp 00007F4D4CB41C58h 0x00000014 popad 0x00000015 mov eax, dword ptr [esi+18h] 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F4D4CB41C4Ah 0x00000021 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7301203 second address: 7301207 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7301207 second address: 730120D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 730120D second address: 730126F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A2Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+18h], eax 0x0000000c pushad 0x0000000d movzx esi, di 0x00000010 movsx edi, ax 0x00000013 popad 0x00000014 mov eax, dword ptr [esi+1Ch] 0x00000017 jmp 00007F4D4CB43A32h 0x0000001c mov dword ptr [edx+1Ch], eax 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007F4D4CB43A2Dh 0x00000028 xor si, AA16h 0x0000002d jmp 00007F4D4CB43A31h 0x00000032 popfd 0x00000033 mov si, 4C87h 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 730126F second address: 7301275 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7301275 second address: 7301279 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7301279 second address: 73012BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esi+20h] 0x0000000b jmp 00007F4D4CB41C4Bh 0x00000010 mov dword ptr [edx+20h], eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 call 00007F4D4CB41C4Bh 0x0000001b pop ecx 0x0000001c jmp 00007F4D4CB41C59h 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 73012BB second address: 73012E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esi+24h] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4D4CB43A2Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 73012E2 second address: 73013A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F4D4CB41C57h 0x00000008 pop esi 0x00000009 pushfd 0x0000000a jmp 00007F4D4CB41C59h 0x0000000f sbb cx, D0F6h 0x00000014 jmp 00007F4D4CB41C51h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d mov dword ptr [edx+24h], eax 0x00000020 pushad 0x00000021 pushfd 0x00000022 jmp 00007F4D4CB41C4Ch 0x00000027 add cl, 00000018h 0x0000002a jmp 00007F4D4CB41C4Bh 0x0000002f popfd 0x00000030 movzx ecx, dx 0x00000033 popad 0x00000034 mov eax, dword ptr [esi+28h] 0x00000037 jmp 00007F4D4CB41C4Bh 0x0000003c mov dword ptr [edx+28h], eax 0x0000003f jmp 00007F4D4CB41C56h 0x00000044 mov ecx, dword ptr [esi+2Ch] 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a pushfd 0x0000004b jmp 00007F4D4CB41C4Dh 0x00000050 add ax, F516h 0x00000055 jmp 00007F4D4CB41C51h 0x0000005a popfd 0x0000005b popad 0x0000005c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 73013A8 second address: 73013D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A2Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+2Ch], ecx 0x0000000c jmp 00007F4D4CB43A30h 0x00000011 mov ax, word ptr [esi+30h] 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 movzx eax, dx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 73013D5 second address: 7301427 instructions: 0x00000000 rdtsc 0x00000002 call 00007F4D4CB41C59h 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ax, dx 0x0000000d popad 0x0000000e mov word ptr [edx+30h], ax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007F4D4CB41C54h 0x0000001b sub cx, 6D28h 0x00000020 jmp 00007F4D4CB41C4Bh 0x00000025 popfd 0x00000026 push ecx 0x00000027 pop ebx 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7301427 second address: 730144A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A35h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ax, word ptr [esi+32h] 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 730144A second address: 7301450 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7301450 second address: 7301488 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx ecx, bx 0x00000006 mov ebx, 7CAB68D0h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov word ptr [edx+32h], ax 0x00000012 jmp 00007F4D4CB43A2Fh 0x00000017 mov eax, dword ptr [esi+34h] 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F4D4CB43A30h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7301488 second address: 7301497 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7301497 second address: 730152E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [edx+34h], eax 0x0000000c jmp 00007F4D4CB43A2Eh 0x00000011 test ecx, 00000700h 0x00000017 jmp 00007F4D4CB43A30h 0x0000001c jne 00007F4DBADC1C62h 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 pushfd 0x00000026 jmp 00007F4D4CB43A2Dh 0x0000002b xor esi, 76788176h 0x00000031 jmp 00007F4D4CB43A31h 0x00000036 popfd 0x00000037 pushfd 0x00000038 jmp 00007F4D4CB43A30h 0x0000003d or ecx, 608AFE98h 0x00000043 jmp 00007F4D4CB43A2Bh 0x00000048 popfd 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 730152E second address: 73015B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 or dword ptr [edx+38h], FFFFFFFFh 0x0000000d jmp 00007F4D4CB41C4Eh 0x00000012 or dword ptr [edx+3Ch], FFFFFFFFh 0x00000016 jmp 00007F4D4CB41C50h 0x0000001b or dword ptr [edx+40h], FFFFFFFFh 0x0000001f jmp 00007F4D4CB41C50h 0x00000024 pop esi 0x00000025 pushad 0x00000026 movzx eax, dx 0x00000029 movsx edi, cx 0x0000002c popad 0x0000002d pop ebx 0x0000002e pushad 0x0000002f pushfd 0x00000030 jmp 00007F4D4CB41C50h 0x00000035 or cx, 54E8h 0x0000003a jmp 00007F4D4CB41C4Bh 0x0000003f popfd 0x00000040 push eax 0x00000041 push edx 0x00000042 mov cl, 4Bh 0x00000044 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7350C9F second address: 7350CAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4D4CB43A2Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 72F06E8 second address: 72F06ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 72F06ED second address: 72F06FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4D4CB43A2Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 72F06FC second address: 72F0712 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F4D4CB41C4Bh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 72F0712 second address: 72F0758 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop ecx 0x00000005 mov ecx, ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b pushad 0x0000000c mov ecx, edx 0x0000000e pushfd 0x0000000f jmp 00007F4D4CB43A2Fh 0x00000014 sub cx, E57Eh 0x00000019 jmp 00007F4D4CB43A39h 0x0000001e popfd 0x0000001f popad 0x00000020 mov ebp, esp 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 72F0758 second address: 72F076B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C4Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7290012 second address: 7290018 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7290018 second address: 729001C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 729001C second address: 7290058 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 jmp 00007F4D4CB43A36h 0x0000000e mov dword ptr [esp], ebp 0x00000011 pushad 0x00000012 mov edi, esi 0x00000014 mov bh, al 0x00000016 popad 0x00000017 mov ebp, esp 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F4D4CB43A30h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 729064F second address: 72906C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4D4CB41C57h 0x00000009 add cx, 257Eh 0x0000000e jmp 00007F4D4CB41C59h 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007F4D4CB41C50h 0x0000001a or esi, 7900D078h 0x00000020 jmp 00007F4D4CB41C4Bh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 mov ebp, esp 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007F4D4CB41C50h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 72906C5 second address: 72906D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 72906D4 second address: 72906E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4D4CB41C4Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 72906E8 second address: 729072D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pop ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushfd 0x0000000e jmp 00007F4D4CB43A37h 0x00000013 sub si, 9AFEh 0x00000018 jmp 00007F4D4CB43A39h 0x0000001d popfd 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 72E08DC second address: 72E08E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 72E08E0 second address: 72E08FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A37h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 72E08FB second address: 72E093E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 46F79E8Ah 0x00000008 pushfd 0x00000009 jmp 00007F4D4CB41C4Bh 0x0000000e jmp 00007F4D4CB41C53h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F4D4CB41C55h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 72E093E second address: 72E0A09 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push edx 0x0000000c pushfd 0x0000000d jmp 00007F4D4CB43A2Ah 0x00000012 sbb ch, 00000008h 0x00000015 jmp 00007F4D4CB43A2Bh 0x0000001a popfd 0x0000001b pop esi 0x0000001c pushad 0x0000001d mov si, bx 0x00000020 mov di, 4D76h 0x00000024 popad 0x00000025 popad 0x00000026 xchg eax, ebp 0x00000027 pushad 0x00000028 call 00007F4D4CB43A33h 0x0000002d pushfd 0x0000002e jmp 00007F4D4CB43A38h 0x00000033 adc ecx, 43F229C8h 0x00000039 jmp 00007F4D4CB43A2Bh 0x0000003e popfd 0x0000003f pop esi 0x00000040 mov esi, edx 0x00000042 popad 0x00000043 mov ebp, esp 0x00000045 pushad 0x00000046 pushfd 0x00000047 jmp 00007F4D4CB43A2Ch 0x0000004c adc cx, 2C28h 0x00000051 jmp 00007F4D4CB43A2Bh 0x00000056 popfd 0x00000057 popad 0x00000058 pop ebp 0x00000059 pushad 0x0000005a push eax 0x0000005b push edx 0x0000005c pushfd 0x0000005d jmp 00007F4D4CB43A32h 0x00000062 add si, DE88h 0x00000067 jmp 00007F4D4CB43A2Bh 0x0000006c popfd 0x0000006d rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 72C0029 second address: 72C008E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebp 0x00000006 pushad 0x00000007 pushfd 0x00000008 jmp 00007F4D4CB41C4Ah 0x0000000d jmp 00007F4D4CB41C55h 0x00000012 popfd 0x00000013 mov edi, eax 0x00000015 popad 0x00000016 mov dword ptr [esp], ebp 0x00000019 pushad 0x0000001a push esi 0x0000001b pop edx 0x0000001c mov si, 8C77h 0x00000020 popad 0x00000021 mov ebp, esp 0x00000023 jmp 00007F4D4CB41C4Ah 0x00000028 and esp, FFFFFFF0h 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e push ebx 0x0000002f pop ecx 0x00000030 call 00007F4D4CB41C59h 0x00000035 pop eax 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 72C008E second address: 72C011C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A2Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub esp, 44h 0x0000000c pushad 0x0000000d call 00007F4D4CB43A2Eh 0x00000012 mov si, D241h 0x00000016 pop ecx 0x00000017 jmp 00007F4D4CB43A37h 0x0000001c popad 0x0000001d xchg eax, ebx 0x0000001e pushad 0x0000001f push esi 0x00000020 mov dx, ED46h 0x00000024 pop ebx 0x00000025 mov dh, ah 0x00000027 popad 0x00000028 push eax 0x00000029 jmp 00007F4D4CB43A36h 0x0000002e xchg eax, ebx 0x0000002f jmp 00007F4D4CB43A30h 0x00000034 xchg eax, esi 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007F4D4CB43A37h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 72C011C second address: 72C0148 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4D4CB41C4Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 72C0148 second address: 72C015A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4D4CB43A2Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 72C015A second address: 72C015E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 72C015E second address: 72C0193 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 jmp 00007F4D4CB43A37h 0x0000000e xchg eax, edi 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F4D4CB43A30h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 72C0193 second address: 72C01A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 72C01A2 second address: 72C01C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 6EE677BAh 0x00000008 push edi 0x00000009 pop eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F4D4CB43A33h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 72C01C5 second address: 72C01F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4D4CB41C4Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 72C01F2 second address: 72C028C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, dword ptr [ebp+08h] 0x0000000c pushad 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F4D4CB43A2Ah 0x00000014 and cx, 2CE8h 0x00000019 jmp 00007F4D4CB43A2Bh 0x0000001e popfd 0x0000001f mov si, 4CDFh 0x00000023 popad 0x00000024 mov edx, esi 0x00000026 popad 0x00000027 mov dword ptr [esp+24h], 00000000h 0x0000002f pushad 0x00000030 movzx eax, dx 0x00000033 mov si, bx 0x00000036 popad 0x00000037 lock bts dword ptr [edi], 00000000h 0x0000003c jmp 00007F4D4CB43A2Bh 0x00000041 jc 00007F4DBCCB5C09h 0x00000047 jmp 00007F4D4CB43A36h 0x0000004c pop edi 0x0000004d jmp 00007F4D4CB43A30h 0x00000052 pop esi 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 push edx 0x00000057 jmp 00007F4D4CB43A2Ah 0x0000005c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 72C028C second address: 72C029B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 72F07D7 second address: 72F086C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4D4CB43A37h 0x00000008 mov dx, ax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007F4D4CB43A35h 0x00000014 xchg eax, ebp 0x00000015 pushad 0x00000016 pushfd 0x00000017 jmp 00007F4D4CB43A2Ch 0x0000001c adc ah, 00000058h 0x0000001f jmp 00007F4D4CB43A2Bh 0x00000024 popfd 0x00000025 pushfd 0x00000026 jmp 00007F4D4CB43A38h 0x0000002b adc ax, 7EB8h 0x00000030 jmp 00007F4D4CB43A2Bh 0x00000035 popfd 0x00000036 popad 0x00000037 mov ebp, esp 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007F4D4CB43A30h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 72F086C second address: 72F087B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 72F0A52 second address: 72F0A58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 72F0A58 second address: 72F0A5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 72F0A5C second address: 72F0A60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7360A03 second address: 7360A36 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, 667248A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dl, byte ptr [ebp+14h] 0x0000000d jmp 00007F4D4CB41C4Ah 0x00000012 mov eax, dword ptr [ebp+10h] 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F4D4CB41C57h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7360A36 second address: 7360A4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4D4CB43A34h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7360A4E second address: 7360A52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7360A52 second address: 7360AB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and dl, 00000007h 0x0000000b pushad 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F4D4CB43A33h 0x00000013 sbb esi, 444DF2AEh 0x00000019 jmp 00007F4D4CB43A39h 0x0000001e popfd 0x0000001f call 00007F4D4CB43A30h 0x00000024 pop ecx 0x00000025 popad 0x00000026 mov edx, 241862E6h 0x0000002b popad 0x0000002c test eax, eax 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 pushad 0x00000032 popad 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7360AB3 second address: 7360AB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7360AB9 second address: 7360ADC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F4DBCC39157h 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F4D4CB43A32h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7340E8E second address: 7340E92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7340E92 second address: 7340EAF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7340EAF second address: 7340ED3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4D4CB41C4Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7340ED3 second address: 7340EED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, 8Dh 0x00000005 call 00007F4D4CB43A2Ah 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7340EED second address: 7340EF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7340EF1 second address: 7340EF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7340EF7 second address: 7340EFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7340EFD second address: 7340F20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4D4CB43A35h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7340F20 second address: 7340F26 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7350427 second address: 735042B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 735042B second address: 7350431 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7350431 second address: 7350442 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4D4CB43A2Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7350442 second address: 7350472 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov edx, ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushfd 0x0000000f jmp 00007F4D4CB41C52h 0x00000014 adc ah, FFFFFF88h 0x00000017 jmp 00007F4D4CB41C4Bh 0x0000001c popfd 0x0000001d rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7350472 second address: 73504E3 instructions: 0x00000000 rdtsc 0x00000002 call 00007F4D4CB43A38h 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], ebp 0x0000000e jmp 00007F4D4CB43A31h 0x00000013 mov ebp, esp 0x00000015 jmp 00007F4D4CB43A2Eh 0x0000001a xchg eax, ebx 0x0000001b jmp 00007F4D4CB43A30h 0x00000020 push eax 0x00000021 pushad 0x00000022 mov dx, 9A24h 0x00000026 popad 0x00000027 xchg eax, ebx 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b call 00007F4D4CB43A30h 0x00000030 pop ecx 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 73504E3 second address: 73504E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 73504E8 second address: 7350506 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A2Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push edx 0x0000000e pop eax 0x0000000f mov edx, 111B3E4Ch 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7350506 second address: 7350540 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C52h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F4D4CB41C4Bh 0x0000000f xchg eax, esi 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F4D4CB41C55h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7350540 second address: 7350546 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7350546 second address: 735054A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 735054A second address: 7350582 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, dword ptr [ebp+08h] 0x0000000b jmp 00007F4D4CB43A2Fh 0x00000010 sub ecx, ecx 0x00000012 pushad 0x00000013 movsx edx, ax 0x00000016 mov edi, ecx 0x00000018 popad 0x00000019 xchg eax, edi 0x0000001a pushad 0x0000001b mov si, F535h 0x0000001f pushad 0x00000020 mov di, si 0x00000023 mov dh, ah 0x00000025 popad 0x00000026 popad 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7350582 second address: 7350586 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7350586 second address: 735058C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 735058C second address: 7350592 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7350592 second address: 7350596 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7350596 second address: 73505BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, edi 0x00000009 jmp 00007F4D4CB41C50h 0x0000000e mov eax, 00000001h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 73505BA second address: 73505D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 73505D7 second address: 7350642 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lock cmpxchg dword ptr [esi], ecx 0x0000000d jmp 00007F4D4CB41C4Eh 0x00000012 mov ecx, eax 0x00000014 jmp 00007F4D4CB41C50h 0x00000019 cmp ecx, 01h 0x0000001c jmp 00007F4D4CB41C50h 0x00000021 jne 00007F4DBCC23BF1h 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F4D4CB41C57h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7350642 second address: 735065A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4D4CB43A34h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 735065A second address: 7350694 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov edi, esi 0x0000000e pushfd 0x0000000f jmp 00007F4D4CB41C54h 0x00000014 jmp 00007F4D4CB41C55h 0x00000019 popfd 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7350694 second address: 7350712 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 79B48D72h 0x00000008 call 00007F4D4CB43A33h 0x0000000d pop ecx 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pop esi 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F4D4CB43A35h 0x00000019 sub esi, 2C8A38F6h 0x0000001f jmp 00007F4D4CB43A31h 0x00000024 popfd 0x00000025 call 00007F4D4CB43A30h 0x0000002a push ecx 0x0000002b pop edx 0x0000002c pop ecx 0x0000002d popad 0x0000002e pop ebx 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007F4D4CB43A38h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 73104D9 second address: 7310548 instructions: 0x00000000 rdtsc 0x00000002 mov bx, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F4D4CB41C52h 0x00000011 sbb ax, 8008h 0x00000016 jmp 00007F4D4CB41C4Bh 0x0000001b popfd 0x0000001c pushad 0x0000001d mov al, C6h 0x0000001f pushfd 0x00000020 jmp 00007F4D4CB41C4Bh 0x00000025 and ax, 784Eh 0x0000002a jmp 00007F4D4CB41C59h 0x0000002f popfd 0x00000030 popad 0x00000031 popad 0x00000032 xchg eax, ecx 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007F4D4CB41C4Dh 0x0000003a rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7310548 second address: 731057C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov edi, 542FFCC2h 0x00000010 mov ebx, 0485230Eh 0x00000015 popad 0x00000016 xchg eax, ecx 0x00000017 pushad 0x00000018 movsx edx, ax 0x0000001b push eax 0x0000001c push edx 0x0000001d call 00007F4D4CB43A2Ah 0x00000022 pop esi 0x00000023 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 731057C second address: 73105DF instructions: 0x00000000 rdtsc 0x00000002 mov ebx, 25D23496h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push 00000000h 0x0000000c jmp 00007F4D4CB41C4Dh 0x00000011 push 00000000h 0x00000013 jmp 00007F4D4CB41C4Eh 0x00000018 push dword ptr [ebp+08h] 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e mov bx, B2D0h 0x00000022 pushfd 0x00000023 jmp 00007F4D4CB41C59h 0x00000028 adc ah, 00000056h 0x0000002b jmp 00007F4D4CB41C51h 0x00000030 popfd 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 73105DF second address: 73105EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4D4CB43A2Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 73102D5 second address: 7310311 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4D4CB41C58h 0x00000009 xor cx, 5128h 0x0000000e jmp 00007F4D4CB41C4Bh 0x00000013 popfd 0x00000014 mov ecx, 4DAFD61Fh 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c xchg eax, ebp 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 mov dx, si 0x00000023 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7310311 second address: 7310367 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F4D4CB43A2Ah 0x00000008 and eax, 75258388h 0x0000000e jmp 00007F4D4CB43A2Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushfd 0x00000017 jmp 00007F4D4CB43A38h 0x0000001c and ah, FFFFFFE8h 0x0000001f jmp 00007F4D4CB43A2Bh 0x00000024 popfd 0x00000025 popad 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a push esi 0x0000002b pop ebx 0x0000002c mov ecx, 751551ADh 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7310367 second address: 7310396 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C53h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4D4CB41C55h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7310396 second address: 73103A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4D4CB43A2Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 73103A6 second address: 73103CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4D4CB41C59h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 73103CD second address: 73103D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 73103D3 second address: 73103D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 73103D9 second address: 7310444 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A36h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [ebp+08h] 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F4D4CB43A2Eh 0x00000015 or ecx, 420721C8h 0x0000001b jmp 00007F4D4CB43A2Bh 0x00000020 popfd 0x00000021 jmp 00007F4D4CB43A38h 0x00000026 popad 0x00000027 and dword ptr [eax], 00000000h 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007F4D4CB43A2Ah 0x00000033 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7310444 second address: 7310448 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7310448 second address: 731044E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7310150 second address: 7310167 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4D4CB41C53h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7310167 second address: 7310196 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB43A39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4D4CB43A2Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 7310196 second address: 73101C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4D4CB41C51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F4D4CB41C4Eh 0x00000010 pop ebp 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 mov bx, cx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 72A0199 second address: 72A019E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 72A019E second address: 72A01A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 72A01A4 second address: 72A01A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	RDTSC instruction interceptor: First address: 72A01A8 second address: 72A01E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jmp 00007F4D4CB41C56h 0x0000000e mov dword ptr [esp], ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F4D4CB41C57h 0x00000018 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Special instruction interceptor: First address: C6BA4A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Special instruction interceptor: First address: E12A1E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Special instruction interceptor: First address: E20CB8 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Special instruction interceptor: First address: E9FE0C instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\94g4KHMj9B.exe

Code function: 0_2_072D0B13 rdtsc

0_2_072D0B13

Source: C:\Users\user\Desktop\94g4KHMj9B.exe

API coverage: 2.7 %

Source: C:\Users\user\Desktop\94g4KHMj9B.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\94g4KHMj9B.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: 94g4KHMj9B.exe, 94g4KHMj9B.exe, 00000000.00000002.1651382690.0000000000DEE000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: 94g4KHMj9B.exe, 00000000.00000003.1491349345.0000000006B61000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Y\MACHINE\SYSTEM\ControlSet001\Services\VBoxSFlO#b
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware-42 27 c5 9a 47 85 d6 84-53 49 ec ec 87 a6 6d 67
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: 94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SYSINTERNALSNum_processorNum_ramnameallfreedriversNum_displaysresolution_xresolution_y\recent_filesprocessesuptime_minutesC:\Windows\System32\VBox.dll01vbox_firstSYSTEM\ControlSet001\Services\VBoxSFvbox_secondC:\USERS\PUBLIC\public_checkWINDBG.EXEdbgwireshark.exeprocmon.exex64dbg.exeida.exedbg_secdbg_thirdyadroinstalled_appsSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall%d%s\%sDisplayNameapp_nameindexCreateToolhelp32Snapshot failed.
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: 94g4KHMj9B.exe, 00000000.00000002.1652230066.0000000001991000.00000004.00000020.00020000.00000000.sdmp, 94g4KHMj9B.exe, 00000000.00000003.1488916312.0000000001942000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: 94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SYSTEM\ControlSet001\Services\VBoxSF
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: 94g4KHMj9B.exe, 00000000.00000002.1651382690.0000000000DEE000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\94g4KHMj9B.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\94g4KHMj9B.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\94g4KHMj9B.exe

Thread information set: HideFromDebugger

Jump to behavior

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Code function: 0_2_07330A34 Start: 07330BA4 End: 07330AD2	0_2_07330A34
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Code function: 0_2_07330A22 Start: 07330BA4 End: 07330AD2	0_2_07330A22
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Code function: 0_2_07330A15 Start: 07330BA4 End: 07330AD2	0_2_07330A15
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Code function: 0_2_07330A66 Start: 07330BA4 End: 07330AD2	0_2_07330A66
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Code function: 0_2_0733096C Start: 07330BA4 End: 07330AD2	0_2_0733096C
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Code function: 0_2_073309A1 Start: 07330BA4 End: 07330AD2	0_2_073309A1
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Code function: 0_2_073309AE Start: 07330BA4 End: 07330AD2	0_2_073309AE
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Code function: 0_2_0733098D Start: 07330BA4 End: 07330AD2	0_2_0733098D
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Code function: 0_2_073309F7 Start: 07330BA4 End: 07330AD2	0_2_073309F7
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Code function: 0_2_073309CB Start: 07330BA4 End: 07330AD2	0_2_073309CB

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\94g4KHMj9B.exe	File opened: NTICE
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	File opened: SICE
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\94g4KHMj9B.exe

Code function: 0_2_072D0B13 rdtsc

0_2_072D0B13

Source: 94g4KHMj9B.exe	Binary or memory string: Program Manager
Source: 94g4KHMj9B.exe, 00000000.00000002.1651382690.0000000000DEE000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\94g4KHMj9B.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\94g4KHMj9B.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: 94g4KHMj9B.exe, 00000000.00000002.1650797309.0000000000AFD000.00000040.00000001.01000000.00000003.sdmp, 94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: procmon.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: 94g4KHMj9B.exe, 00000000.00000002.1650797309.0000000000AFD000.00000040.00000001.01000000.00000003.sdmp, 94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: wireshark.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	2 Process Injection	23 Virtualization/Sandbox Evasion	OS Credential Dumping	751 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	2 Process Injection	LSASS Memory	23 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 Remote System Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	214 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
94g4KHMj9B.exe	43%	Virustotal		Browse
94g4KHMj9B.exe	68%	ReversingLabs	Win32.Trojan.Amadey
94g4KHMj9B.exe	100%	Avira	TR/Crypt.TPM.Gen
94g4KHMj9B.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
httpbin.org	34.226.108.155	true	false		high
home.fivetk5ht.top	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://httpbin.org/ip	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://curl.se/docs/hsts.html	94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp	false	high
http://html4/loose.dtd	94g4KHMj9B.exe, 00000000.00000002.1650797309.0000000000AFD000.00000040.00000001.01000000.00000003.sdmp, 94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp	false	high
http://home.fivetk5ht.top/zldPR	94g4KHMj9B.exe, 00000000.00000002.1652230066.0000000001991000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851http://home.fivetk5ht.top/zldPRFrmVFHTtKntGp	94g4KHMj9B.exe, 00000000.00000002.1650797309.0000000000AFD000.00000040.00000001.01000000.00000003.sdmp	false	high
https://httpbin.org/ipbefore	94g4KHMj9B.exe, 00000000.00000002.1650797309.0000000000AFD000.00000040.00000001.01000000.00000003.sdmp, 94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp	false	high
https://curl.se/docs/http-cookies.html	94g4KHMj9B.exe, 00000000.00000002.1650797309.0000000000AFD000.00000040.00000001.01000000.00000003.sdmp, 94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp	false	high
http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851	94g4KHMj9B.exe, 00000000.00000002.1652230066.000000000190E000.00000004.00000020.00020000.00000000.sdmp	false	high
http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv17345798516963	94g4KHMj9B.exe, 00000000.00000002.1652230066.000000000190E000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv17	94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp	false	high
http://upx.sf.net	Amcache.hve.4.dr	false	high
https://curl.se/docs/alt-svc.html	94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp	false	high
http://.css	94g4KHMj9B.exe, 00000000.00000002.1650797309.0000000000AFD000.00000040.00000001.01000000.00000003.sdmp, 94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp	false	high
http://.jpg	94g4KHMj9B.exe, 00000000.00000002.1650797309.0000000000AFD000.00000040.00000001.01000000.00000003.sdmp, 94g4KHMj9B.exe, 00000000.00000003.1461567252.00000000075D6000.00000004.00001000.00020000.00000000.sdmp	false	high
http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851fff::3	94g4KHMj9B.exe, 00000000.00000002.1652230066.000000000190E000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
34.226.108.155	httpbin.org	United States		14618	AMAZON-AESUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579683
Start date and time:	2024-12-23 07:29:55 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	94g4KHMj9B.exe renamed because original name is a hash value
Original Sample Name:	bc9903cd12a6b359c28e16021909ccb3.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@2/5@14/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 104.208.16.94, 40.126.53.17, 4.245.163.56, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com, onedsblobprdcus16.centralus.cloudapp.azure.com
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

Time	Type	Description
01:30:59	API Interceptor	6x Sleep call for process: 94g4KHMj9B.exe modified
01:31:12	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
34.226.108.155	Gy53Tq6BdK.exe	Get hash	malicious	Unknown	Browse
	HRpFufG1LJ.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse
	OmLwjD18cO.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse
	N3s5DQ51YF.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse
	Yda6AxtlVP.exe	Get hash	malicious	Unknown	Browse
	2OJYjm4J1B.exe	Get hash	malicious	Unknown	Browse
	ze38hsiGOb.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
httpbin.org	95e1Fwp61u.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	98.85.100.80
	7eDrKI88k8.exe	Get hash	malicious	Unknown	Browse	98.85.100.80
	Gy53Tq6BdK.exe	Get hash	malicious	Unknown	Browse	34.226.108.155
	HRpFufG1LJ.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.226.108.155
	t9iCli9iWK.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	98.85.100.80
	uwa78qqv0x.exe	Get hash	malicious	Unknown	Browse	98.85.100.80
	OmLwjD18cO.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.226.108.155
	N3s5DQ51YF.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.226.108.155
	fW6RLQpTIt.exe	Get hash	malicious	Cryptbot	Browse	98.85.100.80
	p3a0oZ4U7X.exe	Get hash	malicious	Unknown	Browse	98.85.100.80

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-AESUS	TmmiCE5Ulm.exe	Get hash	malicious	LummaC	Browse	3.5.16.86
	Gy53Tq6BdK.exe	Get hash	malicious	Unknown	Browse	34.226.108.155
	HRpFufG1LJ.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.226.108.155
	OmLwjD18cO.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.226.108.155
	N3s5DQ51YF.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.226.108.155
	Yda6AxtlVP.exe	Get hash	malicious	Unknown	Browse	34.226.108.155
	2OJYjm4J1B.exe	Get hash	malicious	Unknown	Browse	34.226.108.155
	ze38hsiGOb.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.226.108.155
	armv4l.elf	Get hash	malicious	Unknown	Browse	54.88.200.107
	loligang.sh4.elf	Get hash	malicious	Mirai	Browse	54.137.103.116

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_94g4KHMj9B.exe_b6575ed36de09c438bf01f2cf3bd5adabbee862_0e460935_81992edc-86d8-4977-93f6-000aff44c863\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.943620909089547
Encrypted:	false
SSDEEP:	384:l90yeKGN5BU/S64j5zuiFAY4IO8RjULk:YBU/gj5zuiFAY4IO8
MD5:	F38060BA2D13A5772EDE10EDC0C6AC02
SHA1:	92B0C64C69FFA8D9594230343B4BC25443766ED9
SHA-256:	BE27052A2BFD0FB453067DD7DA221EB89451B818B3E4D4AD4B267DF076507553
SHA-512:	F49E6E8E59FF7B7C5F4A8BCDC334A2E5074C1F97FF6665FC6C19BCE46E641DFC6367A52730C8D0A453D587B2345134D34B300A999EAF37E4ADC4E7176710B0C0
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.9.4.0.9.0.6.2.2.9.9.4.3.3.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.9.4.0.9.0.6.2.8.6.1.9.2.4.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.1.9.9.2.e.d.c.-.8.6.d.8.-.4.9.7.7.-.9.3.f.6.-.0.0.0.a.f.f.4.4.c.8.6.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.6.f.d.e.0.d.3.-.6.1.c.8.-.4.9.7.4.-.b.2.3.c.-.6.3.f.3.1.9.e.b.b.3.1.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.9.4.g.4.K.H.M.j.9.B...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.c.c.8.-.0.0.0.1.-.0.0.1.4.-.5.e.1.1.-.1.f.3.7.0.4.5.5.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.c.a.f.5.3.a.c.5.4.1.1.5.c.6.f.4.7.7.b.8.2.3.6.0.f.1.e.6.2.6.8.3.0.0.0.0.f.f.f.f.!.0.0.0.0.1.b.4.4.4.2.8.9.d.8.d.f.7.7.5.5.f.1.d.7.7.9.b.9.8.6.2.c.8.e.4.9.9.5.e.e.6.d.5.5.!.9.4.g.4.K.H.M.j.9.B...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER112E.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Mon Dec 23 06:31:02 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	208266
Entropy (8bit):	1.4389029113120322
Encrypted:	false
SSDEEP:	384:/oxbbGElXEq/D8CBOmrRIRVqxX45tTlic/C1zH3Q+2d7NRSMNRrKGtGAz:/AbGEVEqrFBOmrRIzqX45lkc/UzHy/2K
MD5:	AAEE638F27BDA9B2C5BF6C6EAF405612
SHA1:	118E2261A53BF2211D539903ABC1D416041DBCB7
SHA-256:	E85A8929BE1A01E06D330B60EF821E35E4C8F9DDC40EB705D7FC013BD6F0321D
SHA-512:	D002A20A063A92F3D8D4CF32D9F73EEA9C7E1F7987CF1F82D300260DE43E17048002DFEBCCA738EA69B113089F12A07ED21266F89FFD33835B141D3E39F2AFEA
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .........ig............D...........D...X............ ...........z..........`.......8...........T...........H,..B........... !...........#..............................................................................eJ.......#......GenuineIntel............T.............ig.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1296.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8350
Entropy (8bit):	3.6997237729684107
Encrypted:	false
SSDEEP:	192:R6l7wVeJa3C6E6YSQSUrFIgmfjQb0prx89bKYsfeOm:R6lXJaS6E6YFSUr6gmfjQbXKLfu
MD5:	BC17ADC78E0CCEA7119726AA8BE6E0FB
SHA1:	8A4AA8D395BF4C209DA830A9EB5455F1890490A3
SHA-256:	3B194F34DF0481C03FEC70CD4FE59F629FBF1F1A2CF85771E08A853CAE2D8BB0
SHA-512:	C56B9B96E04297BAFFD1A1812609EF763F96E62F8B81C30F4A158E54F6E3B3A6E90C56CF46ABC78416781970B30E38C908D46F65B675D50FFC3142AD9F4472EA
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.2.7.2.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER12D5.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4594
Entropy (8bit):	4.475016234677823
Encrypted:	false
SSDEEP:	48:cvIwWl8zsnSJg77aI9wrWpW8VYWYm8M4JP5FL+q8mxLu7zzAzAd:uIjfngI7ia7VaJXTK7zzAzAd
MD5:	E87661B0EA38F733C59720E5157D1AE2
SHA1:	E358CE8534FEE7B60DE652E98248D5EC2474A1A3
SHA-256:	8E306AF5B1E2CF5895C73E38E77577879C8E2987976D66E0EEF100E1DFF8BC3B
SHA-512:	E8038C5E1A7B195EF29FE83FC08D8A685296C555FBAB8A61528194CEBF81528B81267F9A23C38595C1A8375A442C05BFCEC3D5DB36185B67F144D57FC03001F9
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="643533" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.372086982589458
Encrypted:	false
SSDEEP:	6144:+FVfpi6ceLP/9skLmb0ayWWSPtaJG8nAge35OlMMhA2AX4WABlguNFiL:uV1QyWWI/glMM6kF7Pq
MD5:	5BF4C6C9C167CC4985C97816AFEF6B33
SHA1:	E918CB8487C3AFD5139D349A5B291FF320E0259D
SHA-256:	65F383404046D006E94127F47BDFB2491A328FC0B854A8B7D2C41BF2B2A4A0FB
SHA-512:	FB205D065CCFA7DCA7016BAFE082E31ED0D0BF461978765E9D8DBFF3ED9ADD17CB38039CD03B1448824A02B0B1E781E1C7864D8EA09B3C6AEFE53326852C0854
Malicious:	false
Reputation:	low
Preview:	regfC...C....\.Z.................... ....0......\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...<.U................................................................................................................................................................................................................................................................................................................................................h.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	7.983785476322999
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	94g4KHMj9B.exe
File size:	4'490'240 bytes
MD5:	bc9903cd12a6b359c28e16021909ccb3
SHA1:	1b444289d8df7755f1d779b9862c8e4995ee6d55
SHA256:	072e228bf10d03818ed7869a52bdc386d0bd437923044fb98e2a29ae2ff4591a
SHA512:	40dbe8fe4c2bbb7e1328c1dc4d39f81430fcec995e383703f90aaa48132ed8b01e291f581056eb5812de0b10e483e6e9936ca2a579fae0b2587088c49f13f7d9
SSDEEP:	98304:YTYUOgxUXnyMw6UXR5sCWeI6zQpxjPlUj/Wlfa68l2syVu5P03+y6:YROgxWyP62zfWePQpZPliEShlhF0
TLSH:	DE2633B09D9D5EE8E138F738081B451C9F3B45B8891A2AF65F4AF250D5632EDD6230CA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....cg...............(.VH...v..2...........pH...@...................................E...@... ............................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x109b000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:	DYNAMIC_BASE
Time Stamp:	0x67639809 [Thu Dec 19 03:50:33 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F4D4D39C4FAh
punpckldq mm0, qword ptr [eax+eax+00h]
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x74705f	0x73	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x746000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc99954	0x10	ibyjowhj
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc99904	0x18	ibyjowhj
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x745000	0x284c00	575efb5eb8815db228dfe4e295605a15	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x746000	0x1ac	0x200	c657e04ebdd2bf4d1591e11a2f134863	False	0.580078125	data	4.545101978197859	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x747000	0x1000	0x200	e84636d45557e74dadd0f14f36394655	False	0.166015625	data	1.1471680400846989	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x748000	0x392000	0x200	3c86ddffea232b13b84a4ab74e9706a0	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ibyjowhj	0xada000	0x1c0000	0x1bfc00	357f22030bd7b988d5b84e5e056c4466	False	0.9943412810580681	data	7.955270488785443	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
mvafozls	0xc9a000	0x1000	0x400	e509b70d846acf328d707ee54f7afc89	False	0.8427734375	data	6.409426148671415	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0xc9b000	0x3000	0x2200	01433556fcd9e251ed36019e064d6072	False	0.06376378676470588	DOS executable (COM)	0.7875567811980314	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0xc99964	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 07:30:57.535816908 CET	49704	443	192.168.2.8	34.226.108.155
Dec 23, 2024 07:30:57.535861969 CET	443	49704	34.226.108.155	192.168.2.8
Dec 23, 2024 07:30:57.535995007 CET	49704	443	192.168.2.8	34.226.108.155
Dec 23, 2024 07:30:57.550177097 CET	49704	443	192.168.2.8	34.226.108.155
Dec 23, 2024 07:30:57.550201893 CET	443	49704	34.226.108.155	192.168.2.8
Dec 23, 2024 07:30:59.285505056 CET	443	49704	34.226.108.155	192.168.2.8
Dec 23, 2024 07:30:59.292047977 CET	49704	443	192.168.2.8	34.226.108.155
Dec 23, 2024 07:30:59.292062044 CET	443	49704	34.226.108.155	192.168.2.8
Dec 23, 2024 07:30:59.293546915 CET	443	49704	34.226.108.155	192.168.2.8
Dec 23, 2024 07:30:59.293636084 CET	49704	443	192.168.2.8	34.226.108.155
Dec 23, 2024 07:30:59.316046000 CET	49704	443	192.168.2.8	34.226.108.155
Dec 23, 2024 07:30:59.316169024 CET	443	49704	34.226.108.155	192.168.2.8
Dec 23, 2024 07:30:59.366590023 CET	49704	443	192.168.2.8	34.226.108.155
Dec 23, 2024 07:30:59.366611004 CET	443	49704	34.226.108.155	192.168.2.8
Dec 23, 2024 07:30:59.407438993 CET	49704	443	192.168.2.8	34.226.108.155
Dec 23, 2024 07:30:59.451334000 CET	443	49704	34.226.108.155	192.168.2.8
Dec 23, 2024 07:30:59.727327108 CET	443	49704	34.226.108.155	192.168.2.8
Dec 23, 2024 07:30:59.727442026 CET	443	49704	34.226.108.155	192.168.2.8
Dec 23, 2024 07:30:59.727518082 CET	49704	443	192.168.2.8	34.226.108.155
Dec 23, 2024 07:30:59.754848957 CET	49704	443	192.168.2.8	34.226.108.155
Dec 23, 2024 07:30:59.754892111 CET	443	49704	34.226.108.155	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 23, 2024 07:30:57.395809889 CET	63981	53	192.168.2.8	1.1.1.1
Dec 23, 2024 07:30:57.395967007 CET	63981	53	192.168.2.8	1.1.1.1
Dec 23, 2024 07:30:57.533350945 CET	53	63981	1.1.1.1	192.168.2.8
Dec 23, 2024 07:30:57.533476114 CET	53	63981	1.1.1.1	192.168.2.8
Dec 23, 2024 07:31:00.614779949 CET	63984	53	192.168.2.8	1.1.1.1
Dec 23, 2024 07:31:00.614907980 CET	63984	53	192.168.2.8	1.1.1.1
Dec 23, 2024 07:31:00.752846956 CET	53	63984	1.1.1.1	192.168.2.8
Dec 23, 2024 07:31:00.752976894 CET	53	63984	1.1.1.1	192.168.2.8
Dec 23, 2024 07:31:00.957885027 CET	63985	53	192.168.2.8	1.1.1.1
Dec 23, 2024 07:31:00.957986116 CET	63985	53	192.168.2.8	1.1.1.1
Dec 23, 2024 07:31:01.095781088 CET	53	63985	1.1.1.1	192.168.2.8
Dec 23, 2024 07:31:01.095865011 CET	53	63985	1.1.1.1	192.168.2.8
Dec 23, 2024 07:31:01.277650118 CET	63986	53	192.168.2.8	1.1.1.1
Dec 23, 2024 07:31:01.277705908 CET	63986	53	192.168.2.8	1.1.1.1
Dec 23, 2024 07:31:01.415380001 CET	53	63986	1.1.1.1	192.168.2.8
Dec 23, 2024 07:31:01.415466070 CET	53	63986	1.1.1.1	192.168.2.8
Dec 23, 2024 07:31:01.600234985 CET	63987	53	192.168.2.8	1.1.1.1
Dec 23, 2024 07:31:01.600292921 CET	63987	53	192.168.2.8	1.1.1.1
Dec 23, 2024 07:31:01.738158941 CET	53	63987	1.1.1.1	192.168.2.8
Dec 23, 2024 07:31:01.738197088 CET	53	63987	1.1.1.1	192.168.2.8
Dec 23, 2024 07:31:01.935712099 CET	63988	53	192.168.2.8	1.1.1.1
Dec 23, 2024 07:31:01.935806990 CET	63988	53	192.168.2.8	1.1.1.1
Dec 23, 2024 07:31:02.073760986 CET	53	63988	1.1.1.1	192.168.2.8
Dec 23, 2024 07:31:02.076905012 CET	53	63988	1.1.1.1	192.168.2.8
Dec 23, 2024 07:31:02.811212063 CET	63989	53	192.168.2.8	1.1.1.1
Dec 23, 2024 07:31:02.811371088 CET	63989	53	192.168.2.8	1.1.1.1
Dec 23, 2024 07:31:02.949420929 CET	53	63989	1.1.1.1	192.168.2.8
Dec 23, 2024 07:31:02.949975967 CET	53	63989	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 23, 2024 07:30:57.395809889 CET	192.168.2.8	1.1.1.1	0xf172	Standard query (0)	httpbin.org	A (IP address)	IN (0x0001)	false
Dec 23, 2024 07:30:57.395967007 CET	192.168.2.8	1.1.1.1	0x4f08	Standard query (0)	httpbin.org	28	IN (0x0001)	false
Dec 23, 2024 07:31:00.614779949 CET	192.168.2.8	1.1.1.1	0x79c9	Standard query (0)	home.fivetk5ht.top	A (IP address)	IN (0x0001)	false
Dec 23, 2024 07:31:00.614907980 CET	192.168.2.8	1.1.1.1	0x5726	Standard query (0)	home.fivetk5ht.top	28	IN (0x0001)	false
Dec 23, 2024 07:31:00.957885027 CET	192.168.2.8	1.1.1.1	0xc471	Standard query (0)	home.fivetk5ht.top	A (IP address)	IN (0x0001)	false
Dec 23, 2024 07:31:00.957986116 CET	192.168.2.8	1.1.1.1	0xe2da	Standard query (0)	home.fivetk5ht.top	28	IN (0x0001)	false
Dec 23, 2024 07:31:01.277650118 CET	192.168.2.8	1.1.1.1	0xff75	Standard query (0)	home.fivetk5ht.top	A (IP address)	IN (0x0001)	false
Dec 23, 2024 07:31:01.277705908 CET	192.168.2.8	1.1.1.1	0x4a33	Standard query (0)	home.fivetk5ht.top	28	IN (0x0001)	false
Dec 23, 2024 07:31:01.600234985 CET	192.168.2.8	1.1.1.1	0x873d	Standard query (0)	home.fivetk5ht.top	A (IP address)	IN (0x0001)	false
Dec 23, 2024 07:31:01.600292921 CET	192.168.2.8	1.1.1.1	0xadff	Standard query (0)	home.fivetk5ht.top	28	IN (0x0001)	false
Dec 23, 2024 07:31:01.935712099 CET	192.168.2.8	1.1.1.1	0x57d0	Standard query (0)	home.fivetk5ht.top	A (IP address)	IN (0x0001)	false
Dec 23, 2024 07:31:01.935806990 CET	192.168.2.8	1.1.1.1	0xf2e1	Standard query (0)	home.fivetk5ht.top	28	IN (0x0001)	false
Dec 23, 2024 07:31:02.811212063 CET	192.168.2.8	1.1.1.1	0xa94	Standard query (0)	home.fivetk5ht.top	A (IP address)	IN (0x0001)	false
Dec 23, 2024 07:31:02.811371088 CET	192.168.2.8	1.1.1.1	0x209d	Standard query (0)	home.fivetk5ht.top	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 23, 2024 07:30:57.533476114 CET	1.1.1.1	192.168.2.8	0xf172	No error (0)	httpbin.org		34.226.108.155	A (IP address)	IN (0x0001)	false
Dec 23, 2024 07:30:57.533476114 CET	1.1.1.1	192.168.2.8	0xf172	No error (0)	httpbin.org		98.85.100.80	A (IP address)	IN (0x0001)	false
Dec 23, 2024 07:31:00.752846956 CET	1.1.1.1	192.168.2.8	0x5726	Name error (3)	home.fivetk5ht.top	none	none	28	IN (0x0001)	false
Dec 23, 2024 07:31:00.752976894 CET	1.1.1.1	192.168.2.8	0x79c9	Name error (3)	home.fivetk5ht.top	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 07:31:01.095781088 CET	1.1.1.1	192.168.2.8	0xe2da	Name error (3)	home.fivetk5ht.top	none	none	28	IN (0x0001)	false
Dec 23, 2024 07:31:01.095865011 CET	1.1.1.1	192.168.2.8	0xc471	Name error (3)	home.fivetk5ht.top	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 07:31:01.415380001 CET	1.1.1.1	192.168.2.8	0xff75	Name error (3)	home.fivetk5ht.top	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 07:31:01.415466070 CET	1.1.1.1	192.168.2.8	0x4a33	Name error (3)	home.fivetk5ht.top	none	none	28	IN (0x0001)	false
Dec 23, 2024 07:31:01.738158941 CET	1.1.1.1	192.168.2.8	0x873d	Name error (3)	home.fivetk5ht.top	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 07:31:01.738197088 CET	1.1.1.1	192.168.2.8	0xadff	Name error (3)	home.fivetk5ht.top	none	none	28	IN (0x0001)	false
Dec 23, 2024 07:31:02.073760986 CET	1.1.1.1	192.168.2.8	0xf2e1	Name error (3)	home.fivetk5ht.top	none	none	28	IN (0x0001)	false
Dec 23, 2024 07:31:02.076905012 CET	1.1.1.1	192.168.2.8	0x57d0	Name error (3)	home.fivetk5ht.top	none	none	A (IP address)	IN (0x0001)	false
Dec 23, 2024 07:31:02.949420929 CET	1.1.1.1	192.168.2.8	0x209d	Name error (3)	home.fivetk5ht.top	none	none	28	IN (0x0001)	false
Dec 23, 2024 07:31:02.949975967 CET	1.1.1.1	192.168.2.8	0xa94	Name error (3)	home.fivetk5ht.top	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

httpbin.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49704	34.226.108.155	443	3272	C:\Users\user\Desktop\94g4KHMj9B.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-23 06:30:59 UTC	52	OUT	GET /ip HTTP/1.1 Host: httpbin.org Accept: /
2024-12-23 06:30:59 UTC	224	IN	HTTP/1.1 200 OK Date: Mon, 23 Dec 2024 06:30:59 GMT Content-Type: application/json Content-Length: 31 Connection: close Server: gunicorn/19.9.0 Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true
2024-12-23 06:30:59 UTC	31	IN	Data Raw: 7b 0a 20 20 22 6f 72 69 67 69 6e 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 0a 7d 0a Data Ascii: { "origin": "8.46.123.189"}

Target ID:	0
Start time:	01:30:53
Start date:	23/12/2024
Path:	C:\Users\user\Desktop\94g4KHMj9B.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\94g4KHMj9B.exe"
Imagebase:	0x520000
File size:	4'490'240 bytes
MD5 hash:	BC9903CD12A6B359C28E16021909CCB3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:31:02
Start date:	23/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3272 -s 1136
Imagebase:	0xdc0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	134
Total number of Limit Nodes:	11

Executed Functions

Function 072D0B13 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654318036.00000000072D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72d0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0e2d48461ad1a2cb0e006f65b70d5620ea6939ce2ecf19cc07034f757f51b35
Instruction ID: 4f8446e35784c853841685c52e9844bccffd16c1f4755bd80ae8002d85df8b0d
Opcode Fuzzy Hash: b0e2d48461ad1a2cb0e006f65b70d5620ea6939ce2ecf19cc07034f757f51b35
Instruction Fuzzy Hash: BB21F5FB53C214FDA16296825754BFB6B6EE6D7730F308027F807A6A22E2C50F4A5135

Function 073301A0 Relevance: 4.2, APIs: 1, Strings: 1, Instructions: 681
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Process32FirstW.KERNEL32(?,?,47291E99,?), ref: 07330442

Strings

1, xrefs: 073301AD

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID: FirstProcess32
String ID: 1
API String ID: 2623510744-2212294583
Opcode ID: 084d4130b312beb4705733690c29d45a26f085c909abd65cf1baeee2295f837b
Instruction ID: 297bf95e4229da048fc3ae72fcfd9ea38ea2ade14b4607c8f6eca15125da811d
Opcode Fuzzy Hash: 084d4130b312beb4705733690c29d45a26f085c909abd65cf1baeee2295f837b
Instruction Fuzzy Hash: 50E118F726C211BEB22A81456B54AFB6B6FE7C7730B308067F40FD6E42E3944A494671

Function 072F00B9 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 340
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

A:\, xrefs: 072F02A2

Memory Dump Source

Source File: 00000000.00000002.1654369677.00000000072F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72f0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID: A:\
API String ID: 0-3379428675
Opcode ID: c6970347b71323543cfd6248c359645649ee9e6d73edba7e40ed5ff4a3f7e0b1
Instruction ID: 7b38c2c800022aa292b243509d011bba111ebdeb0a23fa064a867d9401ed2793
Opcode Fuzzy Hash: c6970347b71323543cfd6248c359645649ee9e6d73edba7e40ed5ff4a3f7e0b1
Instruction Fuzzy Hash: 9A6180EB23C125BEB621D1962B64AFBA76DE5C7730B30843AFA06C6503E2D44E495271

Function 072F003A Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 339
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

A:\, xrefs: 072F02A2

Memory Dump Source

Source File: 00000000.00000002.1654369677.00000000072F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72f0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID: A:\
API String ID: 0-3379428675
Opcode ID: c16b01bf83ab3bca348918ee086592cc3db93269fe95fc4f532469d78656db1c
Instruction ID: 4c28f9448fc1acd73952b7c4f3362972f11ae10d2a030f91ea23a4e79432ec74
Opcode Fuzzy Hash: c16b01bf83ab3bca348918ee086592cc3db93269fe95fc4f532469d78656db1c
Instruction Fuzzy Hash: B7618FEB23C125BEB221D1922F64AFBA76DE1D7730B30843AFA07C6503E2D44E4A5171

Function 072F0057 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 336
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

A:\, xrefs: 072F02A2

Memory Dump Source

Source File: 00000000.00000002.1654369677.00000000072F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72f0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID: A:\
API String ID: 0-3379428675
Opcode ID: 54a943f2850f8f24f2407016bb5aee0146d49234b0800b5b5c77b88fe099a00b
Instruction ID: 3ca613a90e340bfed4e9d0a1d64fa23a2d4e46b5a966b4709c4bd82507c67663
Opcode Fuzzy Hash: 54a943f2850f8f24f2407016bb5aee0146d49234b0800b5b5c77b88fe099a00b
Instruction Fuzzy Hash: E96190EB23C125BEB621D1926F64AFBA76DE6C7730B30843AFA07D6503E2D44E495131

Function 072F0047 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 335
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

A:\, xrefs: 072F02A2

Memory Dump Source

Source File: 00000000.00000002.1654369677.00000000072F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72f0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID: A:\
API String ID: 0-3379428675
Opcode ID: d22eeeaf242d54b9ca8cfcf83d6aedbcf367509d38176a4866f832f54b40c9d9
Instruction ID: d4b358fdb3cd5983fae5e9b8c02b45d93a9a81a0b282c5867ced98039f60777b
Opcode Fuzzy Hash: d22eeeaf242d54b9ca8cfcf83d6aedbcf367509d38176a4866f832f54b40c9d9
Instruction Fuzzy Hash: 14618EEB23C125BEB221D1922F64AFBA76DE5C7730B30843AFA07C6503E2D54E495171

Function 072F007C Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

A:\, xrefs: 072F02A2

Memory Dump Source

Source File: 00000000.00000002.1654369677.00000000072F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72f0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID: A:\
API String ID: 0-3379428675
Opcode ID: f70de2aa6221692ab07a09b478aa11000ad33caa43d448503c59fc372e9fbd8f
Instruction ID: 81615841037b2b62bebabbb8cbe8c33d9e8a39aebcaf12bbafa330b7dfd28f3d
Opcode Fuzzy Hash: f70de2aa6221692ab07a09b478aa11000ad33caa43d448503c59fc372e9fbd8f
Instruction Fuzzy Hash: 23619FFB23C121BEB221D1926F64AFBA76DE5C7730B30843AFA02D6507E2D44E495131

Function 072F006D Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 328
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

A:\, xrefs: 072F02A2

Memory Dump Source

Source File: 00000000.00000002.1654369677.00000000072F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72f0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID: A:\
API String ID: 0-3379428675
Opcode ID: eb166e69fc81d223928a2de43f739d59075ad6c35da42ee094fd64bffb43281e
Instruction ID: f6059062329dab0eca915faa578b58bd4dfe5b9a4ed99fc9113c9fbebc9b2fb4
Opcode Fuzzy Hash: eb166e69fc81d223928a2de43f739d59075ad6c35da42ee094fd64bffb43281e
Instruction Fuzzy Hash: F8618EFB23C125BEB221D1922F64AFBA76DE5C7730B30843AFA02D6507E2D54E495172

Function 072F00E0 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 323
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

A:\, xrefs: 072F02A2

Memory Dump Source

Source File: 00000000.00000002.1654369677.00000000072F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72f0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID: A:\
API String ID: 0-3379428675
Opcode ID: 9013e84ed3327112bd31f653f5954fe2f970e29efd1460ae42684197c6b19598
Instruction ID: f5ba48d96d4f4893a5b6165b9b046c389bd536787a469e2e9981d4d1a1f0ec8a
Opcode Fuzzy Hash: 9013e84ed3327112bd31f653f5954fe2f970e29efd1460ae42684197c6b19598
Instruction Fuzzy Hash: 92518EEB27C125BE762181922F64AFBA76DE1C3730B30843AFA47C6507E2D44E495131

Function 072F00A9 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 311
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

A:\, xrefs: 072F02A2

Memory Dump Source

Source File: 00000000.00000002.1654369677.00000000072F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72f0000_94g4KHMj9B.jbxd

Similarity

API ID: DrivesLogical
String ID: A:\
API String ID: 999431828-3379428675
Opcode ID: 8e766f1f525029859c50d11f371237fceb7f5ecf36547c96b2be9a41602d0f34
Instruction ID: ce1f836e3378bead2688932132ebaf4419694ade8176b0997e066388aa7b4271
Opcode Fuzzy Hash: 8e766f1f525029859c50d11f371237fceb7f5ecf36547c96b2be9a41602d0f34
Instruction Fuzzy Hash: AE5159EB23C125BEB22291922F64AFBA76DE1C7730B30843AFA07D6507E2D44E495131

Function 072F00FE Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 307
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

A:\, xrefs: 072F02A2

Memory Dump Source

Source File: 00000000.00000002.1654369677.00000000072F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72f0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID: A:\
API String ID: 0-3379428675
Opcode ID: bc39be2ab547ff562c95392e0eb78fb6226e1dfcc3ee9ce3a9d465df2441da08
Instruction ID: de4efac76a03bc17f71fd3232dcf3f3b5774ce1e7b1775f8744d1e6f7bf16a2e
Opcode Fuzzy Hash: bc39be2ab547ff562c95392e0eb78fb6226e1dfcc3ee9ce3a9d465df2441da08
Instruction Fuzzy Hash: 975180FB23C125BEB622C5826F64AFBA76DE5C7730B30843AFA06C6507E2D44E495131

Function 072F00D2 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 302
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

A:\, xrefs: 072F02A2

Memory Dump Source

Source File: 00000000.00000002.1654369677.00000000072F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72f0000_94g4KHMj9B.jbxd

Similarity

API ID: DrivesLogical
String ID: A:\
API String ID: 999431828-3379428675
Opcode ID: 9de6e1c48536665ae0523e46f75f0608d430aeeed7b7e813bfd6b84d1d8b86a0
Instruction ID: 5c6a8cf966865e47f3a9fbf265de96cb4499c9f68d30739216282a1a1531249a
Opcode Fuzzy Hash: 9de6e1c48536665ae0523e46f75f0608d430aeeed7b7e813bfd6b84d1d8b86a0
Instruction Fuzzy Hash: DF515DFB23C125BEB621D1822F64AFBA76DE5C7730B30843AFA06D6507E2D44E495131

Function 072F0112 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 292
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

A:\, xrefs: 072F02A2

Memory Dump Source

Source File: 00000000.00000002.1654369677.00000000072F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72f0000_94g4KHMj9B.jbxd

Similarity

API ID: DrivesLogical
String ID: A:\
API String ID: 999431828-3379428675
Opcode ID: 5747f902de77d6767f4aa35cf9b194715d92db8e8dd86ec361c67b6216d10613
Instruction ID: 2c05e4ba4e88d8ee41bb6e15a21dcb275c87c8be9628ecc6444de055b27498d7
Opcode Fuzzy Hash: 5747f902de77d6767f4aa35cf9b194715d92db8e8dd86ec361c67b6216d10613
Instruction Fuzzy Hash: C5515BFB23C165BEB622D5822F64AFBA76DE5C3730B31843AF906C6507E2D44E495231

Function 072F0128 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 290
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

A:\, xrefs: 072F02A2

Memory Dump Source

Source File: 00000000.00000002.1654369677.00000000072F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72f0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID: A:\
API String ID: 0-3379428675
Opcode ID: c84da2944961981c667536599678d1393adf04ae47af64d889c2bee336bd8bec
Instruction ID: c0532a353e2f13794d52f5988217ad833aa30d1daf185dfbbb91f743cf0a1b9d
Opcode Fuzzy Hash: c84da2944961981c667536599678d1393adf04ae47af64d889c2bee336bd8bec
Instruction Fuzzy Hash: 4A514CFB23C225BEB621D5926F64AFBA76DE5C2730B31843AF902C6507E2D44E495131

Function 072F0141 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 283
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

A:\, xrefs: 072F02A2

Memory Dump Source

Source File: 00000000.00000002.1654369677.00000000072F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72f0000_94g4KHMj9B.jbxd

Similarity

API ID: DrivesLogical
String ID: A:\
API String ID: 999431828-3379428675
Opcode ID: eac21f62ac625a0f72db3badb043540f55716a824e35e00c39024c469cd50334
Instruction ID: 78f85f3eee7e72b0e21ea57ca55f8daa78c54ae57ec226f33aead2db674c31bf
Opcode Fuzzy Hash: eac21f62ac625a0f72db3badb043540f55716a824e35e00c39024c469cd50334
Instruction Fuzzy Hash: AC514BFB23C125BEB621D5822F64AFBA76DE5C6730B31843AF906C6107E2D44E495231

Function 072F015C Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 276
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

A:\, xrefs: 072F02A2

Memory Dump Source

Source File: 00000000.00000002.1654369677.00000000072F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72f0000_94g4KHMj9B.jbxd

Similarity

API ID: DrivesLogical
String ID: A:\
API String ID: 999431828-3379428675
Opcode ID: 46b52df6b92690d6a2117801d5713d3746343e4eaad3dcbe03fe4965a19fc52c
Instruction ID: e6bd9b897cb5731cd9808f3a163a4e49a67b837513f82d22a33b789e8795befc
Opcode Fuzzy Hash: 46b52df6b92690d6a2117801d5713d3746343e4eaad3dcbe03fe4965a19fc52c
Instruction Fuzzy Hash: 54516CFB23C121BEB221D5826B609FBA76DE5C2730B31C47BF906C6107E2E44E495235

Function 072F0181 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 260COMMON

Download Yara Rule

Strings

A:\, xrefs: 072F02A2

Memory Dump Source

Source File: 00000000.00000002.1654369677.00000000072F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72f0000_94g4KHMj9B.jbxd

Similarity

API ID: DrivesLogical
String ID: A:\
API String ID: 999431828-3379428675
Opcode ID: faf69320c6319ef4716519693d40c62786cc53f0e43ece47dffe5b0bc1d35542
Instruction ID: 37fbd1287fa824b2831497424362c76c410959594b5f3d1da0bf11a885282f5b
Opcode Fuzzy Hash: faf69320c6319ef4716519693d40c62786cc53f0e43ece47dffe5b0bc1d35542
Instruction Fuzzy Hash: B2518DFB23C261BE7621D1826B64AFBA76DE5C6730B30847BF906D6107E2E44E495231

Function 072F020B Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 259COMMON

Download Yara Rule

Strings

A:\, xrefs: 072F02A2

Memory Dump Source

Source File: 00000000.00000002.1654369677.00000000072F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72f0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID: A:\
API String ID: 0-3379428675
Opcode ID: f3515d15119b2a47208331ad4f5d89c4818bf3e9201ea37454b5b706c4d3b26e
Instruction ID: 1581ef4f1c673c21274c25615cf0404ef1e93d128fb924c88d1cb7926ca57858
Opcode Fuzzy Hash: f3515d15119b2a47208331ad4f5d89c4818bf3e9201ea37454b5b706c4d3b26e
Instruction Fuzzy Hash: 6E51A2F723C261BEB622D5916B549FBAB6DE5C37307318477F902C6407E2E44E4A5231

Function 072F01B4 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 255COMMON

Download Yara Rule

Strings

A:\, xrefs: 072F02A2

Memory Dump Source

Source File: 00000000.00000002.1654369677.00000000072F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72f0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID: A:\
API String ID: 0-3379428675
Opcode ID: 8a7d30fb48cace594c9350a08df7ead9fec16dd018678de4373d8a2dfc9049c5
Instruction ID: 2c44444cbd0eafc7556f93d4f61db3b270673a257733dfc3a3c1094582503629
Opcode Fuzzy Hash: 8a7d30fb48cace594c9350a08df7ead9fec16dd018678de4373d8a2dfc9049c5
Instruction Fuzzy Hash: 575192E723C161BEB621D1812F649FBA76DD6C7730B30847BF902C6107E2E44E4A5231

Function 072F019D Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

A:\, xrefs: 072F02A2

Memory Dump Source

Source File: 00000000.00000002.1654369677.00000000072F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72f0000_94g4KHMj9B.jbxd

Similarity

API ID: DrivesLogical
String ID: A:\
API String ID: 999431828-3379428675
Opcode ID: de7cacbdd87da02a97d034b3fe7edfca5f6906659fb5820318661ba6a8295b16
Instruction ID: 64a015603a3ca2e6e55a1e5dad29daa9c11c13b2a4f3a79114e7eb9921d1acdb
Opcode Fuzzy Hash: de7cacbdd87da02a97d034b3fe7edfca5f6906659fb5820318661ba6a8295b16
Instruction Fuzzy Hash: 21516DFB23C161BEB622D5826F649FBA76DE5C2730B30843BF906C6107E2E44E495231

Function 072F01DB Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 239COMMON

Download Yara Rule

Strings

A:\, xrefs: 072F02A2

Memory Dump Source

Source File: 00000000.00000002.1654369677.00000000072F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72f0000_94g4KHMj9B.jbxd

Similarity

API ID: DrivesLogical
String ID: A:\
API String ID: 999431828-3379428675
Opcode ID: 43eb963c29aa04cb518f174479930604e5b678d73eec712e863f68bb7a610fb8
Instruction ID: c2fbaf512889b22b5f1b573c6d36f27de7f61c21fa409c1a8464ab4551eea46b
Opcode Fuzzy Hash: 43eb963c29aa04cb518f174479930604e5b678d73eec712e863f68bb7a610fb8
Instruction Fuzzy Hash: AB417DFB23C121BEB621D5826F64AFBA76DE5C2730B318476F906C6107E2E44E495231

Function 072F01F9 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 226COMMON

Download Yara Rule

Strings

A:\, xrefs: 072F02A2

Memory Dump Source

Source File: 00000000.00000002.1654369677.00000000072F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72f0000_94g4KHMj9B.jbxd

Similarity

API ID: DrivesLogical
String ID: A:\
API String ID: 999431828-3379428675
Opcode ID: d1f98074c96a454906e0ae32b85c956c48b1c7d75abb364937aa68d773bbf693
Instruction ID: 44d23068442049aa9e39cfaa27e79187d37dca5e16974a775c4501c43e6ebd0e
Opcode Fuzzy Hash: d1f98074c96a454906e0ae32b85c956c48b1c7d75abb364937aa68d773bbf693
Instruction Fuzzy Hash: B9418FFB23C225BEB621D5826F54AFBA76DE5C2730B308476F902D6107E3E44E495631

Function 072F0237 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

A:\, xrefs: 072F02A2

Memory Dump Source

Source File: 00000000.00000002.1654369677.00000000072F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72f0000_94g4KHMj9B.jbxd

Similarity

API ID: DrivesLogical
String ID: A:\
API String ID: 999431828-3379428675
Opcode ID: 25d10b02cf54b5e54fdce4c351371d23402151664716bfaf69cf2c8b8b4fa915
Instruction ID: 995407b4dd5c5ccf8af4f4cc14013c29cacbe91572547654a83d57c645a5fcfb
Opcode Fuzzy Hash: 25d10b02cf54b5e54fdce4c351371d23402151664716bfaf69cf2c8b8b4fa915
Instruction Fuzzy Hash: D6416DEB23C261BEB621D1922B64AFBA76DE5C2730B31847BF902D5507E2D44E495232

Function 072F026A Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 192COMMON

Download Yara Rule

Strings

A:\, xrefs: 072F02A2

Memory Dump Source

Source File: 00000000.00000002.1654369677.00000000072F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72f0000_94g4KHMj9B.jbxd

Similarity

API ID: DrivesLogical
String ID: A:\
API String ID: 999431828-3379428675
Opcode ID: a5d4e20ef69a15efdc4bdffa9fb9ec302efae654ec99e44e73cc37cfd675cd49
Instruction ID: 78b729c7c2fa1780236ebd3fdd206fd8439e2940edd7e47235ada6fdd24f10e0
Opcode Fuzzy Hash: a5d4e20ef69a15efdc4bdffa9fb9ec302efae654ec99e44e73cc37cfd675cd49
Instruction Fuzzy Hash: 4241C0FB23C261AEB621D5926B64AFBA76DE5C3730B30C47BF902C5007E2E44E495231

Function 072F027E Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 190COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNELBASE(?,0000CA51), ref: 072F0386

Strings

A:\, xrefs: 072F02A2

Memory Dump Source

Source File: 00000000.00000002.1654369677.00000000072F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72f0000_94g4KHMj9B.jbxd

Similarity

API ID: DrivesLogical
String ID: A:\
API String ID: 999431828-3379428675
Opcode ID: 224e0f9ac048166532255c7739dd6cdc3be8fceb161799831cd94c713cdbadbf
Instruction ID: 910e39bea71ee4d3e6ac31863db3d9091d6e7033b6df69da8b89293a9b102686
Opcode Fuzzy Hash: 224e0f9ac048166532255c7739dd6cdc3be8fceb161799831cd94c713cdbadbf
Instruction Fuzzy Hash: 3341A5FB13C221BE762191922B64AFBA76DE5C7730B30C477F902C6507E6E44E495631

Function 072F0286 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 187COMMON

Download Yara Rule

Strings

A:\, xrefs: 072F02A2

Memory Dump Source

Source File: 00000000.00000002.1654369677.00000000072F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72f0000_94g4KHMj9B.jbxd

Similarity

API ID: DrivesLogical
String ID: A:\
API String ID: 999431828-3379428675
Opcode ID: 90f07b0e9eac1aed904f760c904802c5d2b5c8ec9465a0685e8e2904da9f2338
Instruction ID: 2c88f1f07d7b255750477b59c1dd0fe5256325d6495bdb6e053af5ab9e90b716
Opcode Fuzzy Hash: 90f07b0e9eac1aed904f760c904802c5d2b5c8ec9465a0685e8e2904da9f2338
Instruction Fuzzy Hash: 6A41A2F723C221BEB62195922B64AFBA76DE5C3730B30C477F942C5107E6E44E495631

Function 072F02A1 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

A:\, xrefs: 072F02A2

Memory Dump Source

Source File: 00000000.00000002.1654369677.00000000072F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72f0000_94g4KHMj9B.jbxd

Similarity

API ID: DrivesLogical
String ID: A:\
API String ID: 999431828-3379428675
Opcode ID: c598b556ee2e22693b3908f6ac062c8d5debf2075c240f97b9a4f34ba60384c7
Instruction ID: 13f6ddf1899b7f91f457b9d40bdc8981c9a88c78815ca0a10bd2ec2282dc5233
Opcode Fuzzy Hash: c598b556ee2e22693b3908f6ac062c8d5debf2075c240f97b9a4f34ba60384c7
Instruction Fuzzy Hash: 4F3191FB23C221BEB62191922B64AFBA76DE5C3730B30C47BF902C5507E2E44E495631

Function 0733000F Relevance: 2.3, APIs: 1, Instructions: 778COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc12570b4c0819c790833d84f5613734a8dafe18862d50057341805e436c0a5c
Instruction ID: cb0e1b84ac710d601ec23099c50927bf130e016ae44c5a444e3269628943d06f
Opcode Fuzzy Hash: cc12570b4c0819c790833d84f5613734a8dafe18862d50057341805e436c0a5c
Instruction Fuzzy Hash: 82F128F716C111BEB22A81856B54AFB6B6FE7C7730F308466F40FDAE42E2944E494271

Function 07330000 Relevance: 2.3, APIs: 1, Instructions: 774COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e28fd14744d3861d9fdee9a3798b53dbcf39f511c371f2bad20a60334dbf1ef
Instruction ID: 68ba7697781ea7e21c01ad1fb790a973db7452b6e787fff6c308f9155dbe5273
Opcode Fuzzy Hash: 7e28fd14744d3861d9fdee9a3798b53dbcf39f511c371f2bad20a60334dbf1ef
Instruction Fuzzy Hash: 48F127FB16C111BEB22A81856B54AFB6B6FE7C7730F308066F40FDAE42E2944E494171

Function 0733002A Relevance: 2.3, APIs: 1, Instructions: 769COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5ac9b87a038512d43e021746b2581f9c8e5e426a29a92c1a74db8e0ca998d1a
Instruction ID: 29bfb74fb18995589e1638011b3e9bbb8d74fd07d39ff4dea418dcad3f6a822c
Opcode Fuzzy Hash: e5ac9b87a038512d43e021746b2581f9c8e5e426a29a92c1a74db8e0ca998d1a
Instruction Fuzzy Hash: A7F117F716C111BEB22A81856B54AFB6B6FE7C7730F308066F40FDAE42E2944E494271

Function 0733003C Relevance: 2.3, APIs: 1, Instructions: 766COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17853ca4ea8ef676ea3849efcd506d48b4609fc77d516ce6ad9747d3b4fc0f8c
Instruction ID: 49ed684c7240ae0d46149b11b5c22f5afe09f8cdfe440e8d5dae7a6d5b0c1ec3
Opcode Fuzzy Hash: 17853ca4ea8ef676ea3849efcd506d48b4609fc77d516ce6ad9747d3b4fc0f8c
Instruction Fuzzy Hash: 80F116F716C111BEB22A81856B54AFB6B6FE7C7730F308466F40FDAE42E2944E494271

Function 07330073 Relevance: 2.3, APIs: 1, Instructions: 762COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6808cdd0dd5534bac1fd5bbfcd27d4b9e65d03789b486e3b2831cea926d215da
Instruction ID: 946f30cbfa0920fd9b7971744aa79e3f9b23884880dbcf7b6f7dbc84e203e7eb
Opcode Fuzzy Hash: 6808cdd0dd5534bac1fd5bbfcd27d4b9e65d03789b486e3b2831cea926d215da
Instruction Fuzzy Hash: 55F117F716C111BEB22A81456B54AFB6B6FE7C7730F308467F40FDAE42E2944A494271

Function 0733005B Relevance: 2.3, APIs: 1, Instructions: 758COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81a97b624eaf2c25e49606a81eeee251547a4b9e8e4c7d5cdd5642b9e5d6c4c4
Instruction ID: 1d1e45724785aa0ee9617fc958e39323c529b37ba3d8b262f804a68c11dd1239
Opcode Fuzzy Hash: 81a97b624eaf2c25e49606a81eeee251547a4b9e8e4c7d5cdd5642b9e5d6c4c4
Instruction Fuzzy Hash: 1BF128F726C111BEB22A81456B54AFB6B6FE7C7730F308026F40FD6E42E2944E494171

Function 0733008C Relevance: 2.2, APIs: 1, Instructions: 749COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e096d07e5cae832abfd64f790bbcf0f1adae163bcee4534816a712d8651f5fe
Instruction ID: 8d12352d343b5e44744f71cdaa015a4dd6089530c49606a7ae10096c4e38aaa2
Opcode Fuzzy Hash: 3e096d07e5cae832abfd64f790bbcf0f1adae163bcee4534816a712d8651f5fe
Instruction Fuzzy Hash: E6F116FB16C111BEB22A81856B54AFB6B6FE7C7730F308467F40FD6E02E2944A494671

Function 07330095 Relevance: 2.2, APIs: 1, Instructions: 744COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bfb06b65bbf39c092004d8953006f51d0f8a30432f4f7c1524aba149e6b8369
Instruction ID: e545cee50b1e3b64771c5d7513485131745c7b8cf8257c0c6937e11b1efc658d
Opcode Fuzzy Hash: 7bfb06b65bbf39c092004d8953006f51d0f8a30432f4f7c1524aba149e6b8369
Instruction Fuzzy Hash: B2F127F716C111BEB22A81856B54AFB6B6FE7C7730F308467F40FD6E02E2944A494671

Function 07330128 Relevance: 2.2, APIs: 1, Instructions: 733COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98eba488666f7bfea17fd6366b18fdf545cd8c5a6b875389903f84f95ee7baa7
Instruction ID: 297e6f7f982adfe2278a5200b076a8052005e5593e3afa00193c83373ca56e11
Opcode Fuzzy Hash: 98eba488666f7bfea17fd6366b18fdf545cd8c5a6b875389903f84f95ee7baa7
Instruction Fuzzy Hash: 34F127F716C111BEB22A85856B54AFB6B6FE7C7730B308027F40FD6E02E2944E494671

Function 073300CE Relevance: 2.2, APIs: 1, Instructions: 728COMMON

Download Yara Rule

APIs

Process32FirstW.KERNEL32(?,?,47291E99,?), ref: 07330442

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: 0407fcd44c8e2b24c7912704750e2adfa722fca8fe0fcab9223b90490389f196
Instruction ID: 122a49eb178bd6c3abc01be55bb90d263dfd8ac495715904de0b3bc2089c67d8
Opcode Fuzzy Hash: 0407fcd44c8e2b24c7912704750e2adfa722fca8fe0fcab9223b90490389f196
Instruction Fuzzy Hash: 2AF117F716C121BEB22A81856B54AFB6B6FE6C7730F308067F40FD6E42E2944E494671

Function 073300C7 Relevance: 2.2, APIs: 1, Instructions: 725COMMON

Download Yara Rule

APIs

Process32FirstW.KERNEL32(?,?,47291E99,?), ref: 07330442

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: 23151515fb26297b18fd537a2f13c1725d5f9ebdfd6bea4e053c41b83a090089
Instruction ID: 4947285a157e35e7539d6b05859c5bb69ec3752e8ee8bede6430596a2cb4c6f6
Opcode Fuzzy Hash: 23151515fb26297b18fd537a2f13c1725d5f9ebdfd6bea4e053c41b83a090089
Instruction Fuzzy Hash: B8F107F726C111BEB22A81856B54AFB6B6FE6C7730F308067F40FD6E02E2944E495671

Function 07330100 Relevance: 2.2, APIs: 1, Instructions: 718COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59c4976484e8d3deab5e2d608fb018f43ae533a341e593c00fe361f818c86d83
Instruction ID: 684d3e8242e356e65de68eb72df051beff5941c1f0b959301a84afeaee8b3bcb
Opcode Fuzzy Hash: 59c4976484e8d3deab5e2d608fb018f43ae533a341e593c00fe361f818c86d83
Instruction Fuzzy Hash: 60E117F726C111BEB22A85456B54AFB6B6FE7C7730B308067F40FD6E02E2944E494671

Function 07330162 Relevance: 2.2, APIs: 1, Instructions: 713COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d28f1761ac118125a3022a8819ad73881d1dd66e7a06e40f486e848a18afacb2
Instruction ID: c64600566550ae5061fbc1994210e79063e8c9fa995ea2b902e9da59f7a9b77c
Opcode Fuzzy Hash: d28f1761ac118125a3022a8819ad73881d1dd66e7a06e40f486e848a18afacb2
Instruction Fuzzy Hash: FCE138FB16C111BEB22A85856B54AFB6B6FE7C7730B308027F40FD6E02E2944E495671

Function 07330110 Relevance: 2.2, APIs: 1, Instructions: 707COMMON

Download Yara Rule

APIs

Process32FirstW.KERNEL32(?,?,47291E99,?), ref: 07330442

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: 94f7aa82fc3faa9b05bf2206d61acc0301044da1c84946e03568a35d7c20fecf
Instruction ID: 507ca7b17ebfd12ad8284a9c1a7ceb1b267e6a5b6436128254ba9aa69c9b78f5
Opcode Fuzzy Hash: 94f7aa82fc3faa9b05bf2206d61acc0301044da1c84946e03568a35d7c20fecf
Instruction Fuzzy Hash: D9E116F726C111BEB22A81856B54AFB6B6FE6C7730B308067F40FD6E02E2944E494671

Function 07330145 Relevance: 2.2, APIs: 1, Instructions: 704COMMON

Download Yara Rule

APIs

Process32FirstW.KERNEL32(?,?,47291E99,?), ref: 07330442

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: d23e8d071ec426119ca8878e5a1521e39659dce24bee41452d9c7e297e98902c
Instruction ID: c5e9e97d680179d972ac03ddeee1c3384f7453dc1428c96d45086bc52efd2bfc
Opcode Fuzzy Hash: d23e8d071ec426119ca8878e5a1521e39659dce24bee41452d9c7e297e98902c
Instruction Fuzzy Hash: DFE126F726C111BEB22A81856B54AFB6B6FE7C7730F308067F40FD6E42E2944A494671

Function 07330177 Relevance: 2.2, APIs: 1, Instructions: 694COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d9218454504e1dbcdc4ac5318c5bbb6b1dff69c8227897b9a6bd5ec04e5b87b
Instruction ID: af35c69033006ae80fb86bb59dc334329af15fc120bb506c78aae9ac2d94dcd5
Opcode Fuzzy Hash: 6d9218454504e1dbcdc4ac5318c5bbb6b1dff69c8227897b9a6bd5ec04e5b87b
Instruction Fuzzy Hash: F4E128F726C211BEB22A81452B54AFB6B6FE7C7730F308467F40FD6E02E2944A495671

Function 07330195 Relevance: 2.2, APIs: 1, Instructions: 683COMMON

Download Yara Rule

APIs

Process32FirstW.KERNEL32(?,?,47291E99,?), ref: 07330442

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: 15f2b1f27e8ca663755dcad5440e289abcbc7e3c8bcd4b39fa996d9f13c57af6
Instruction ID: 5e54d049de0db44ba8a1df64c7761c5e2d652013e42d71993a847b3ab9adca56
Opcode Fuzzy Hash: 15f2b1f27e8ca663755dcad5440e289abcbc7e3c8bcd4b39fa996d9f13c57af6
Instruction Fuzzy Hash: 68E127F726C111BEB22A81456B54AFB6B6FE6C7730B308027F40FD6E02E2944A495671

Function 073301CD Relevance: 2.2, APIs: 1, Instructions: 660COMMON

Download Yara Rule

APIs

Process32FirstW.KERNEL32(?,?,47291E99,?), ref: 07330442

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: b729b39ad2a490c9bd6a7847ffd1d6240c2fefe56209dcd1295f345215d80840
Instruction ID: 7b944c645dce16ae2fd538b79051f65117e7c35dd24730a4fe6e66f31214a3fc
Opcode Fuzzy Hash: b729b39ad2a490c9bd6a7847ffd1d6240c2fefe56209dcd1295f345215d80840
Instruction Fuzzy Hash: 75E107F726C111BEB22A81856B54AFB6B6FE7C7730F308067F40FD6E42E2944A494671

Function 07330273 Relevance: 2.2, APIs: 1, Instructions: 658COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d4278bf984ed60a16861e605625cf2152828d5d330459fce6023f36edc3c2c5
Instruction ID: 16b57e6f7419deba86d17f0c742f5cbed87d4ccf6be96c41c6f48a950386150a
Opcode Fuzzy Hash: 5d4278bf984ed60a16861e605625cf2152828d5d330459fce6023f36edc3c2c5
Instruction Fuzzy Hash: A6E126F716C111BEB22A81856B54AF76B6FE7C7730B308467F40FDAE02E2944A494671

Function 073301DA Relevance: 2.2, APIs: 1, Instructions: 656COMMON

Download Yara Rule

APIs

Process32FirstW.KERNEL32(?,?,47291E99,?), ref: 07330442

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: bad1dca65f5b6f86b62d966cd26987485d2f3c4d256612b1383b1b6c83110205
Instruction ID: f3163f2bcaebfb5ee73ff13a365bb7b7282c8a1d68346370b7410539c4566165
Opcode Fuzzy Hash: bad1dca65f5b6f86b62d966cd26987485d2f3c4d256612b1383b1b6c83110205
Instruction Fuzzy Hash: CAE127F726C111BEB22A81452B54AFB6B6FE7C7730F308067F40FD6E02E2944A494671

Function 073301F9 Relevance: 2.2, APIs: 1, Instructions: 653COMMON

Download Yara Rule

APIs

Process32FirstW.KERNEL32(?,?,47291E99,?), ref: 07330442

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: 9af833b08b0ad90bd2adfedaa9c510e80e55be30bd204132ce899025ec0b79f7
Instruction ID: dc506c7e78c3091f9b279041d690f0a38b363f8565ad72d87c69246a80bbe25f
Opcode Fuzzy Hash: 9af833b08b0ad90bd2adfedaa9c510e80e55be30bd204132ce899025ec0b79f7
Instruction Fuzzy Hash: 5DE137F716C111BEB22A81856B54AFB6B6FE7C7730F308427F40FD6E02E2944A494671

Function 07330215 Relevance: 2.2, APIs: 1, Instructions: 650COMMON

Download Yara Rule

APIs

Process32FirstW.KERNEL32(?,?,47291E99,?), ref: 07330442

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: 43695718aa7e9dd4ecc2cac84840ec4edc85dbd06ccc91b4e9e65e9ffce2ae8b
Instruction ID: b5ed90e5cfdf3f38fb2402a274beabed9bd014016ef2fefddc3665e4c61ac808
Opcode Fuzzy Hash: 43695718aa7e9dd4ecc2cac84840ec4edc85dbd06ccc91b4e9e65e9ffce2ae8b
Instruction Fuzzy Hash: BBD116F716C111BEB22A81856B54AFB6B6FE7C7730B308467F40FD6E02E2944A494671

Function 07330239 Relevance: 2.1, APIs: 1, Instructions: 644COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26959a8783f0e3a87c519b44420c6b1d8ad4dcfc1954a392e85461de36b64f74
Instruction ID: 88643535725cf9a3423dbb647d840d00268b69d556157cf831e71834413e8557
Opcode Fuzzy Hash: 26959a8783f0e3a87c519b44420c6b1d8ad4dcfc1954a392e85461de36b64f74
Instruction Fuzzy Hash: 9AD127E716C221BEB22A81856B54AF76B6FE7C7730F308467F40FD6E02E3944A494671

Function 0733029A Relevance: 2.1, APIs: 1, Instructions: 642COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc81bd6be99c6b29bca0f3a2d789c1d1a30a0db8b9eeec1148f9f44b9b731646
Instruction ID: fe9ee9afec91f49f9a484113d554823d5c2cae5c60b6c30eed552e3c01f52d1f
Opcode Fuzzy Hash: dc81bd6be99c6b29bca0f3a2d789c1d1a30a0db8b9eeec1148f9f44b9b731646
Instruction Fuzzy Hash: CED139F726C121BEB22A81856B54AFB6B6FE7C7730B308467F40FD6D02E3944A494571

Function 0733025B Relevance: 2.1, APIs: 1, Instructions: 636COMMON

Download Yara Rule

APIs

Process32FirstW.KERNEL32(?,?,47291E99,?), ref: 07330442

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: 8bab0bb904c347e74dfcf05da1fe469f7cc5470f6d8ec94ae739761ed8086688
Instruction ID: ed37ad55ae854b3506ab2bfcc47504d95b37948b1fcd528bfc9f7478f3116cbe
Opcode Fuzzy Hash: 8bab0bb904c347e74dfcf05da1fe469f7cc5470f6d8ec94ae739761ed8086688
Instruction Fuzzy Hash: C1D128F726C121BEB22A81856B54AFB6B6FE7C7730B308467F40FD6E02E3944A494571

Function 073302B3 Relevance: 2.1, APIs: 1, Instructions: 636COMMON

Download Yara Rule

APIs

Process32FirstW.KERNEL32(?,?,47291E99,?), ref: 07330442

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: b597cd56cb4e8a445c3b9260fe84c36b1028f8e10b28bc8da5777113aabbba7e
Instruction ID: 68c362734e09323e9774824c1fcb3adb02baac7088be90efcf3bbb37d21a6e7a
Opcode Fuzzy Hash: b597cd56cb4e8a445c3b9260fe84c36b1028f8e10b28bc8da5777113aabbba7e
Instruction Fuzzy Hash: FAD147F726C221BEB22A81552B54AFB6B6FE7C7730B308477F40FD6D02E2944A4A4571

Function 07330286 Relevance: 2.1, APIs: 1, Instructions: 625COMMON

Download Yara Rule

APIs

Process32FirstW.KERNEL32(?,?,47291E99,?), ref: 07330442

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: 7333dd3cdada28bce076d1fdd82582e8cb0afd19c244d3e5abb56344f6fdcd0f
Instruction ID: 314875603474ad6826a090322653fb9d4e8aa3fd974b8c692104bd353730cd12
Opcode Fuzzy Hash: 7333dd3cdada28bce076d1fdd82582e8cb0afd19c244d3e5abb56344f6fdcd0f
Instruction Fuzzy Hash: 81D127F726C121BEB22A81856B54AFB6B6FE7C7730B308467F40FD6E02E2944A494571

Function 0733038F Relevance: 2.1, APIs: 1, Instructions: 613COMMON

Download Yara Rule

APIs

Process32FirstW.KERNEL32(?,?,47291E99,?), ref: 07330442

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: bb19ce0782b624e96ff11c3d431b8e64da9761520030bd65390231714daabf96
Instruction ID: eb7f54f1be5651bcdef8f6ba40fb7ea4f4356992bae2cc053952f89c2670b0cc
Opcode Fuzzy Hash: bb19ce0782b624e96ff11c3d431b8e64da9761520030bd65390231714daabf96
Instruction Fuzzy Hash: 80D138F726C211BEB22A81856F54AFB6B6FE7C7730B308167F40FD6D02E2944A494571

Function 073302FC Relevance: 2.1, APIs: 1, Instructions: 608COMMON

Download Yara Rule

APIs

Process32FirstW.KERNEL32(?,?,47291E99,?), ref: 07330442

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: ab13925b5495e319c7347578f6e29bca8503379759394c7c08cb006787ee853e
Instruction ID: 9aa672c29ccc6addf94cc6e0b9f3f16613cbe8d622328a2cf5108df1839fba26
Opcode Fuzzy Hash: ab13925b5495e319c7347578f6e29bca8503379759394c7c08cb006787ee853e
Instruction Fuzzy Hash: 34D127F726C221BEB22A81856B54AFB6B6FE7C7730B308467F40FD6D02E3944A494571

Function 07330312 Relevance: 2.1, APIs: 1, Instructions: 600COMMON

Download Yara Rule

APIs

Process32FirstW.KERNEL32(?,?,47291E99,?), ref: 07330442

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: b8b438e2d4443ebf31f60f723dd824d398664c7caf1b73f6189ad74638be288c
Instruction ID: 2612ff98b0530a5209d1d644a7c61cc968480279799349688a7468d632ec59c7
Opcode Fuzzy Hash: b8b438e2d4443ebf31f60f723dd824d398664c7caf1b73f6189ad74638be288c
Instruction Fuzzy Hash: 3BD127F726C221BEB22A81856B54AFB6B6FE7C7730B308467F40FD6D02E2944A494571

Function 0733033A Relevance: 2.1, APIs: 1, Instructions: 594COMMON

Download Yara Rule

APIs

Process32FirstW.KERNEL32(?,?,47291E99,?), ref: 07330442

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: fd4a197e44721ab432cb78adf8be88367aecfcc15dbca6a5b3ff44ddb144bfb6
Instruction ID: 1979823aae3f6bd5e17fa61eab26f6b3d6dba2875ef7deffffd3dbbe30c5af41
Opcode Fuzzy Hash: fd4a197e44721ab432cb78adf8be88367aecfcc15dbca6a5b3ff44ddb144bfb6
Instruction Fuzzy Hash: E0D127F726C211BEB22A81856B54AFB6B6FE7C7730B308067F40FD6A02E2944A494571

Function 073303C0 Relevance: 2.1, APIs: 1, Instructions: 588COMMON

Download Yara Rule

APIs

Process32FirstW.KERNEL32(?,?,47291E99,?), ref: 07330442

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: f15b13493bb0151665e18e2a11c068a9dc2065d69bcb3251cef406abfcd3e908
Instruction ID: 13f4770d2ba52f5fd5e208cec93ab2e4d6f46ae5060ec2c6cd37a17fd96db5f1
Opcode Fuzzy Hash: f15b13493bb0151665e18e2a11c068a9dc2065d69bcb3251cef406abfcd3e908
Instruction Fuzzy Hash: CAC148F725C211BEB22A81956F14AF76B6FE7C7730B308067F44FD6E02E2944A4A4671

Function 07330358 Relevance: 2.1, APIs: 1, Instructions: 584COMMON

Download Yara Rule

APIs

Process32FirstW.KERNEL32(?,?,47291E99,?), ref: 07330442

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: bafa48edecdaed2a775fa98432f7ded6dabcf95b70852da7b7cc37519f5d5722
Instruction ID: 982cce191d9ae6fdef119a48efbe55a707c09d873fc5b5c5638013506e0c25a2
Opcode Fuzzy Hash: bafa48edecdaed2a775fa98432f7ded6dabcf95b70852da7b7cc37519f5d5722
Instruction Fuzzy Hash: F5C137F726C211BEB22A81856B54AFB6B6FE7C7730B308067F40FD6D02E2944A494571

Function 07330371 Relevance: 2.1, APIs: 1, Instructions: 581COMMON

Download Yara Rule

APIs

Process32FirstW.KERNEL32(?,?,47291E99,?), ref: 07330442

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: 40d7a66f22da0353abb9c1ce5a5f53600a8cb26860fefd9048c4049b95aa5f15
Instruction ID: 0900eafd08b9d1a01d36e12e09e05b9b52e9cb69ca7e4af3e8dbad63a0165b81
Opcode Fuzzy Hash: 40d7a66f22da0353abb9c1ce5a5f53600a8cb26860fefd9048c4049b95aa5f15
Instruction Fuzzy Hash: 91C127F726C211BEB22A81856B54AFB6B6FE7C7730B308467F40FD6E02E2944A494571

Function 073303D7 Relevance: 2.1, APIs: 1, Instructions: 562COMMON

Download Yara Rule

APIs

Process32FirstW.KERNEL32(?,?,47291E99,?), ref: 07330442

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: 4df56c097a224251f5a8cddfd790b33970595167d05de0824ce439ecb93ae8e7
Instruction ID: e64d25a395e663e39305593a9d605e265913661f72e7ee9f50db083b0bb1fd0e
Opcode Fuzzy Hash: 4df56c097a224251f5a8cddfd790b33970595167d05de0824ce439ecb93ae8e7
Instruction Fuzzy Hash: 3DC149F725C211BEB22A81856B54AFB6B6FE7C7730B308477F40FD6D02E2944A4A4671

Function 073303F4 Relevance: 2.1, APIs: 1, Instructions: 559COMMON

Download Yara Rule

APIs

Process32FirstW.KERNEL32(?,?,47291E99,?), ref: 07330442

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: 031fae3915e988c37e4818c3ee72f29e831beb41531799f16cf0d69e0f5366af
Instruction ID: 35385a837106f60b0ab7becae880f54e830bc9512f66f240986225c1f97de57e
Opcode Fuzzy Hash: 031fae3915e988c37e4818c3ee72f29e831beb41531799f16cf0d69e0f5366af
Instruction Fuzzy Hash: 51C147F725C211BEB22A85452B54AFB6B6FE7C7730B308077F40FC6E02E2944A494671

Function 07330425 Relevance: 2.0, APIs: 1, Instructions: 541COMMON

Download Yara Rule

APIs

Process32FirstW.KERNEL32(?,?,47291E99,?), ref: 07330442

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: 0a84ee292e4ac56e69415d6ad220d0712f2dad678c0862900b07a63119f422f3
Instruction ID: b15acfdcceac557d2f86d0090114111f0eda251180221eda8b2e7e80f7c59648
Opcode Fuzzy Hash: 0a84ee292e4ac56e69415d6ad220d0712f2dad678c0862900b07a63119f422f3
Instruction Fuzzy Hash: CBC148F725C211BEB22A85856B54AFB6B6FE7C7730B308077F40FD6E02E2944A494671

Function 07340000 Relevance: 1.9, APIs: 1, Instructions: 428COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27c789e8e5c114f2cf203e2ad6c622c855afd14dbb4687873403f1209a2ed363
Instruction ID: 3b9f98ee610e5ca2d487e9f77a69da11bc71807c9ac7c9a1f222807814eefaa1
Opcode Fuzzy Hash: 27c789e8e5c114f2cf203e2ad6c622c855afd14dbb4687873403f1209a2ed363
Instruction Fuzzy Hash: 758194EB36C120BD714E81516B54AFB6AAEE1D7730F3084A6F60FD6E42E2D86F491431

Function 07340027 Relevance: 1.9, APIs: 1, Instructions: 421COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd4c5bd2d0c58525675479540f50bdfca4d13984e1e0efb29d0e2f5762ee85f3
Instruction ID: c594d6d5c908acd33cd3ea147fc03d65a2f13e6f3e755408f3d3a901e9fac93a
Opcode Fuzzy Hash: bd4c5bd2d0c58525675479540f50bdfca4d13984e1e0efb29d0e2f5762ee85f3
Instruction Fuzzy Hash: B981A4EB36C120BD714E81516B54AFB6AAEE2D7730F3084A6F50FD6E42E2D86F491431

Function 07340040 Relevance: 1.9, APIs: 1, Instructions: 414COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4202d3c578aa6a66fd53a7d8339f86707d92eb3718328af8bd29a3b7f917dcc
Instruction ID: ee792ec95ff0347740cb4454f7efdff6a98a1ae8a0dc9db901f3ac0a3891ecc5
Opcode Fuzzy Hash: e4202d3c578aa6a66fd53a7d8339f86707d92eb3718328af8bd29a3b7f917dcc
Instruction Fuzzy Hash: B68192EB36C120BDB14E81516B55AFB6AAEE1C7730F3084A6F50FD6E42E2986F4D1431

Function 0734005E Relevance: 1.9, APIs: 1, Instructions: 413COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4130af54571e52af2153cfe228c8fc0d94eac4ed93a27f7db4f7920fed815f41
Instruction ID: 2f2b247a727f283b6bd3f23e71bd9d8fbe303f20533d628fe274cd7db8ee4f5c
Opcode Fuzzy Hash: 4130af54571e52af2153cfe228c8fc0d94eac4ed93a27f7db4f7920fed815f41
Instruction Fuzzy Hash: A78195EB36C121BD714E81416B54AF76BAEE2D7730F3084A6F50FD6E42E2986F491431

Function 07340156 Relevance: 1.9, APIs: 1, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad175fa7c92c61909a3caedcdbfa757a1717177d3178dd9a7ab97053491504fb
Instruction ID: 4ed02b3ec832515d8dd7b55b5cb154e2fbfacf5a79664b49204e6631f7a9e63c
Opcode Fuzzy Hash: ad175fa7c92c61909a3caedcdbfa757a1717177d3178dd9a7ab97053491504fb
Instruction Fuzzy Hash: 2181F5EB36C121BDB10E81516B54AF72BAEE5D7330B3084A7F50FD6E42E2886F4A5531

Function 07340093 Relevance: 1.9, APIs: 1, Instructions: 390COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfd166672dbc398f7e4cbd425917ee5228dce93602dfd24e245bd47dab8d0b52
Instruction ID: 36d7308845ca73f8ce617577b38290d355a0e7f61debf17f355567eae44afe80
Opcode Fuzzy Hash: bfd166672dbc398f7e4cbd425917ee5228dce93602dfd24e245bd47dab8d0b52
Instruction Fuzzy Hash: 407182EB36C121BDB14E81416B54AF76AAEE2D7730F3084A6F50FD6E42E2986F491431

Function 0734009F Relevance: 1.9, APIs: 1, Instructions: 386COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6427be3f6936f93b7db3a7260b6534ba128ac194d08b8b1c0229a794a5dcc606
Instruction ID: cf50732edb16d55ef3783ed7c6e26b3feb3595e57c0052503bbeb671fe4c0ec2
Opcode Fuzzy Hash: 6427be3f6936f93b7db3a7260b6534ba128ac194d08b8b1c0229a794a5dcc606
Instruction Fuzzy Hash: 7E7194EB36C121BDB14E81416B54AF76AAEE2D7730F3084A6F50FD6E42E2D86F491431

Function 0734011D Relevance: 1.9, APIs: 1, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a368048f6a0bb1655b77b7b7ba0080f6a6aabfdf7d791fb05959c3769c44813
Instruction ID: f07a6b18ffb19ec098a5cd882c507c0b17ab61aeb568e197b8091e7463314dd5
Opcode Fuzzy Hash: 1a368048f6a0bb1655b77b7b7ba0080f6a6aabfdf7d791fb05959c3769c44813
Instruction Fuzzy Hash: 2371F5EB35C220BDB10E81512B54AF76AAEE2C7330F3084A6F50FD6E42F2986F495431

Function 073400F1 Relevance: 1.9, APIs: 1, Instructions: 369COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed15e800ff3c3060e1b3bf0f01dc7e0a334a1aed775589cf784947dde475f234
Instruction ID: 0b6130f713a9a6e71390b5c41fd0d94e524df734d84e024fe2b4796bc5da81e6
Opcode Fuzzy Hash: ed15e800ff3c3060e1b3bf0f01dc7e0a334a1aed775589cf784947dde475f234
Instruction Fuzzy Hash: 3C71B5EB35C121BDB14E81416B54AFB6AAEE1D7730F3084A6F60FD6E42E2986F491431

Function 073400CF Relevance: 1.9, APIs: 1, Instructions: 368COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3712a750a10bc35565db2c5b73bcd8464795fa59e1afce67d8fcb3b1684bb05
Instruction ID: 30e098ac75cf66a565b554166dbc81dd5fc7a592fdf099ca3bf2e7a3219ce2ef
Opcode Fuzzy Hash: d3712a750a10bc35565db2c5b73bcd8464795fa59e1afce67d8fcb3b1684bb05
Instruction Fuzzy Hash: 1471C5EB35C120BD714E81416B55AF76AAEE2D7730F3084A6F90FD6E42E2D86F491431

Function 073400BF Relevance: 1.9, APIs: 1, Instructions: 367COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d05e0a419b021b9e508917d19779ed995285c22db029acf8178a6bb0f308122
Instruction ID: 5e45849004c28c1800da9d50114f95917932d2456887b51b1a5753471827ea13
Opcode Fuzzy Hash: 5d05e0a419b021b9e508917d19779ed995285c22db029acf8178a6bb0f308122
Instruction Fuzzy Hash: 197193EB36C121BD714E81416B54AF76AAEE2D7730F3084A6F60FD6E42E2D86F491431

Function 07340144 Relevance: 1.8, APIs: 1, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4e68b6cda14c6be7097d00b8afaa320a25a0780082d93889f8dc08e9929a1f7
Instruction ID: 50cf841a37696e9bd1feaa9652626556690d33dfa0302e6e2490050ef1a571ad
Opcode Fuzzy Hash: f4e68b6cda14c6be7097d00b8afaa320a25a0780082d93889f8dc08e9929a1f7
Instruction Fuzzy Hash: A361A4EB36C120BD714E81416B54AF76AAEE2D7730F3084A6F50FD6E42E2D86F491431

Function 0734019C Relevance: 1.8, APIs: 1, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c776a78bd0d6f274b925735fe496fcf12e039a72fc1c4ac4e6df1b0991199a5d
Instruction ID: ac54104fcfa060824ed6249d9a43778283f75bef61bea02c7feb44d100fa2e42
Opcode Fuzzy Hash: c776a78bd0d6f274b925735fe496fcf12e039a72fc1c4ac4e6df1b0991199a5d
Instruction Fuzzy Hash: E151E6EB35C121BDB10E91516B54AFB6AAEE2D3330F3084A6F50FD6E42E2986F4D1431

Function 073401CC Relevance: 1.8, APIs: 1, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1a699a40f9021db3fb4c9dc6e322b721b4ff9566b6b60b627e869cec4940ddd
Instruction ID: 45fe76fc1a383a1d41e3432674a2d1f77bc73314f1573bba689259fb3f5d2d36
Opcode Fuzzy Hash: b1a699a40f9021db3fb4c9dc6e322b721b4ff9566b6b60b627e869cec4940ddd
Instruction Fuzzy Hash: 9351C5EB35C121BDB14E81416B54AF75AAEE2D7330F3084A6F50FD6E42E2D86F491431

Function 073401DC Relevance: 1.8, APIs: 1, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c750199812cc47fc1db6bc07d8ddfb3c0066d28a76698ef73529f52bac79f0c5
Instruction ID: 3d3785dafd729fef0e50ce9ec3eb6a815413b51c2dced5687e337ff7a9c628af
Opcode Fuzzy Hash: c750199812cc47fc1db6bc07d8ddfb3c0066d28a76698ef73529f52bac79f0c5
Instruction Fuzzy Hash: 8351B4EB36C121BDB10E81416B54AF76AAEE2D7730F3084A6F50FD6E42E2D86F491431

Function 07340201 Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ec227f0020e870f93af34680b4abd1d4b2156e9cc6e913cc85bacba9a6ad588
Instruction ID: 22e3ecc89f6e41dcb152a00034a05280d751a0dd71b3e897d02ef2fd1483173d
Opcode Fuzzy Hash: 5ec227f0020e870f93af34680b4abd1d4b2156e9cc6e913cc85bacba9a6ad588
Instruction Fuzzy Hash: 7151D7EB35C121BDB10E81416B54AF75AADE2D7730F3084A6F60FD6E42E2D82F491431

Function 073401F6 Relevance: 1.8, APIs: 1, Instructions: 293COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7263f9dd5cb1aecc7e7777d448b4b5bb7e3d2b5bad0070cd58b71f3dfead8e29
Instruction ID: 3b1294124970808b31a0f761ddc3ecc5efaca2596e87e05576d9490e6fc451ed
Opcode Fuzzy Hash: 7263f9dd5cb1aecc7e7777d448b4b5bb7e3d2b5bad0070cd58b71f3dfead8e29
Instruction Fuzzy Hash: 6551A6EB36C121BDB14E90416B54AF75AAEE2D7730F3084A6F60FD5E42E2D86F491431

Function 0734021A Relevance: 1.8, APIs: 1, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eca6c1e6dd90b684f06f199778ce8b13f24d57465178c3feec2764621e11225
Instruction ID: 4e2f326c5b707c469dec4c262211c318b7ca95f7794426d43e230f81bd48272f
Opcode Fuzzy Hash: 2eca6c1e6dd90b684f06f199778ce8b13f24d57465178c3feec2764621e11225
Instruction Fuzzy Hash: 4C51B5EB36C121BDB14E81416B54AF75AAEE2D7730F3084A6F50FD6E42E2C86F491471

Function 07340255 Relevance: 1.8, APIs: 1, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9130978bfa3f99f531a0bc01690cc6b7defb083784820e55fa9ddf42525ffbe0
Instruction ID: 780b118c4baff2e3a7045469d43ea8bb84af5854262428d6cd178eefb995a56e
Opcode Fuzzy Hash: 9130978bfa3f99f531a0bc01690cc6b7defb083784820e55fa9ddf42525ffbe0
Instruction Fuzzy Hash: AD51C5EB36C121BDB10E81412B55AF75BAEE1D7730F3084A6F90FD6E42E2886F4A1471

Function 07340296 Relevance: 1.8, APIs: 1, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ed6eb519388a794dffe8b8590a70982959ef38bbb647b266e07f2bffe42a1dd
Instruction ID: 7f4d279144ad982f824c77a2c71574e8ab1c740c20fadd2febdeddc7a8ad94c6
Opcode Fuzzy Hash: 6ed6eb519388a794dffe8b8590a70982959ef38bbb647b266e07f2bffe42a1dd
Instruction Fuzzy Hash: A141B8EB35C121BDB10E91416B54AF75AADE2D7730F3084A6F90FD6A42E2D82F4A1471

Function 0734031D Relevance: 1.8, APIs: 1, Instructions: 258COMMON

Download Yara Rule

APIs

Process32NextW.KERNEL32(000000E7,000000E7,72A0DE27,?), ref: 073404D0

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 8762e33e51e4b7aacc6ba3e1f08cf7b641071c82a551117feb2fe8760197f460
Instruction ID: fa606cb77421fff9671eb252cf236c92823284a1cac8ed50d180bea016d8c400
Opcode Fuzzy Hash: 8762e33e51e4b7aacc6ba3e1f08cf7b641071c82a551117feb2fe8760197f460
Instruction Fuzzy Hash: 8251DBEB35C161BDB10E81416B54EFA6BADE2C7730F3084EAF50FC6942E2992E4E5531

Function 0734028C Relevance: 1.8, APIs: 1, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5503ab95ded93422294a5ca9689f5369b51ef7657cb0942080de3ff8d157dfa3
Instruction ID: f7fae0506512a61f72ca5a2889ff3a43bd7b3f2a5db280a454f5d6aa5a994208
Opcode Fuzzy Hash: 5503ab95ded93422294a5ca9689f5369b51ef7657cb0942080de3ff8d157dfa3
Instruction Fuzzy Hash: 7441A7EB36C121BD710E91412B54AF75AADE2D7730F3084A6F50FC6E42E2C86F4A1471

Function 073402B4 Relevance: 1.8, APIs: 1, Instructions: 255COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d394e2fb681d4c60f0f956896cea2a9a226cced8116a8d17bc785fbe758f1cc1
Instruction ID: 69bf08fff5d9e8e1107fad7ee6b7dcfef45c01ce92ff4ef8c5f075e65df5793f
Opcode Fuzzy Hash: d394e2fb681d4c60f0f956896cea2a9a226cced8116a8d17bc785fbe758f1cc1
Instruction Fuzzy Hash: B441A6EB36C121BD714E91412B54AF75BAEE2D7730F3084A6F90FC6A42E2882F4A1471

Function 073402E2 Relevance: 1.7, APIs: 1, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9010ba042d347beac6a5f67c4e245664e2ab40528843f7e43059433a39127115
Instruction ID: 9af77aaf19d7b71d5f65e8e7981493d32ee45d566dd906ee2b50aa1038c711d3
Opcode Fuzzy Hash: 9010ba042d347beac6a5f67c4e245664e2ab40528843f7e43059433a39127115
Instruction Fuzzy Hash: 5441A7EB36C121BDB14E91412B54AF75AAEE2D7730F3084AAF50FD6942E3986F4A1431

Function 073402D6 Relevance: 1.7, APIs: 1, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 7b358997dab36f6635a583d7e03539fc2d381fc50124e416bc8983e508b27640
Instruction ID: d3f0f3dc6dda68ce6e7ecc4f70834421a4e9854101941d982c4a7db14e2457e0
Opcode Fuzzy Hash: 7b358997dab36f6635a583d7e03539fc2d381fc50124e416bc8983e508b27640
Instruction Fuzzy Hash: C04187EB36C121BD714E91416B54AF65AADE2D7730F3084A6F90FD5D42E2882F4E1471

Function 0734030D Relevance: 1.7, APIs: 1, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 58b9ed8820b5b028db0ec2e497b1d5a9a4048828f0be73f4b76d05450e732f4a
Instruction ID: fd4f489b16188623a1076e2f0eb16ebf33385bc75d8b948df38691f3ca09da38
Opcode Fuzzy Hash: 58b9ed8820b5b028db0ec2e497b1d5a9a4048828f0be73f4b76d05450e732f4a
Instruction Fuzzy Hash: C54186EB36C121BDB14E91412B54AF75AADE2C7730F3084A6F90FD6E42E2882F4E1471

Function 07340356 Relevance: 1.7, APIs: 1, Instructions: 231COMMON

Download Yara Rule

APIs

Process32NextW.KERNEL32(000000E7,000000E7,72A0DE27,?), ref: 073404D0

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 3577a632d73e92808835f968362ab2c93845fa90dfb38814d516747bec7e10d1
Instruction ID: 01d1e78f8a833f3f3dc3ef934f0aff55019e763a707780f5f5c4024f89beeb9e
Opcode Fuzzy Hash: 3577a632d73e92808835f968362ab2c93845fa90dfb38814d516747bec7e10d1
Instruction Fuzzy Hash: 7041D7EB35C1617DB10E91416B54AF66BAEE2C7730F3084E6F90FC6A42E2892E4E1471

Function 0734033D Relevance: 1.7, APIs: 1, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 637232bbeee266965fcc1934515bf554adc75a8d1b250b0b6119e5c6b926066d
Instruction ID: 810439d24f96defa44f2c46362e310d3a2e288c5ae7c7ca46ef0811dae3003e7
Opcode Fuzzy Hash: 637232bbeee266965fcc1934515bf554adc75a8d1b250b0b6119e5c6b926066d
Instruction Fuzzy Hash: 034176EB35C121BDB14E91416F54AF75BAEE2D7730F3084A6F90FD6A42E2982F4A1431

Function 073403DA Relevance: 1.7, APIs: 1, Instructions: 212COMMON

Download Yara Rule

APIs

Process32NextW.KERNEL32(000000E7,000000E7,72A0DE27,?), ref: 073404D0

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 2f44efb97597d7147510b4d318130990d5b328d4faab7c31095ea3e4de223689
Instruction ID: 5a3f0b98a4b6c3b32d7541b6f3fc91e118583e4cc3df3418b3ee327f95a61b7b
Opcode Fuzzy Hash: 2f44efb97597d7147510b4d318130990d5b328d4faab7c31095ea3e4de223689
Instruction Fuzzy Hash: 734184EB35C121BC714E90416B54AF65AAEE1C7730F30C4A7F90FD6A42E2886E4E1471

Function 073403C1 Relevance: 1.7, APIs: 1, Instructions: 204COMMON

Download Yara Rule

APIs

Process32NextW.KERNEL32(000000E7,000000E7,72A0DE27,?), ref: 073404D0

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 1ece435d996faf9263ce4704c80b2ff525cf91f8b1b8bfb29890f19b83aef69b
Instruction ID: 5ee5c9d2bb0d9fb2ec1a24d37248a15dca4e03e1c5200f35aa1fd330b142fd8e
Opcode Fuzzy Hash: 1ece435d996faf9263ce4704c80b2ff525cf91f8b1b8bfb29890f19b83aef69b
Instruction Fuzzy Hash: 85311FEB35C1217CB14E91412F54AF756AEE2D7730F3084B6F90BD6A42E2D86E4E2471

Function 0734039B Relevance: 1.7, APIs: 1, Instructions: 203COMMON

Download Yara Rule

APIs

Process32NextW.KERNEL32(000000E7,000000E7,72A0DE27,?), ref: 073404D0

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 477b9d1bda9734ed8c9202103766989c8343774dce27221bbe76215445543eea
Instruction ID: 7c0b288aa1d736cfd6530fbbd031895e86ee0dce6542a2dfa076233eda222d60
Opcode Fuzzy Hash: 477b9d1bda9734ed8c9202103766989c8343774dce27221bbe76215445543eea
Instruction Fuzzy Hash: 783132EB35C161BD714E90412B54AF65AAEE1D7730F3084A6F90FD6E42E2882E4E1471

Function 073403A6 Relevance: 1.7, APIs: 1, Instructions: 201COMMON

Download Yara Rule

APIs

Process32NextW.KERNEL32(000000E7,000000E7,72A0DE27,?), ref: 073404D0

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 295a1d1a46c138c33f25c37d8efd658afc3d5ced651f5809448743c539b5bde5
Instruction ID: b9694207731540895b7976c4e8a60dac2ec4c9aaff0dd09050a22e5ec3b45f91
Opcode Fuzzy Hash: 295a1d1a46c138c33f25c37d8efd658afc3d5ced651f5809448743c539b5bde5
Instruction Fuzzy Hash: 0A3121EB35C121BC714E91426B54AFA56AEE1D7730F3084A7F90FD6A42E2C86E4E2471

Function 073403B7 Relevance: 1.7, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

Process32NextW.KERNEL32(000000E7,000000E7,72A0DE27,?), ref: 073404D0

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: d2c78bbd8f1fbf6d27de3cc3fb395782d520615e9a7f15a2a589ebeafef06baf
Instruction ID: 76c4a510585a5b70ffd18a3c9ac52a368abcc9958165cf067f74c7a9c18d1ba3
Opcode Fuzzy Hash: d2c78bbd8f1fbf6d27de3cc3fb395782d520615e9a7f15a2a589ebeafef06baf
Instruction Fuzzy Hash: 033110EB35C1617C714E91422B54AF656AEE1D7730F3084B6F90FD6A42E2C86E4E2471

Function 072F032B Relevance: 1.7, APIs: 1, Instructions: 189COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNELBASE(?,0000CA51), ref: 072F0386

Memory Dump Source

Source File: 00000000.00000002.1654369677.00000000072F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72f0000_94g4KHMj9B.jbxd

Similarity

API ID: DrivesLogical
String ID:
API String ID: 999431828-0
Opcode ID: d80cede5a07a67e9a09c0e2af1151fcaba406c90b635573c215492c544bca974
Instruction ID: 0bebc2e8bc07d45a406cac9488f8fef06a9b3affea5adbf88efaffd0881b54fe
Opcode Fuzzy Hash: d80cede5a07a67e9a09c0e2af1151fcaba406c90b635573c215492c544bca974
Instruction Fuzzy Hash: 9641A2FB23C261BEB622D1926B64AFBA76DE5C7730730847BF542C5007E2D84E495632

Function 072F02C6 Relevance: 1.7, APIs: 1, Instructions: 189COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNELBASE(?,0000CA51), ref: 072F0386

Memory Dump Source

Source File: 00000000.00000002.1654369677.00000000072F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72f0000_94g4KHMj9B.jbxd

Similarity

API ID: DrivesLogical
String ID:
API String ID: 999431828-0
Opcode ID: 73fc48054a27b08c59300b692114a9cb541e597ce85d704e531fda04cf165126
Instruction ID: 5b7e5ecc07a4d6294b7cd0796431b1464488e01610c0f7b624c9c9d218cba42b
Opcode Fuzzy Hash: 73fc48054a27b08c59300b692114a9cb541e597ce85d704e531fda04cf165126
Instruction Fuzzy Hash: 3E41B5EB23C251BEB622D1927B649FBA76DE5C7730730847BF942C5007E2D44E495232

Function 07340429 Relevance: 1.7, APIs: 1, Instructions: 177COMMON

Download Yara Rule

APIs

Process32NextW.KERNEL32(000000E7,000000E7,72A0DE27,?), ref: 073404D0

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 90167bd2ce7a73e9b6f86fc7a6ec3785af71919fb55cfda70821568f00a2edad
Instruction ID: ac7feb81c0a514f05013d42df8b3d6ada4258ba0084aaf3c8b883bdcd11c9d09
Opcode Fuzzy Hash: 90167bd2ce7a73e9b6f86fc7a6ec3785af71919fb55cfda70821568f00a2edad
Instruction Fuzzy Hash: 7F3176EB35C121BDB14E91512B54AFA67AEE2D3730F3084B7F50BC6942E2C86E4E1471

Function 073403FF Relevance: 1.7, APIs: 1, Instructions: 177COMMON

Download Yara Rule

APIs

Process32NextW.KERNEL32(000000E7,000000E7,72A0DE27,?), ref: 073404D0

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: c285cde4266f2b235c2a932a337489448d87ce18484e0b055daf0538a12eaee9
Instruction ID: b9efba901b8ad1e77cb3ddd6f7e03b72e11b511b627c792721de083f4d7ccb79
Opcode Fuzzy Hash: c285cde4266f2b235c2a932a337489448d87ce18484e0b055daf0538a12eaee9
Instruction Fuzzy Hash: 7F3162EB35C161BCB14E91412B54AF65BAEE1C7730F3084B6F90BC6E42E2886E4E1431

Function 07340417 Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

APIs

Process32NextW.KERNEL32(000000E7,000000E7,72A0DE27,?), ref: 073404D0

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 443a2d7b7c4345691643ddac68f6678110a8556a7b9c6b382f06259d8586cfb9
Instruction ID: 6b5c0878cafef1b71eab3a8fc7028ca3f4c91ca51a238ee47c992c4bbbc7a23a
Opcode Fuzzy Hash: 443a2d7b7c4345691643ddac68f6678110a8556a7b9c6b382f06259d8586cfb9
Instruction Fuzzy Hash: 5E3123EB35C161BC714E91412B54AFA56AEE2D7730F3084B7F90FD6A42E2886E4E2471

Function 073404C0 Relevance: 1.7, APIs: 1, Instructions: 161COMMON

Download Yara Rule

APIs

Process32NextW.KERNEL32(000000E7,000000E7,72A0DE27,?), ref: 073404D0

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 6e950e46f1e4eaf5cfb5a38d856f657ec1dbd50a6191647c569a1925af9ce325
Instruction ID: 8ebc71f6303da569cefb0d51852206a5219f258dcb96d0c7b7214d57cb59e4ed
Opcode Fuzzy Hash: 6e950e46f1e4eaf5cfb5a38d856f657ec1dbd50a6191647c569a1925af9ce325
Instruction Fuzzy Hash: A03161EB35C121BC714E91412B54AFA5AAEE1D7730F3084B6F90BD6D42E2886F4E2471

Function 07340449 Relevance: 1.7, APIs: 1, Instructions: 158COMMON

Download Yara Rule

APIs

Process32NextW.KERNEL32(000000E7,000000E7,72A0DE27,?), ref: 073404D0

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 6dddcde6a8ffd577411390ba045e08c679340edd2d12946a68b184adb6492edc
Instruction ID: 21f275d6d2dd0fe67de708fdc67f1a09980b180b952580496ef6eaff2a0981f2
Opcode Fuzzy Hash: 6dddcde6a8ffd577411390ba045e08c679340edd2d12946a68b184adb6492edc
Instruction Fuzzy Hash: 1D2121EB35C1617CB14E91412B54AF656AEE2D7730F3084B6F90BD6E42E2886E4E2471

Function 07340456 Relevance: 1.7, APIs: 1, Instructions: 156COMMON

Download Yara Rule

APIs

Process32NextW.KERNEL32(000000E7,000000E7,72A0DE27,?), ref: 073404D0

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 200d4b4df149f05ee24ed4fc7030a361fde19def4a0c0932ebe017c6f51a3acc
Instruction ID: e0215a086f5cf5749c449984c66117e89286fc246cfb9eb1c138291780c37086
Opcode Fuzzy Hash: 200d4b4df149f05ee24ed4fc7030a361fde19def4a0c0932ebe017c6f51a3acc
Instruction Fuzzy Hash: B1216FEB35C1217CB14E81422B54AFA56AEE1D3730B3084B6F90BC6A42E2886E4E2571

Function 073404DC Relevance: 1.6, APIs: 1, Instructions: 150COMMON

Download Yara Rule

APIs

Process32NextW.KERNEL32(000000E7,000000E7,72A0DE27,?), ref: 073404D0

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: e9704e471b8b81c3e20d2b8936ecb15634d1d9e3927406a24d70e724c749445f
Instruction ID: 202ef58db2fa596bc37ac5c4779e4e5cd610a2a1f5ea0efc922370d4345a56bc
Opcode Fuzzy Hash: e9704e471b8b81c3e20d2b8936ecb15634d1d9e3927406a24d70e724c749445f
Instruction Fuzzy Hash: 582191EB35C1617CB14E91512B14AFA5BAEE1C7730F3084A7F94BC6D42E2886E4E1571

Function 07340481 Relevance: 1.6, APIs: 1, Instructions: 141COMMON

Download Yara Rule

APIs

Process32NextW.KERNEL32(000000E7,000000E7,72A0DE27,?), ref: 073404D0

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: cae28a1da72be2b54f4bb03139aaa6388322ddc69de63c80704825a2e25a9faa
Instruction ID: f9e1dd1737ed40ab8a829c95d992aa0637e8efa4affda6d7bab11b8bcd8ecd05
Opcode Fuzzy Hash: cae28a1da72be2b54f4bb03139aaa6388322ddc69de63c80704825a2e25a9faa
Instruction Fuzzy Hash: 9B218EEB35C1617CB14E91412B14AFA57AEE2C7730F3084B7F90BC6982E2886E4E1471

Function 0734049B Relevance: 1.6, APIs: 1, Instructions: 137COMMON

Download Yara Rule

APIs

Process32NextW.KERNEL32(000000E7,000000E7,72A0DE27,?), ref: 073404D0

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: c38348aef8409b80645a87799e28fe2184286423e8e40d2b2c92595250f27ad3
Instruction ID: 59e675ee956d90eeb819ba82a66b860651c9f1a0ab7009b23a812f782f3dc3ef
Opcode Fuzzy Hash: c38348aef8409b80645a87799e28fe2184286423e8e40d2b2c92595250f27ad3
Instruction Fuzzy Hash: 38214FEB35D1617CB14E91412F54AFA57AEE2C7730F3084A7F90BC6942E2886E4E1471

Function 072F031F Relevance: 1.6, APIs: 1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654369677.00000000072F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72f0000_94g4KHMj9B.jbxd

Similarity

API ID: DrivesLogical
String ID:
API String ID: 999431828-0
Opcode ID: a41ad9e4b0ef167e8fabb25e517076fdbd977b376f48353903958382b7f68ec3
Instruction ID: fd790e8872568f98ae42cbdda43859e55b8990968c9da4c20e7788307d646f22
Opcode Fuzzy Hash: a41ad9e4b0ef167e8fabb25e517076fdbd977b376f48353903958382b7f68ec3
Instruction Fuzzy Hash: 5D210AF723C211AEB621E5916B949FBE76DE5C3730B308477F602C6103E6E44D494631

Function 073404B0 Relevance: 1.6, APIs: 1, Instructions: 128COMMON

Download Yara Rule

APIs

Process32NextW.KERNEL32(000000E7,000000E7,72A0DE27,?), ref: 073404D0

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 94dce747f78a197677e6fd306aafe58be57e816ae58e46a2212913aca03a4cba
Instruction ID: 6a3ab32874f92385ed27398c8c7892e355e673dabdc506ab3e6397d26badfa40
Opcode Fuzzy Hash: 94dce747f78a197677e6fd306aafe58be57e816ae58e46a2212913aca03a4cba
Instruction Fuzzy Hash: 91214DEB35C1617CB14E91422F54AFA57AEE2D7730B30C4A7F90BC6942E2886F4E2571

Function 0734050E Relevance: 1.6, APIs: 1, Instructions: 126COMMON

Download Yara Rule

APIs

Process32NextW.KERNEL32(000000E7,000000E7,72A0DE27,?), ref: 073404D0

Memory Dump Source

Source File: 00000000.00000002.1654491650.0000000007340000.00000040.00001000.00020000.00000000.sdmp, Offset: 07340000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7340000_94g4KHMj9B.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 539c06cd572b50d5772aa4ba4d5232e72a946b8de8f5d58a7a1ee61ae68f9305
Instruction ID: e6a394fdfdc782ca565d71433f43152eb8b401760629af126220bba51ecf37ed
Opcode Fuzzy Hash: 539c06cd572b50d5772aa4ba4d5232e72a946b8de8f5d58a7a1ee61ae68f9305
Instruction Fuzzy Hash: D1212CEB35C1617C714E91412F54AFB57AEE2D3730B31C4A7F90BC6942E2886E4E2471

Function 072F034E Relevance: 1.6, APIs: 1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654369677.00000000072F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72f0000_94g4KHMj9B.jbxd

Similarity

API ID: DrivesLogical
String ID:
API String ID: 999431828-0
Opcode ID: 5245cbc77782af16007ae51d40099fbc1b6aa9908fdd42a2acb036f333bb1432
Instruction ID: 371edd157d4e91ebcc54cddcce23609dde8582ea26c7a4026a7425ae6961c263
Opcode Fuzzy Hash: 5245cbc77782af16007ae51d40099fbc1b6aa9908fdd42a2acb036f333bb1432
Instruction Fuzzy Hash: 022168E723C211EFA632A5A167905FAFBA9F6C3330B308476F642D6103E6E48D458735

Function 072F036F Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNELBASE(?,0000CA51), ref: 072F0386

Memory Dump Source

Source File: 00000000.00000002.1654369677.00000000072F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72f0000_94g4KHMj9B.jbxd

Similarity

API ID: DrivesLogical
String ID:
API String ID: 999431828-0
Opcode ID: 438ef7cd9527996ac6587f843c5831bc4e4a3db21cb90150d8163ae56a98ea02
Instruction ID: dc2ca7d63d0f92471151227f965a4a915b4a8d99c797de86cdcf19b1df802950
Opcode Fuzzy Hash: 438ef7cd9527996ac6587f843c5831bc4e4a3db21cb90150d8163ae56a98ea02
Instruction Fuzzy Hash: 491126E713C212EFA622A5A167946FBEB69F6C3330B308436F603C6103E6E05D458635

Function 072D0763 Relevance: .4, Instructions: 399COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654318036.00000000072D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72d0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f4f3a11f48266c8daa8920cb291293f9b1a816a517d70aedcc55937e494047d
Instruction ID: d9c2f04ad8d359192f18dadef775fed4457c3ff45caff18142bb06381a2269b4
Opcode Fuzzy Hash: 4f4f3a11f48266c8daa8920cb291293f9b1a816a517d70aedcc55937e494047d
Instruction Fuzzy Hash: 3E8104F753C254BDB22281966B54BFA6B6EE6C7730F308427F403D6622E2D90E4E5532

Function 072D076C Relevance: .4, Instructions: 395COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654318036.00000000072D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72d0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e392e558b6467ebea92a881d54d981c24cbb742674102d733c000a585a7dafc
Instruction ID: 658923e1d96e3344ca63fb8f73afec945ee58b174905378f8ad53eec137a96d9
Opcode Fuzzy Hash: 0e392e558b6467ebea92a881d54d981c24cbb742674102d733c000a585a7dafc
Instruction Fuzzy Hash: 2E8114F753C254BDF22285966B54AFA6B6EE6C7730F308427F403D6622E2D90F4A5231

Function 072D0780 Relevance: .4, Instructions: 394COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654318036.00000000072D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72d0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a35bd030f9c07e7063624658cade80a20f373f297b2b3a1cf502529701d2fad
Instruction ID: dc65e5505ebc57f798b8cbc51b59cfcfb35eb1ef614d833f1462648401047bd0
Opcode Fuzzy Hash: 4a35bd030f9c07e7063624658cade80a20f373f297b2b3a1cf502529701d2fad
Instruction Fuzzy Hash: D781F2F753C254BDB22285966B54AFA6B6EE6C7730F308427F403D6612E2D90F4A5232

Function 072D075C Relevance: .4, Instructions: 394COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654318036.00000000072D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72d0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3dc9bbe13ed75f3e80ddb41508eff8e98cdd7d919fed3fd55c684166d0df9c4
Instruction ID: 96c74dc9ac9653c91dcc9bfb337cbdf0df9f04d50f12dd286a7792d6d84c45d0
Opcode Fuzzy Hash: f3dc9bbe13ed75f3e80ddb41508eff8e98cdd7d919fed3fd55c684166d0df9c4
Instruction Fuzzy Hash: 5C81F4F753C254BDF22285966B54AFA6B6EE6C7730F308427F403D6612E2D80F4A5132

Function 072D0832 Relevance: .4, Instructions: 373COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654318036.00000000072D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72d0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41a43079ce09942e874866234d7125568a80fea7de990ab4065bd09fdc799e4e
Instruction ID: 0ae25352827d470fd89e773b577bc3a1fdd5ce5b2b3b006fdcf33265592dcebd
Opcode Fuzzy Hash: 41a43079ce09942e874866234d7125568a80fea7de990ab4065bd09fdc799e4e
Instruction Fuzzy Hash: 588156E753C155BDB2228695AB54AFA7B7EE6C7730F308467F403DA622E2C40F4A4231

Function 072D0819 Relevance: .4, Instructions: 369COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654318036.00000000072D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72d0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a06a276e7f929cab6ccf2ebf909b447a6d320c9633f21d379758432e3b5199e9
Instruction ID: 78a63e1d1a7b3b20a18dc7014c8fb6bf92a9aec385d1611df49e91556bd53c27
Opcode Fuzzy Hash: a06a276e7f929cab6ccf2ebf909b447a6d320c9633f21d379758432e3b5199e9
Instruction Fuzzy Hash: D97125F753C255BDF2228595AB54AFA6B6EE6C7730F308427F403DA622E2D40F4A4231

Function 072D07B4 Relevance: .4, Instructions: 365COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654318036.00000000072D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72d0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a055ce802026a6d1e1f436dc3d77c999b998880006e251107e9be47654b370de
Instruction ID: 0fb32ee1e136495ecf4d983cfa4c4a02f0df318191b0da7a3a2145381977d30b
Opcode Fuzzy Hash: a055ce802026a6d1e1f436dc3d77c999b998880006e251107e9be47654b370de
Instruction Fuzzy Hash: 787115F753C255BDF22286956B54AFA6B6EE6C7730F308427F403D6622E2D50F4A4232

Function 072D0806 Relevance: .4, Instructions: 350COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654318036.00000000072D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72d0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e33c762d17ba9231b66ac5d577f80907c14d8d9584e5f330efb2a01e28a82f03
Instruction ID: 148ddd08623c91a50e4fa0714449b456b9df5b9a1c5a83965141d49843ceed07
Opcode Fuzzy Hash: e33c762d17ba9231b66ac5d577f80907c14d8d9584e5f330efb2a01e28a82f03
Instruction Fuzzy Hash: 937137FB53C154BDB22285956B54AFA6B6EE6D7730F308427F403D6622E2C50F4E4231

Function 072D07EA Relevance: .4, Instructions: 350COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654318036.00000000072D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72d0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cc70c6c7ca077360be38fa9883c99d17933e46bffd0aae68b2584d98a53d20b
Instruction ID: ead64c741ec2abed8f65c176ebc73ed89eb8ca111278ff1e1b5a6db4d8260e41
Opcode Fuzzy Hash: 1cc70c6c7ca077360be38fa9883c99d17933e46bffd0aae68b2584d98a53d20b
Instruction Fuzzy Hash: B17126F753C254BDB22286956B54AFA6B6EE6D7730F308427F403D6622E2C50F4E4232

Function 072D07DB Relevance: .4, Instructions: 350COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654318036.00000000072D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72d0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37d008685c2af91ac58424ad5b6b63ebb79d07091d2a2e9dcacc5935eb8eaa97
Instruction ID: c2e78a394c7e689a8ae7734acf8fd678653bb104750b3aa771a6dfc33bbd6e33
Opcode Fuzzy Hash: 37d008685c2af91ac58424ad5b6b63ebb79d07091d2a2e9dcacc5935eb8eaa97
Instruction Fuzzy Hash: F97136F753C254BDB22282956B54AFA6B6EE6D7730F308427F403D6622E2D50F4A4232

Function 072D0850 Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654318036.00000000072D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72d0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1544fc2e2c12574ff89a1d7356510dbe86c428c58a657c9d225670c1117299ef
Instruction ID: 2e7a4677620360f9107f3d78d4dca6ca7e01e0de1ac0da4bed8f3daf678bcf28
Opcode Fuzzy Hash: 1544fc2e2c12574ff89a1d7356510dbe86c428c58a657c9d225670c1117299ef
Instruction Fuzzy Hash: CD6127E753C154BDB22281956B54AFA6B6EE6D7730F308467F403D6622E2C50F4A5232

Function 072D0897 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654318036.00000000072D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72d0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b01806757da9389e4528dc2e9adee4c4f9539e604e12191586e9700ec16a8a5a
Instruction ID: b1dccd8adb7004c6ac3b17ca2f90e58d8916c73b4a167db629456bc27d4bc39b
Opcode Fuzzy Hash: b01806757da9389e4528dc2e9adee4c4f9539e604e12191586e9700ec16a8a5a
Instruction Fuzzy Hash: 6F5139E753C255FDB22286956B54AFA6B6EE6D7730F308427F403D6622E3C50F4A4231

Function 072D08B6 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654318036.00000000072D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72d0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fae1ebb12949a957151e8a40f86ad0851968339e5215bef67f3bf968fd36676
Instruction ID: 8a317dc0cdf0bca4d94b0ff9571dd8dae7717b1c3b7231bd7a68eec3babfcbb8
Opcode Fuzzy Hash: 8fae1ebb12949a957151e8a40f86ad0851968339e5215bef67f3bf968fd36676
Instruction Fuzzy Hash: 5F5127EB53C155BDB23286955B54AFA6B6EE6D7730F308427F403D6622E2C50F4A4132

Function 072D08CA Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654318036.00000000072D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72d0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 391fc9e91c3fae5f0fb4383c73a9e4e351eea9fdada151a6f8df3e919929865e
Instruction ID: e441a55e9086ec6c2103f70604d0be2a46e89a63be9b1f52f8f1a56bc09d90bf
Opcode Fuzzy Hash: 391fc9e91c3fae5f0fb4383c73a9e4e351eea9fdada151a6f8df3e919929865e
Instruction Fuzzy Hash: 095138EB53C154BDB23286956B54AFA6B6EE6D7730F308427F403D6622E2C50F4A4132

Function 072D094A Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654318036.00000000072D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72d0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a5f4ab3cb4074b5e90dd96534b4416b25eb052059ad8ca7ad244c39e5e8dfde
Instruction ID: 945abf34671de6e60c6819c0a6a439fdf738c89e444305acc78d25c7614cde5f
Opcode Fuzzy Hash: 4a5f4ab3cb4074b5e90dd96534b4416b25eb052059ad8ca7ad244c39e5e8dfde
Instruction Fuzzy Hash: F05136EB53D255BDB23282966B54AFA6B6EE6C7730F308427F403D5622E2C50F4E5131

Function 072D08E6 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654318036.00000000072D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72d0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8653443aa0d2e61beab30b6f088832927bb8aa4c79e56fbe5ff1df224ebe7307
Instruction ID: 42665ff20578eb3ce2e7bf7f0800e249470c3f827c0ac65f1678c4a87c3af1df
Opcode Fuzzy Hash: 8653443aa0d2e61beab30b6f088832927bb8aa4c79e56fbe5ff1df224ebe7307
Instruction Fuzzy Hash: 7D5137EB53D254FCB22282966B54AFA6B6EE6C7730F308427F403D6222E2C50F4E4131

Function 072D0901 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654318036.00000000072D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72d0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26c0a8a05cb61e1154b12365a99bd5202a25d6c4ea82048f72e92c3db48db903
Instruction ID: a81ffb64c89fabce0965c29aa5c0d3fbde28f135e739e8d803374c5414c68d1c
Opcode Fuzzy Hash: 26c0a8a05cb61e1154b12365a99bd5202a25d6c4ea82048f72e92c3db48db903
Instruction Fuzzy Hash: 3E41E2EB53C250BCB26286926B54AFA6B6EE6D7730F308427F803D5622E2C50F4E4131

Function 072D0924 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654318036.00000000072D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72d0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ccb4710dea55f8300ddf503c2c2de730dced9efabf6bf0da9213d2bacb0e710
Instruction ID: 29facd233d67fbb5d7e1496db99fe76d435fc0cf52652cf44141a5cbbb709dc5
Opcode Fuzzy Hash: 9ccb4710dea55f8300ddf503c2c2de730dced9efabf6bf0da9213d2bacb0e710
Instruction Fuzzy Hash: 4141F5EB53C250BCB22286966B54AFA6B6EE6D7730F308427F803D5622E3C50F4E4135

Function 072D0A54 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654318036.00000000072D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72d0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83f7141be7b6cfb67d23eb3bd1e0a539b1fdd53bf164200982781245bdf86a42
Instruction ID: 660fcdc0245c1b332e0cfdc7ac25d5d99fbe56e3d58b08e1aceb2226f0792699
Opcode Fuzzy Hash: 83f7141be7b6cfb67d23eb3bd1e0a539b1fdd53bf164200982781245bdf86a42
Instruction Fuzzy Hash: 7D4104EB57C254BDF222C2925B54AFAAB3EE6C7630F30852BF40395622E2D40F4A4131

Function 072D0992 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654318036.00000000072D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72d0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df63a2ecbd7f8a87cb3322a0fa5c16cd06c100cb79b3e0700d3f78d976fd9bff
Instruction ID: 2b672525495ab8d6d47aafdcd8327ddb32878b11eb0378b51bb42b2c0feba8c9
Opcode Fuzzy Hash: df63a2ecbd7f8a87cb3322a0fa5c16cd06c100cb79b3e0700d3f78d976fd9bff
Instruction Fuzzy Hash: 6841F6FB53C254FDE22282965B54AFA6B6EE6D7630F308467F80396622E3C50E4E4131

Function 072D09DA Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654318036.00000000072D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72d0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c138392b8046c145b2388b792f04af3eab2f8fad62de7313a644055d79a1b31
Instruction ID: 3f441ddab1fc5543fd39a9ae7a3daedd492e8d28f0547ee8649ebea58dc2d4d6
Opcode Fuzzy Hash: 6c138392b8046c145b2388b792f04af3eab2f8fad62de7313a644055d79a1b31
Instruction Fuzzy Hash: EB4126EB53C114BDF16186822B54AFAAB3EE6D7730F308527F403A5622E2D80F4E4135

Function 072D0983 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654318036.00000000072D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72d0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1759f0e24786f8b6064f4fb3ef6f4d2323d6fb9bb28929bc26e48cb6fed76311
Instruction ID: 091d3f4c5875f00deb4bff6eb8e11669585eb60ad4418acf2fb5a172b93a8555
Opcode Fuzzy Hash: 1759f0e24786f8b6064f4fb3ef6f4d2323d6fb9bb28929bc26e48cb6fed76311
Instruction Fuzzy Hash: 3441F2EB53D254FCB26286925B54AFA6B7EE6D7630F308427F80395622E2C90F4E4135

Function 072D09E3 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654318036.00000000072D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72d0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78e803f51c1591c0ec86be2ac79d0f4a0ef0b7e180ffdf6331fc9c2d9d087ac7
Instruction ID: 5c90b0f88564c4999cd2374a414c688037568c49ad4dde52240952e39926a90a
Opcode Fuzzy Hash: 78e803f51c1591c0ec86be2ac79d0f4a0ef0b7e180ffdf6331fc9c2d9d087ac7
Instruction Fuzzy Hash: EE31E2EB57C114BCB17182822B54AFAAB2EE6D7730F308527F903A5622E2C90F4E0135

Function 072D09C7 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654318036.00000000072D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72d0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91d471fecaf61247ddf0d0c0c0915eb1b93d4e0435fd6c65111b4481d7b36615
Instruction ID: 480d6a64fc498659a506f9e6c96d2607e8fb6926509ff22bfbe6a21de0e52642
Opcode Fuzzy Hash: 91d471fecaf61247ddf0d0c0c0915eb1b93d4e0435fd6c65111b4481d7b36615
Instruction Fuzzy Hash: 0241E3FB53C254FDB26286965B54AFA6B2EE6D7730F308427F80395622E2C90F4E4131

Function 072D0A95 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654318036.00000000072D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72d0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0a2588329445d670ee685b6111a7257b89e1b0269196143ab245f0f05650bb6
Instruction ID: f3ad2fc14e5b56ce3a74d671935a2e9cdbdb5909d493dd668e946cd64cb75ec2
Opcode Fuzzy Hash: d0a2588329445d670ee685b6111a7257b89e1b0269196143ab245f0f05650bb6
Instruction Fuzzy Hash: E24138EB53C254BCE222C6A25B54BFA6B6EEAD7730F308417F40399522E2C50F4E4675

Function 072D0A16 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654318036.00000000072D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72d0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c691fe6fa1c6bd07ee065aa96291870c8528d5a0e7333fa970b5563da0a4847
Instruction ID: e38ae8e68f9c2f875244819d7cce69ea5e124661fc3bf4553e40a2cd7453e9a7
Opcode Fuzzy Hash: 7c691fe6fa1c6bd07ee065aa96291870c8528d5a0e7333fa970b5563da0a4847
Instruction Fuzzy Hash: 9741F5FB53C254BCB26282965B54AFA6B2EE6D7734F308527F80395622E3C50F4E4235

Function 072D0A83 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654318036.00000000072D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72d0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a3e2e97885b2b1d27343ea1b74bb80a19a9e461c020dc5d8fb7a9ada8fe7d97
Instruction ID: 5ee4952b570764704dbdd17104605821359af76c2ef9d62d1caf4971c4f08f98
Opcode Fuzzy Hash: 8a3e2e97885b2b1d27343ea1b74bb80a19a9e461c020dc5d8fb7a9ada8fe7d97
Instruction Fuzzy Hash: 2C31C2EB63C214BCB26192961B54BFA6B6EE6D7730F308427F80395622E2D90F4E0535

Function 072D0B72 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654318036.00000000072D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72d0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fa41a64bd7ad85d7a1adf87a1ccbcd76bc745d26c4d4a67c78b5edaa469c2d6
Instruction ID: 1f4717b8ba341b8f60c3bdd3c479d32c1cbad3466f1c0efcc936926a9db16a81
Opcode Fuzzy Hash: 9fa41a64bd7ad85d7a1adf87a1ccbcd76bc745d26c4d4a67c78b5edaa469c2d6
Instruction Fuzzy Hash: 273169F753C254BDA13296925718BFA6F2EE6C7730F308527F4439A522E2C40F4A4171

Function 072D0AE8 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654318036.00000000072D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72d0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26fcd274c068f7b3d036f3e92f0b74606c9314f043eabbb23d6c06a4c1c31e4a
Instruction ID: aa05a2294e04f5c744a346788a0667ed5be004082caca624c7abf3678ddd3d61
Opcode Fuzzy Hash: 26fcd274c068f7b3d036f3e92f0b74606c9314f043eabbb23d6c06a4c1c31e4a
Instruction Fuzzy Hash: 4F21F5FB63C224EDA22196921755BFA6B2ED6D7630F308427F40396522D3C50F8A5136

Function 072D0AC6 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654318036.00000000072D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72d0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 528f05d601d63811b6e88487101687ec61a06bceddb089844d80223ba2af4bd2
Instruction ID: 6dd8d404a095fd5628d9bb5d40f64f811fdd0beeda3eb551ea49fe7d3648961a
Opcode Fuzzy Hash: 528f05d601d63811b6e88487101687ec61a06bceddb089844d80223ba2af4bd2
Instruction Fuzzy Hash: AE2104FB63C224FDA22196922B55BFA6B2EE6D7730F308427F40396522E3C50E4E0135

Function 072D0B0A Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654318036.00000000072D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72d0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1294d6a2629010116b8b3526e255dff7e9b03cf08d27e56d1822d22e00f569ef
Instruction ID: ad69482d0e7b75bf037d938d2cb4122be9ed980e1e0a864cebea1fd47eeb1bef
Opcode Fuzzy Hash: 1294d6a2629010116b8b3526e255dff7e9b03cf08d27e56d1822d22e00f569ef
Instruction Fuzzy Hash: DB2133E753C214FCA16296825714BFB6B2EE6D7730F308523F803A6A22E3C50F4A4131

Function 072D0BB4 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654318036.00000000072D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72d0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a87dbc3103ac8855def772b983d996091b6d4afccbef9e588bacfede785177e0
Instruction ID: eddbf99831269a22acddd33ed750ca24aaa26c7367e9a7d629f5c10fbf004040
Opcode Fuzzy Hash: a87dbc3103ac8855def772b983d996091b6d4afccbef9e588bacfede785177e0
Instruction Fuzzy Hash: 072136F753C228FDA22196925718BFB6B2EE6D7730F308527F80399522E2C80F4A0175

Function 072D0B4A Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654318036.00000000072D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72d0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d01b0fd5f3e97c466b95a99e5d0245827dcce8d0ff888d8af617a3dcbedb3fec
Instruction ID: f13a2dcf7beaa9dc94f1c7d4f494499c864e0633251834fb7ab45648cad31450
Opcode Fuzzy Hash: d01b0fd5f3e97c466b95a99e5d0245827dcce8d0ff888d8af617a3dcbedb3fec
Instruction Fuzzy Hash: 6B2135F793C254FDA26282921B48BFA6B3EE6D7630F308127F80399522D2D50F4A0136

Function 072D0B37 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654318036.00000000072D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72d0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1b0dd9955e6075d6390a2f54acd50d3b3c66a9e8f2d5ed089eaae4ab9cf8a13
Instruction ID: 5872e523b6c071e415e5f487dc7dffd493925c5567a140c9cd639c7ae3fb375f
Opcode Fuzzy Hash: a1b0dd9955e6075d6390a2f54acd50d3b3c66a9e8f2d5ed089eaae4ab9cf8a13
Instruction Fuzzy Hash: C5113AF753C224FCA26192821755BFA6B2EE2D7730F308127F80365A22E2C40F490075

Function 072D0B5D Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654318036.00000000072D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72d0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29be506f582f34f31fefe0fbffbc6c210a1c2de9e06077a2e0e89d3d2ec5fec6
Instruction ID: 5da57185fceb95786cca84bf2897f1891d43e2335dacbb0d154a606492c22596
Opcode Fuzzy Hash: 29be506f582f34f31fefe0fbffbc6c210a1c2de9e06077a2e0e89d3d2ec5fec6
Instruction Fuzzy Hash: 9811F0F753C214EDA22196921B58BFA6B2EE6D7330F308027E8079A622D2D80F494175

Function 072D0BA3 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654318036.00000000072D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_72d0000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35decad5ee5069aa60c88ea50459ca955ceb441abd5463e0bccdc77a60ff5389
Instruction ID: f90049533f46d7b4727b967539b9e7c6e78e72ffab5e6ba6fbdfb8ce1f17442e
Opcode Fuzzy Hash: 35decad5ee5069aa60c88ea50459ca955ceb441abd5463e0bccdc77a60ff5389
Instruction Fuzzy Hash: 8111E2F763C218FDA22196925714AFB6B2ED6D7330F308527F80395961D2D50E494135

Function 07380193 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654594121.0000000007380000.00000040.00001000.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7380000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05ada97e2b83bcb117f571f9330a24ddaf0469799a5241585171d32b281501f7
Instruction ID: 6ccde6f7d313c297d4e8549ee3c02360d21259001086fdf78893551a5eeb1450
Opcode Fuzzy Hash: 05ada97e2b83bcb117f571f9330a24ddaf0469799a5241585171d32b281501f7
Instruction Fuzzy Hash: 04F05CEB2293042CE947796416A00DE3B666E422343324090E044DB142FB768A4ED250

Function 073801BF Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654594121.0000000007380000.00000040.00001000.00020000.00000000.sdmp, Offset: 07380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7380000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fa8666edfdd9100e7c834dc91f58aaa1f9c25a5fedd94a5f1837830e9a5e25a
Instruction ID: 2beb521bb846d3ec945b810e8d4308717b69a33f3c16083a9eaf45ceb03d85fb
Opcode Fuzzy Hash: 1fa8666edfdd9100e7c834dc91f58aaa1f9c25a5fedd94a5f1837830e9a5e25a
Instruction Fuzzy Hash: 6DD0A7FF6193046DE985B9555B544ED763A7A827707714125B40597140FBB1494CE050

Non-executed Functions

Function 073309A1 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25a9aa2e93ce90e89dcc99baf2eee32f3bd61efee8612da58e0e5cde50897dfc
Instruction ID: 6b4ff0a7a29afc48f984d84b2efc95a14609f97fcadfad1dde4b1ac478d93522
Opcode Fuzzy Hash: 25a9aa2e93ce90e89dcc99baf2eee32f3bd61efee8612da58e0e5cde50897dfc
Instruction Fuzzy Hash: EA316BFB56C210BEB26A854567507F66A2FEBC7730F308067B00FE6F11D2944E899571

Function 0733096C Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f98d0b6942d33e38e37ec120f86d6e6e56e0ab684245ca9c98a36d3e469a15e2
Instruction ID: 6ec7a69f91311bcf93e56f3753148034bfed54d53402ea6d7a1d351eadb72361
Opcode Fuzzy Hash: f98d0b6942d33e38e37ec120f86d6e6e56e0ab684245ca9c98a36d3e469a15e2
Instruction Fuzzy Hash: 3E315AFB56C110BEB26A85456750BF76A2FEBD7730F308066B00FE6F01D2944E859171

Function 0733098D Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b57ee27f45951de25b610f7ecbd98d624820cb9dbac47534a475cfb9b927f21a
Instruction ID: 7212793e16d1139ba8928f31841a5edf401f7de2f614d9e179564bfc93f5c679
Opcode Fuzzy Hash: b57ee27f45951de25b610f7ecbd98d624820cb9dbac47534a475cfb9b927f21a
Instruction Fuzzy Hash: D12136EB22C210BEB26A85552B50AF76A6FEBD7330F308166B00FE6E01D6944A855171

Function 073309CB Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2bcf58b0f64f029ad1b30c2bfa7f415f7e561b580387646c6d834b5622eae72
Instruction ID: 8f59cf55f3ae196eb9ae08abdde93bdd9ee57c65eaf43c7d9bc937f6fd2e3033
Opcode Fuzzy Hash: f2bcf58b0f64f029ad1b30c2bfa7f415f7e561b580387646c6d834b5622eae72
Instruction Fuzzy Hash: B6313BF762C211BEB22AC55567446F7BB6FEBC7330B308076B00FD6E01D6908A859171

Function 073309AE Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f67219c646495994728eeee857af513df53e5bd5b01b97b9481fa918ac470a6
Instruction ID: b4839a383b6d8f41ebc946651d3baad94cacd2e70fcb6d584db038ec965d041f
Opcode Fuzzy Hash: 7f67219c646495994728eeee857af513df53e5bd5b01b97b9481fa918ac470a6
Instruction Fuzzy Hash: AF2146F722C210BE722A85952750AF76B6FEBC7730B308066B00FD6F01D6948F899271

Function 07330A66 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7fdef175da4c36aebac58bd81f81dd16a1bb41d909fbe2acb64aca0a7646544
Instruction ID: 75b55fa31d7fabf007553673a5655542fc9264c5c8618b9b310a445a00da6f70
Opcode Fuzzy Hash: e7fdef175da4c36aebac58bd81f81dd16a1bb41d909fbe2acb64aca0a7646544
Instruction Fuzzy Hash: 08318BEB61C240BEF31685562A445F7AF6FEEC723073044BAF04BD7A03D2954A499231

Function 073309F7 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3edd7249712558c97e4db8de77daee0fd0e88efc54298a8e89fa27e1ce86ec77
Instruction ID: 85a559b5ec2c2626f45936a53897c53454fdefba1fd990298e3ed0502ffd9a23
Opcode Fuzzy Hash: 3edd7249712558c97e4db8de77daee0fd0e88efc54298a8e89fa27e1ce86ec77
Instruction Fuzzy Hash: 9B2128F722C211BEB22A85957704AF66A6FEBC7330B308476B00FD6E01D6908E855171

Function 07330A15 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcaa9a5d808c6c501a91226dc4a4e8717b2e6fe4ae038374726785793c463074
Instruction ID: 738dc79e9ddc54062023397254bf0a298bfbd21a095e4986b6fcbd3cf5d62eff
Opcode Fuzzy Hash: dcaa9a5d808c6c501a91226dc4a4e8717b2e6fe4ae038374726785793c463074
Instruction Fuzzy Hash: D921F9FB22C210BE722A85457B14AF6676FEBC7730B308467B01FD6E01D6908E855171

Function 07330A22 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eba0eacdc4fb1fa47b77c4640e23ace6b1f10c245230477ee6bcbc460c49c76e
Instruction ID: 78d0448c6831ea0630d6265e04d9597933d236c621d4652d62815d841958d0d8
Opcode Fuzzy Hash: eba0eacdc4fb1fa47b77c4640e23ace6b1f10c245230477ee6bcbc460c49c76e
Instruction Fuzzy Hash: C221F6FB62C210BE722A85852B14AF6AB6FEBC7730B30C466B00FD2E01D6908E855171

Function 07330A34 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1654466238.0000000007330000.00000040.00001000.00020000.00000000.sdmp, Offset: 07330000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7330000_94g4KHMj9B.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f679c82e751536b67d6c334938541abd94ebb535cd3802045a840ca228e09c01
Instruction ID: 9b64503ff82ede1ad453ff666e5901cecac5d67c87e77e1c43815ce3541302d2
Opcode Fuzzy Hash: f679c82e751536b67d6c334938541abd94ebb535cd3802045a840ca228e09c01
Instruction Fuzzy Hash: 9E11E7FB62C211BE712A85863B10AF76B6FEAC7730B308466B00FD2E01D2948E455171

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 94g4KHMj9B.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_94g4KHMj9B.exe_b6575ed36de09c438bf01f2cf3bd5adabbee862_0e460935_81992edc-86d8-4977-93f6-000aff44c863\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER112E.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1296.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER12D5.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
94g4KHMj9B.exe

Function 073301A0 Relevance: 4.2, APIs: 1, Strings: 1, Instructions: 681
COMMON

Function 072F00B9 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 340
COMMON

Function 072F003A Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 339
COMMON

Function 072F0057 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 336
COMMON

Function 072F0047 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 335
COMMON

Function 072F007C Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 329
COMMON

Function 072F006D Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 328
COMMON

Function 072F00E0 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 323
COMMON

Function 072F00A9 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 311
COMMON

Function 072F00FE Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 307
COMMON

Function 072F00D2 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 302
COMMON

Function 072F0112 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 292
COMMON

Function 072F0128 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 290
COMMON

Function 072F0141 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 283
COMMON

Function 072F015C Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 276
COMMON