Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1532434
MD5:	94eedad5efd6b4130b472b769b0a5c35
SHA1:	db9d4f3b42ce62fae1ddcdea627390f1705f0fd9
SHA256:	2b87095a88843574715151c409bc2d2f86431f50c6692247b77d3c3a7afd75cd
Tags:	exeuser-Bitsight
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

AI detected suspicious sample

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Hides threads from debuggers

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to detect virtual machines (SIDT)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Enables debug privileges

Entry point lies outside standard sections

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 3668 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 94EEDAD5EFD6B4130B472B769B0A5C35)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A04867 CryptVerifySignatureA,

0_2_00A04867

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: file.exe, 00000000.00000002.1804351796.0000000000822000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1669447399.0000000004D90000.00000004.00001000.00020000.00000000.sdmp

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099B19B	0_2_0099B19B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099F2E4	0_2_0099F2E4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009FE225	0_2_009FE225
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A036F	0_2_009A036F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00933604	0_2_00933604
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099967E	0_2_0099967E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008BA7FA	0_2_008BA7FA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009948F3	0_2_009948F3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A399E	0_2_009A399E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00997BE8	0_2_00997BE8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008E7B12	0_2_008E7B12
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099CC15	0_2_0099CC15
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00966C65	0_2_00966C65
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00949DD8	0_2_00949DD8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A1DE5	0_2_009A1DE5

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 009FF85C appears 35 times

Source: file.exe, 00000000.00000002.1804382221.0000000000826000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: file.exe

Static PE information: Section: xnyyorma ZLIB complexity 0.9947547969448585

Source: classification engine

Classification label: mal100.evad.winEXE@1/1@0/0

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior

Source: file.exe

Static file information: File size 1743360 > 1048576

Source: file.exe

Static PE information: Raw size of xnyyorma is bigger than: 0x100000 < 0x1a3600

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.820000.0.unpack :EW;.rsrc:W;.idata :W; :EW;xnyyorma:EW;coaxywia:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1b2350 should be: 0x1ac2bd

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: xnyyorma
Source: file.exe	Static PE information: section name: coaxywia
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B609B push 4BC17F26h; mov dword ptr [esp], ebx	0_2_009B9255
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009C0091 push eax; mov dword ptr [esp], 3AFE1AD6h	0_2_009C01F6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009BE095 push eax; ret	0_2_009BE0A4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B7094 push 47433A0Ah; mov dword ptr [esp], edx	0_2_009B70A4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A250B0 push 55A9231Dh; mov dword ptr [esp], eax	0_2_00A25107
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A250B0 push ebx; mov dword ptr [esp], eax	0_2_00A2512F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A70083 push edx; mov dword ptr [esp], eax	0_2_00A700D4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A70083 push edi; mov dword ptr [esp], ecx	0_2_00A700DD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A70083 push 3B7B35BAh; mov dword ptr [esp], edx	0_2_00A701D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A70083 push esi; mov dword ptr [esp], ebp	0_2_00A702B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B80BC push eax; mov dword ptr [esp], esi	0_2_009B83B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3508D push ebp; mov dword ptr [esp], edx	0_2_00A3512B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A59090 push esi; mov dword ptr [esp], 330B3EE5h	0_2_00A59123
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A59090 push 50883D78h; mov dword ptr [esp], eax	0_2_00A59133
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B70D8 push eax; mov dword ptr [esp], 15E4EF5Eh	0_2_009B70DA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0090A0D6 push 03746967h; mov dword ptr [esp], edi	0_2_0090A0F9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0090A0D6 push edx; mov dword ptr [esp], eax	0_2_0090A137
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009C60D4 push 32768A93h; mov dword ptr [esp], ecx	0_2_009C6183
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A570EF push ebp; mov dword ptr [esp], esi	0_2_00A57115
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A570EF push 2C7DD340h; mov dword ptr [esp], esi	0_2_00A5713B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B60C1 push 7E7327DBh; mov dword ptr [esp], edi	0_2_009B67E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009BD0FF push ecx; mov dword ptr [esp], ebp	0_2_009BD1F9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009C00F9 push ebp; mov dword ptr [esp], 4FF35B1Eh	0_2_009C015D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009C00F9 push ebp; mov dword ptr [esp], edi	0_2_009C026C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009BE0E6 push esi; ret	0_2_009BE0F5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B501F push eax; mov dword ptr [esp], esp	0_2_009B8E49
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B1015 push 7C97F055h; mov dword ptr [esp], eax	0_2_009B101D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009C600E push esi; mov dword ptr [esp], edx	0_2_009C6292
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009C600E push 73D910F2h; mov dword ptr [esp], esi	0_2_009C629F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009BE007 push ecx; ret	0_2_009BE016
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0094F031 push ecx; mov dword ptr [esp], eax	0_2_0094F042

Source: file.exe	Static PE information: section name: entropy: 7.804495319048474
Source: file.exe	Static PE information: section name: xnyyorma entropy: 7.952908636162783

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82DA2E second address: 82DA34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82DA34 second address: 82DA38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82DA38 second address: 82DA3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 999164 second address: 999168 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 999168 second address: 999172 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 999172 second address: 999176 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A7D51 second address: 9A7D68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F20D8D0D9FDh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A7D68 second address: 9A7D6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A7FF4 second address: 9A7FFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A7FFE second address: 9A8006 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ABF00 second address: 9ABF0A instructions: 0x00000000 rdtsc 0x00000002 jns 00007F20D8D0D9FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ABF0A second address: 9ABF1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push edx 0x0000000b jp 00007F20D92506CCh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ABF1D second address: 82DA2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 mov eax, dword ptr [eax] 0x00000007 jne 00007F20D8D0D9FEh 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 jmp 00007F20D8D0D9FBh 0x00000016 pop eax 0x00000017 jbe 00007F20D8D0D9F9h 0x0000001d movsx ecx, di 0x00000020 push dword ptr [ebp+122D0239h] 0x00000026 sub dword ptr [ebp+122D2C50h], edi 0x0000002c call dword ptr [ebp+122D17BEh] 0x00000032 pushad 0x00000033 jp 00007F20D8D0DA03h 0x00000039 xor eax, eax 0x0000003b stc 0x0000003c mov edx, dword ptr [esp+28h] 0x00000040 xor dword ptr [ebp+122D311Ch], eax 0x00000046 mov dword ptr [ebp+122D37B9h], eax 0x0000004c sub dword ptr [ebp+122D1A6Ch], esi 0x00000052 mov esi, 0000003Ch 0x00000057 mov dword ptr [ebp+122D2B76h], edx 0x0000005d add esi, dword ptr [esp+24h] 0x00000061 stc 0x00000062 jmp 00007F20D8D0DA05h 0x00000067 lodsw 0x00000069 pushad 0x0000006a pushad 0x0000006b mov esi, eax 0x0000006d popad 0x0000006e mov dl, cl 0x00000070 popad 0x00000071 sub dword ptr [ebp+122D1A6Ch], ecx 0x00000077 add eax, dword ptr [esp+24h] 0x0000007b mov dword ptr [ebp+122D2B76h], esi 0x00000081 mov ebx, dword ptr [esp+24h] 0x00000085 cld 0x00000086 nop 0x00000087 push eax 0x00000088 push edx 0x00000089 push edx 0x0000008a pushad 0x0000008b popad 0x0000008c pop edx 0x0000008d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC0B0 second address: 9AC0B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC0B4 second address: 9AC0B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC16A second address: 9AC170 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC170 second address: 9AC174 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AC174 second address: 9AC1EE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 4A6D9363h 0x0000000f mov ecx, dword ptr [ebp+122D3841h] 0x00000015 mov edx, edi 0x00000017 push 00000003h 0x00000019 pushad 0x0000001a mov edx, dword ptr [ebp+122D3761h] 0x00000020 mov edx, dword ptr [ebp+122D30DBh] 0x00000026 popad 0x00000027 push 00000000h 0x00000029 sub dword ptr [ebp+122D1BFBh], esi 0x0000002f push 00000003h 0x00000031 push 00000000h 0x00000033 push eax 0x00000034 call 00007F20D92506C8h 0x00000039 pop eax 0x0000003a mov dword ptr [esp+04h], eax 0x0000003e add dword ptr [esp+04h], 0000001Bh 0x00000046 inc eax 0x00000047 push eax 0x00000048 ret 0x00000049 pop eax 0x0000004a ret 0x0000004b mov ecx, dword ptr [ebp+122D3651h] 0x00000051 jmp 00007F20D92506D7h 0x00000056 push C971FAA1h 0x0000005b push edx 0x0000005c push edi 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CAF5A second address: 9CAF5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CAF5E second address: 9CAF73 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F20D92506C6h 0x00000008 jg 00007F20D92506C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CAF73 second address: 9CAF78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CAF78 second address: 9CAF8D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20D92506CFh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CAF8D second address: 9CAF91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CB100 second address: 9CB12B instructions: 0x00000000 rdtsc 0x00000002 ja 00007F20D92506C6h 0x00000008 jmp 00007F20D92506CCh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F20D92506CEh 0x00000014 pop edi 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CB12B second address: 9CB143 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F20D8D0DA04h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CB143 second address: 9CB15A instructions: 0x00000000 rdtsc 0x00000002 jl 00007F20D92506C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F20D92506CDh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CC668 second address: 9CC682 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20D8D0DA06h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CC682 second address: 9CC68B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CC68B second address: 9CC696 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F20D8D0D9F6h 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CC905 second address: 9CC90B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CC90B second address: 9CC92A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F20D8D0DA09h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CC92A second address: 9CC92F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CF0AA second address: 9CF0AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CF242 second address: 9CF27D instructions: 0x00000000 rdtsc 0x00000002 jp 00007F20D92506D4h 0x00000008 jmp 00007F20D92506CEh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 jno 00007F20D92506C6h 0x00000019 jmp 00007F20D92506D8h 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CF27D second address: 9CF2CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20D8D0DA03h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007F20D8D0DA04h 0x00000012 mov eax, dword ptr [eax] 0x00000014 pushad 0x00000015 jns 00007F20D8D0DA0Bh 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CF2CE second address: 9CF2E2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b pushad 0x0000000c jl 00007F20D92506CCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CDACD second address: 9CDAD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CDAD1 second address: 9CDADB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CDADB second address: 9CDADF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D0670 second address: 9D0679 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7AC3 second address: 9D7ACF instructions: 0x00000000 rdtsc 0x00000002 js 00007F20D8D0D9F6h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7C45 second address: 9D7C4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7C4B second address: 9D7C5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F20D8D0D9F6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7C5C second address: 9D7C60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7C60 second address: 9D7C6A instructions: 0x00000000 rdtsc 0x00000002 jno 00007F20D8D0D9F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7DAD second address: 9D7DB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7DB3 second address: 9D7DD0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20D8D0D9FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D835D second address: 9D8362 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8D50 second address: 9D8D54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8D54 second address: 9D8D78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F20D92506CBh 0x0000000c jns 00007F20D92506C6h 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 push ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 jnp 00007F20D92506C6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8D78 second address: 9D8D7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8D7C second address: 9D8DB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jnc 00007F20D92506D9h 0x00000011 mov eax, dword ptr [eax] 0x00000013 pushad 0x00000014 jmp 00007F20D92506CEh 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8DB5 second address: 9D8DB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8DB9 second address: 9D8DBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8DBD second address: 9D8DCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8DCC second address: 9D8DDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jo 00007F20D92506CCh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8DDB second address: 9D8E8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push 00000000h 0x00000008 push eax 0x00000009 call 00007F20D8D0D9F8h 0x0000000e pop eax 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 add dword ptr [esp+04h], 0000001Ch 0x0000001b inc eax 0x0000001c push eax 0x0000001d ret 0x0000001e pop eax 0x0000001f ret 0x00000020 call 00007F20D8D0DA02h 0x00000025 mov edi, dword ptr [ebp+122D1BBBh] 0x0000002b pop edi 0x0000002c mov dword ptr [ebp+122D2E2Dh], edi 0x00000032 add dword ptr [ebp+122D1BD9h], ebx 0x00000038 call 00007F20D8D0D9F9h 0x0000003d jmp 00007F20D8D0D9FBh 0x00000042 push eax 0x00000043 push esi 0x00000044 jmp 00007F20D8D0D9FCh 0x00000049 pop esi 0x0000004a mov eax, dword ptr [esp+04h] 0x0000004e jns 00007F20D8D0DA0Eh 0x00000054 mov eax, dword ptr [eax] 0x00000056 jmp 00007F20D8D0D9FBh 0x0000005b mov dword ptr [esp+04h], eax 0x0000005f jng 00007F20D8D0DA04h 0x00000065 push eax 0x00000066 push edx 0x00000067 pushad 0x00000068 popad 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8E8A second address: 9D8E8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8F99 second address: 9D8F9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D91EC second address: 9D91F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D91F0 second address: 9D91FA instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F20D8D0D9F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D9A62 second address: 9D9A67 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D9C1D second address: 9D9C23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DBD14 second address: 9DBD1E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F20D92506C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DC5D1 second address: 9DC5DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DD171 second address: 9DD189 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20D92506CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push esi 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pop esi 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DC5DF second address: 9DC5EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F20D8D0D9F6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DD432 second address: 9DD438 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DD189 second address: 9DD18F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DD438 second address: 9DD43D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DDF49 second address: 9DDF4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DDF4D second address: 9DDF51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DDF51 second address: 9DDF5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DDF5A second address: 9DDF60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DEB6C second address: 9DEB72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DEB72 second address: 9DEB76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DE878 second address: 9DE8AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F20D8D0D9F6h 0x00000009 jmp 00007F20D8D0D9FEh 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F20D8D0DA08h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E5245 second address: 9E52CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20D92506CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007F20D92506C8h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 00000016h 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 mov edi, ecx 0x00000026 mov ebx, dword ptr [ebp+122D2A30h] 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push ebp 0x00000031 call 00007F20D92506C8h 0x00000036 pop ebp 0x00000037 mov dword ptr [esp+04h], ebp 0x0000003b add dword ptr [esp+04h], 00000019h 0x00000043 inc ebp 0x00000044 push ebp 0x00000045 ret 0x00000046 pop ebp 0x00000047 ret 0x00000048 mov bl, 30h 0x0000004a push 00000000h 0x0000004c push 00000000h 0x0000004e push edx 0x0000004f call 00007F20D92506C8h 0x00000054 pop edx 0x00000055 mov dword ptr [esp+04h], edx 0x00000059 add dword ptr [esp+04h], 00000014h 0x00000061 inc edx 0x00000062 push edx 0x00000063 ret 0x00000064 pop edx 0x00000065 ret 0x00000066 sub dword ptr [ebp+122D2B52h], edx 0x0000006c push eax 0x0000006d push ecx 0x0000006e push eax 0x0000006f push edx 0x00000070 jng 00007F20D92506C6h 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E755F second address: 9E7565 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E6658 second address: 9E665D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7565 second address: 9E756D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E756D second address: 9E7585 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F20D92506C6h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d jp 00007F20D92506D0h 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E677C second address: 9E6786 instructions: 0x00000000 rdtsc 0x00000002 je 00007F20D8D0D9FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7585 second address: 9E75C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 mov edi, dword ptr [ebp+122D2BABh] 0x0000000c jmp 00007F20D92506D0h 0x00000011 push 00000000h 0x00000013 mov ebx, dword ptr [ebp+122D1C00h] 0x00000019 jnc 00007F20D92506CCh 0x0000001f push 00000000h 0x00000021 mov bh, 2Bh 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 push ebx 0x00000029 pop ebx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E75C0 second address: 9E75D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20D8D0D9FEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7737 second address: 9E7741 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F20D92506C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E95A2 second address: 9E95AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E95AA second address: 9E95AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EB294 second address: 9EB29A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E95AE second address: 9E95C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007F20D92506C6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EB29A second address: 9EB29E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E95C0 second address: 9E95CA instructions: 0x00000000 rdtsc 0x00000002 jno 00007F20D92506C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EB29E second address: 9EB2BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20D8D0DA03h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E95CA second address: 9E95E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F20D92506D9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EB2BD second address: 9EB2C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E95E7 second address: 9E9685 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20D92506CFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c mov ebx, 139A39BCh 0x00000011 push dword ptr fs:[00000000h] 0x00000018 call 00007F20D92506D2h 0x0000001d jmp 00007F20D92506CBh 0x00000022 pop ebx 0x00000023 mov dword ptr fs:[00000000h], esp 0x0000002a push 00000000h 0x0000002c push esi 0x0000002d call 00007F20D92506C8h 0x00000032 pop esi 0x00000033 mov dword ptr [esp+04h], esi 0x00000037 add dword ptr [esp+04h], 00000017h 0x0000003f inc esi 0x00000040 push esi 0x00000041 ret 0x00000042 pop esi 0x00000043 ret 0x00000044 jns 00007F20D92506C9h 0x0000004a mov eax, dword ptr [ebp+122D04E1h] 0x00000050 jmp 00007F20D92506CCh 0x00000055 mov dword ptr [ebp+1246B110h], esi 0x0000005b push FFFFFFFFh 0x0000005d mov di, ax 0x00000060 mov di, cx 0x00000063 push eax 0x00000064 push eax 0x00000065 push edx 0x00000066 jo 00007F20D92506CCh 0x0000006c ja 00007F20D92506C6h 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EB2C2 second address: 9EB2C7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EB2C7 second address: 9EB2FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 pushad 0x00000009 mov dl, cl 0x0000000b popad 0x0000000c push 00000000h 0x0000000e pushad 0x0000000f pushad 0x00000010 add dword ptr [ebp+122D295Bh], ebx 0x00000016 push ebx 0x00000017 pop edi 0x00000018 popad 0x00000019 mov ax, 819Ah 0x0000001d popad 0x0000001e push 00000000h 0x00000020 xchg eax, esi 0x00000021 jmp 00007F20D92506CAh 0x00000026 push eax 0x00000027 pushad 0x00000028 pushad 0x00000029 pushad 0x0000002a popad 0x0000002b push eax 0x0000002c pop eax 0x0000002d popad 0x0000002e push edi 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EC470 second address: 9EC474 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EC474 second address: 9EC47A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EB50F second address: 9EB515 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EB515 second address: 9EB519 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EB519 second address: 9EB528 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EB528 second address: 9EB52E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EB52E second address: 9EB53D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F20D8D0D9FAh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99AC81 second address: 99AC85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EC644 second address: 9EC648 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99AC85 second address: 99AC89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99AC89 second address: 99AC8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EC648 second address: 9EC662 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007F20D92506D0h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99AC8F second address: 99AC9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jc 00007F20D8D0D9F6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EC71F second address: 9EC723 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EFB9A second address: 9EFBA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EFBA0 second address: 9EFBC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 mov edi, dword ptr [ebp+122D2935h] 0x0000000c mov dword ptr [ebp+122D2B48h], ecx 0x00000012 push 00000000h 0x00000014 and bx, 02CAh 0x00000019 push 00000000h 0x0000001b mov bx, si 0x0000001e xchg eax, esi 0x0000001f pushad 0x00000020 jng 00007F20D92506CCh 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EFBC8 second address: 9EFBE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F20D8D0D9FCh 0x0000000a je 00007F20D8D0D9F6h 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jnp 00007F20D8D0D9F6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EFBE4 second address: 9EFBEA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EFBEA second address: 9EFBF5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F20D8D0D9F6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F0AFA second address: 9F0B8C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20D92506D6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f call 00007F20D92506C8h 0x00000014 pop edi 0x00000015 mov dword ptr [esp+04h], edi 0x00000019 add dword ptr [esp+04h], 00000018h 0x00000021 inc edi 0x00000022 push edi 0x00000023 ret 0x00000024 pop edi 0x00000025 ret 0x00000026 movsx ebx, dx 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push ebp 0x0000002e call 00007F20D92506C8h 0x00000033 pop ebp 0x00000034 mov dword ptr [esp+04h], ebp 0x00000038 add dword ptr [esp+04h], 00000018h 0x00000040 inc ebp 0x00000041 push ebp 0x00000042 ret 0x00000043 pop ebp 0x00000044 ret 0x00000045 push 00000000h 0x00000047 push 00000000h 0x00000049 push ebx 0x0000004a call 00007F20D92506C8h 0x0000004f pop ebx 0x00000050 mov dword ptr [esp+04h], ebx 0x00000054 add dword ptr [esp+04h], 00000014h 0x0000005c inc ebx 0x0000005d push ebx 0x0000005e ret 0x0000005f pop ebx 0x00000060 ret 0x00000061 add dword ptr [ebp+122D2C2Bh], ebx 0x00000067 push eax 0x00000068 push eax 0x00000069 push edx 0x0000006a pushad 0x0000006b jbe 00007F20D92506C6h 0x00000071 push eax 0x00000072 push edx 0x00000073 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F0B8C second address: 9F0B91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EED51 second address: 9EED64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F20D92506CEh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EED64 second address: 9EED69 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F1D93 second address: 9F1D97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F3BD4 second address: 9F3BD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F2CE0 second address: 9F2CE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F2CE6 second address: 9F2CEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F2CEA second address: 9F2D5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push dword ptr fs:[00000000h] 0x00000010 jmp 00007F20D92506CAh 0x00000015 mov dword ptr fs:[00000000h], esp 0x0000001c mov bl, F3h 0x0000001e mov bl, 68h 0x00000020 mov eax, dword ptr [ebp+122D05C1h] 0x00000026 jo 00007F20D92506C8h 0x0000002c mov bl, dl 0x0000002e mov edi, dword ptr [ebp+122D2D87h] 0x00000034 push FFFFFFFFh 0x00000036 push 00000000h 0x00000038 push ecx 0x00000039 call 00007F20D92506C8h 0x0000003e pop ecx 0x0000003f mov dword ptr [esp+04h], ecx 0x00000043 add dword ptr [esp+04h], 0000001Ch 0x0000004b inc ecx 0x0000004c push ecx 0x0000004d ret 0x0000004e pop ecx 0x0000004f ret 0x00000050 nop 0x00000051 pushad 0x00000052 pushad 0x00000053 jmp 00007F20D92506CFh 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F2D5D second address: 9F2D87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F20D8D0DA09h 0x0000000a popad 0x0000000b push eax 0x0000000c push edi 0x0000000d pushad 0x0000000e jl 00007F20D8D0D9F6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5F62 second address: 9F5F68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5F68 second address: 9F5FF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ebx 0x0000000c call 00007F20D8D0D9F8h 0x00000011 pop ebx 0x00000012 mov dword ptr [esp+04h], ebx 0x00000016 add dword ptr [esp+04h], 00000019h 0x0000001e inc ebx 0x0000001f push ebx 0x00000020 ret 0x00000021 pop ebx 0x00000022 ret 0x00000023 mov dword ptr [ebp+122D1BD9h], ecx 0x00000029 mov dword ptr [ebp+122D351Eh], ebx 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push eax 0x00000034 call 00007F20D8D0D9F8h 0x00000039 pop eax 0x0000003a mov dword ptr [esp+04h], eax 0x0000003e add dword ptr [esp+04h], 0000001Dh 0x00000046 inc eax 0x00000047 push eax 0x00000048 ret 0x00000049 pop eax 0x0000004a ret 0x0000004b and di, 3BD4h 0x00000050 push 00000000h 0x00000052 mov edi, 0FA11684h 0x00000057 xchg eax, esi 0x00000058 push esi 0x00000059 push ebx 0x0000005a jmp 00007F20D8D0DA01h 0x0000005f pop ebx 0x00000060 pop esi 0x00000061 push eax 0x00000062 push eax 0x00000063 push edx 0x00000064 jns 00007F20D8D0D9FCh 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F4EE2 second address: 9F4FA2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20D92506D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007F20D92506C8h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 0000001Ah 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 mov dword ptr [ebp+122D17DBh], ebx 0x0000002a push dword ptr fs:[00000000h] 0x00000031 xor di, 0276h 0x00000036 sbb bl, FFFFFF82h 0x00000039 mov dword ptr fs:[00000000h], esp 0x00000040 push 00000000h 0x00000042 push ecx 0x00000043 call 00007F20D92506C8h 0x00000048 pop ecx 0x00000049 mov dword ptr [esp+04h], ecx 0x0000004d add dword ptr [esp+04h], 0000001Ah 0x00000055 inc ecx 0x00000056 push ecx 0x00000057 ret 0x00000058 pop ecx 0x00000059 ret 0x0000005a add dword ptr [ebp+122D1B15h], edi 0x00000060 mov eax, dword ptr [ebp+122D103Dh] 0x00000066 call 00007F20D92506D2h 0x0000006b sbb di, AE2Dh 0x00000070 pop ebx 0x00000071 push FFFFFFFFh 0x00000073 jmp 00007F20D92506D7h 0x00000078 sub ebx, dword ptr [ebp+122D311Ch] 0x0000007e nop 0x0000007f pushad 0x00000080 push ebx 0x00000081 push eax 0x00000082 push edx 0x00000083 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F4FA2 second address: 9F4FAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F4FAB second address: 9F4FAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F4FAF second address: 9F4FCF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F20D8D0DA03h 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F6122 second address: 9F6126 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F6126 second address: 9F612A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F6267 second address: 9F626B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FDE9A second address: 9FDEB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F20D8D0DA01h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FDEB0 second address: 9FDECE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jmp 00007F20D92506D7h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0BE46 second address: A0BE4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0BE4A second address: A0BE50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0BE50 second address: A0BE54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A11DC8 second address: A11DD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F20D92506C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A11DD2 second address: A11DE3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20D8D0D9FAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A12300 second address: A12319 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F20D92506D5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A12319 second address: A1231D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1231D second address: A12328 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A12328 second address: A1232E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1232E second address: A1234E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F20D92506D7h 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A12464 second address: A1246E instructions: 0x00000000 rdtsc 0x00000002 jne 00007F20D8D0D9F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A125DC second address: A125EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F20D92506CAh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A126FF second address: A12705 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A12705 second address: A12718 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F20D92506CDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A12718 second address: A1272C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20D8D0D9FFh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1272C second address: A12732 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A12886 second address: A1289B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 ja 00007F20D8D0D9F6h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jne 00007F20D8D0D9F6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A12E9D second address: A12EA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A12EA1 second address: A12EAC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A12EAC second address: A12EB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A12EB3 second address: A12EBA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E1E89 second address: 9E1EB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 jnp 00007F20D92506DCh 0x0000000d popad 0x0000000e push eax 0x0000000f pushad 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E1EB2 second address: 9BF47E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jg 00007F20D8D0D9FCh 0x0000000b popad 0x0000000c nop 0x0000000d mov dword ptr [ebp+122D1F0Eh], ecx 0x00000013 mov dword ptr [ebp+122D2C50h], edi 0x00000019 lea eax, dword ptr [ebp+12487C00h] 0x0000001f sub ecx, 1E5970C5h 0x00000025 push eax 0x00000026 pushad 0x00000027 pushad 0x00000028 ja 00007F20D8D0D9F6h 0x0000002e push edi 0x0000002f pop edi 0x00000030 popad 0x00000031 push edi 0x00000032 jnc 00007F20D8D0D9F6h 0x00000038 pop edi 0x00000039 popad 0x0000003a mov dword ptr [esp], eax 0x0000003d mov ch, 43h 0x0000003f call dword ptr [ebp+122D1B9Ah] 0x00000045 pushad 0x00000046 pushad 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E26DE second address: 9E26E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E26E2 second address: 9E26E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E28D6 second address: 9E2903 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20D92506D6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b pushad 0x0000000c je 00007F20D92506C8h 0x00000012 push eax 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 jbe 00007F20D92506C6h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E2A4E second address: 9E2A67 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jc 00007F20D8D0D9F6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 pushad 0x00000011 jng 00007F20D8D0D9F6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E2DBF second address: 9E2E01 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jg 00007F20D92506D1h 0x0000000e jmp 00007F20D92506CBh 0x00000013 nop 0x00000014 add di, BD20h 0x00000019 push 0000001Eh 0x0000001b push eax 0x0000001c mov dword ptr [ebp+12477D60h], edi 0x00000022 pop edi 0x00000023 nop 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F20D92506D6h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E2E01 second address: 9E2E2C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F20D8D0DA04h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F20D8D0D9FEh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E2E2C second address: 9E2E42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F20D92506D2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E2F9F second address: 9E2FA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E2FA3 second address: 9E2FCA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F20D92506D1h 0x0000000c jne 00007F20D92506C6h 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 push ecx 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1688F second address: A16895 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A16895 second address: A16899 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A16899 second address: A168A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a js 00007F20D8D0D9F6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A16A3C second address: A16A40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A16EBE second address: A16EC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A16EC4 second address: A16ECA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A16ECA second address: A16ECF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A16ECF second address: A16F09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F20D92506D6h 0x00000008 ja 00007F20D92506C6h 0x0000000e jmp 00007F20D92506D1h 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push edi 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A16F09 second address: A16F14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A16F14 second address: A16F1A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A16F1A second address: A16F20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A16F20 second address: A16F26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A16F26 second address: A16F31 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A171F5 second address: A171F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1FC8A second address: A1FC90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A263E4 second address: A263EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A263EC second address: A263F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A252A8 second address: A252D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F20D92506C6h 0x0000000a popad 0x0000000b jns 00007F20D92506CEh 0x00000011 jo 00007F20D92506C8h 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a push esi 0x0000001b push eax 0x0000001c push edx 0x0000001d jp 00007F20D92506C6h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A25557 second address: A2555D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2555D second address: A25563 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A25563 second address: A25588 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F20D8D0DA0Dh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A256B4 second address: A256BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A256BC second address: A256C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A256C0 second address: A256F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20D92506D1h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jl 00007F20D92506EAh 0x00000011 push edx 0x00000012 jmp 00007F20D92506CCh 0x00000017 pop edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A256F1 second address: A256F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A259BB second address: A259C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A259C1 second address: A259C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A259C5 second address: A259E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20D92506D6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A25DFD second address: A25E05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A25E05 second address: A25E16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F20D92506CCh 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2CC35 second address: A2CC43 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F20D8D0D9F8h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2CC43 second address: A2CC4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F20D92506C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 995B84 second address: 995B8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2C969 second address: A2C96F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2C96F second address: A2C99C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20D8D0DA02h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F20D8D0DA03h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2F673 second address: A2F677 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2F677 second address: A2F67D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3643B second address: A3644F instructions: 0x00000000 rdtsc 0x00000002 jne 00007F20D92506C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007F20D92506CEh 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3644F second address: A36453 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36453 second address: A3646A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20D92506CCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A34D9F second address: A34DCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F20D8D0DA01h 0x00000009 popad 0x0000000a jmp 00007F20D8D0DA07h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A34DCC second address: A34DD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A34DD2 second address: A34DD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A34DD8 second address: A34DDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A34DDC second address: A34DE6 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F20D8D0D9F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A35314 second address: A3531E instructions: 0x00000000 rdtsc 0x00000002 jne 00007F20D92506C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3572C second address: A35732 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A361F2 second address: A361F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A393DE second address: A39405 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 jmp 00007F20D8D0DA03h 0x0000000e pushad 0x0000000f popad 0x00000010 pop edx 0x00000011 jp 00007F20D8D0D9F8h 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A39405 second address: A3940B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A38B38 second address: A38B4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F20D8D0D9F6h 0x0000000a popad 0x0000000b pushad 0x0000000c jc 00007F20D8D0D9F6h 0x00000012 push edi 0x00000013 pop edi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A38B4E second address: A38B69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F20D92506D3h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A38DF9 second address: A38E19 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F20D8D0D9FBh 0x00000008 pop esi 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F20D8D0D9FCh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A38E19 second address: A38E30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007F20D92506C8h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A38E30 second address: A38E34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A38E34 second address: A38E52 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20D92506D8h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A38E52 second address: A38E5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F20D8D0D9F6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A38E5E second address: A38E62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A38E62 second address: A38E66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A390F9 second address: A390FE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A390FE second address: A39111 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F20D8D0D9F6h 0x0000000a pop edx 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pushad 0x00000011 popad 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3C48D second address: A3C493 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3CA42 second address: A3CA46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3CA46 second address: A3CA4C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3CA4C second address: A3CA5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F20D8D0D9FAh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3CA5C second address: A3CA60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3CA60 second address: A3CA7A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jne 00007F20D8D0D9F6h 0x00000011 pushad 0x00000012 popad 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3CA7A second address: A3CA80 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3CA80 second address: A3CA85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3CD15 second address: A3CD33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F20D92506D9h 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3CD33 second address: A3CD39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3CD39 second address: A3CD3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3CD3D second address: A3CD6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F20D8D0D9FDh 0x00000011 jmp 00007F20D8D0DA09h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A434FD second address: A43524 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007F20D92506DFh 0x0000000e jmp 00007F20D92506D3h 0x00000013 js 00007F20D92506C6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A43524 second address: A43539 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20D8D0D9FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b push edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A439C5 second address: A439CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A439CC second address: A439EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pop edx 0x0000000c jmp 00007F20D8D0DA01h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A439EF second address: A43A04 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F20D92506C6h 0x00000008 jne 00007F20D92506C6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A43CBD second address: A43CD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007F20D8D0D9FCh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44554 second address: A44560 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007F20D92506C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44560 second address: A4458D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F20D8D0D9FBh 0x00000008 jmp 00007F20D8D0DA01h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 pop eax 0x00000013 jl 00007F20D8D0D9F6h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4484F second address: A4485C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jg 00007F20D92506C6h 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44B5A second address: A44B7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F20D8D0D9F6h 0x0000000a jmp 00007F20D8D0DA01h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44B7A second address: A44B7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44E02 second address: A44E0C instructions: 0x00000000 rdtsc 0x00000002 jne 00007F20D8D0D9F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A450E5 second address: A450EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A450EB second address: A450F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F20D8D0D9F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A450F5 second address: A450F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4943C second address: A49440 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A49440 second address: A4945C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F20D92506D4h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4945C second address: A49466 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F20D8D0D9F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A49466 second address: A4946A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A495F0 second address: A4961B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F20D8D0DA06h 0x0000000d jmp 00007F20D8D0D9FDh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4961B second address: A4963F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20D92506D2h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f jno 00007F20D92506C6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4963F second address: A49643 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A50210 second address: A50218 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A57F62 second address: A57F68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5619F second address: A561B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jno 00007F20D92506CCh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A561B1 second address: A561BC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jl 00007F20D8D0D9F6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A561BC second address: A561CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A561CC second address: A561D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A562EA second address: A562EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A568F3 second address: A568F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A56E88 second address: A56EB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F20D92506D2h 0x00000009 pop edx 0x0000000a push edi 0x0000000b pushad 0x0000000c popad 0x0000000d pop edi 0x0000000e jmp 00007F20D92506D0h 0x00000013 popad 0x00000014 push esi 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A55D0E second address: A55D27 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20D8D0DA05h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9976E9 second address: 997702 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F20D92506D5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 997702 second address: 99772C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F20D8D0DA06h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f jmp 00007F20D8D0D9FAh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A60292 second address: A602A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F20D92506D2h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A603CF second address: A603D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A60564 second address: A6056E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F20D92506C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6BFD6 second address: A6BFDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A76D6A second address: A76D6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A75BC3 second address: A75BC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A75BC7 second address: A75BD9 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F20D92506C6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A75BD9 second address: A75BE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7AAC1 second address: A7AAC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7AAC5 second address: A7AAC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7AAC9 second address: A7AAD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7AAD1 second address: A7AAD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7AAD7 second address: A7AADD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7AADD second address: A7AAE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7EAC9 second address: A7EACD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7EACD second address: A7EAE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F20D8D0D9FCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7EAE2 second address: A7EAED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7EAED second address: A7EAF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F20D8D0D9F6h 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A822C4 second address: A822C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8997A second address: A8997E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8997E second address: A89984 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A89984 second address: A899B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F20D8D0DA04h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F20D8D0DA01h 0x00000015 popad 0x00000016 push ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A899B8 second address: A899BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A88486 second address: A88493 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A88493 second address: A88497 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A88497 second address: A884A1 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F20D8D0D9F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A88BBD second address: A88BD9 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F20D92506C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007F20D92506C8h 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 jg 00007F20D92506C6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A88BD9 second address: A88BE3 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F20D8D0D9F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8D140 second address: A8D14C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F20D92506C6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9096D second address: A90982 instructions: 0x00000000 rdtsc 0x00000002 je 00007F20D8D0D9F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b jo 00007F20D8D0DA06h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A90982 second address: A90986 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5D20 second address: AB5D36 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20D8D0D9FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5D36 second address: AB5D3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5D3D second address: AB5D4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F20D8D0D9FBh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5D4E second address: AB5D6C instructions: 0x00000000 rdtsc 0x00000002 jc 00007F20D92506C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F20D92506CEh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5D6C second address: AB5D7C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push esi 0x0000000a pop esi 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5D7C second address: AB5D82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5D82 second address: AB5D88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB562D second address: AB5631 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5631 second address: AB5668 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F20D8D0DA00h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f jns 00007F20D8D0D9F6h 0x00000015 pop ecx 0x00000016 pushad 0x00000017 jmp 00007F20D8D0DA03h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB5668 second address: AB566E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB566E second address: AB5693 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F20D8D0D9F6h 0x0000000a popad 0x0000000b jmp 00007F20D8D0D9FBh 0x00000010 pushad 0x00000011 js 00007F20D8D0D9F6h 0x00000017 jbe 00007F20D8D0D9F6h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB57B7 second address: AB57BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB57BB second address: AB57BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB57BF second address: AB57CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB91BA second address: AB91D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F20D8D0D9F6h 0x0000000a popad 0x0000000b push ebx 0x0000000c push eax 0x0000000d pop eax 0x0000000e pushad 0x0000000f popad 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 push esi 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB8C46 second address: AB8C68 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F20D92506D2h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnl 00007F20D92506DAh 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB8C68 second address: AB8C6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABD15D second address: ABD184 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F20D92506D3h 0x00000008 pushad 0x00000009 popad 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jbe 00007F20D92506C6h 0x00000013 jns 00007F20D92506C6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABD184 second address: ABD19E instructions: 0x00000000 rdtsc 0x00000002 jc 00007F20D8D0D9F6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pushad 0x00000012 popad 0x00000013 jp 00007F20D8D0D9F6h 0x00000019 pop eax 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC1531 second address: AC1579 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F20D92506D2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jno 00007F20D92506C6h 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F20D92506CDh 0x00000017 jmp 00007F20D92506D5h 0x0000001c popad 0x0000001d pop ecx 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC1579 second address: AC1583 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F20D8D0D9F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABA2EB second address: ABA30E instructions: 0x00000000 rdtsc 0x00000002 jne 00007F20D92506C6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F20D92506D5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABA30E second address: ABA312 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB8F27 second address: AB8F2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB8F2D second address: AB8F36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB8F36 second address: AB8F40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F20D92506C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABA137 second address: ABA175 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F20D8D0D9F6h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F20D8D0DA07h 0x00000011 push edi 0x00000012 jmp 00007F20D8D0DA08h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABA175 second address: ABA18F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push esi 0x00000006 pushad 0x00000007 popad 0x00000008 pop esi 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d jmp 00007F20D92506CAh 0x00000012 pushad 0x00000013 popad 0x00000014 pop ebx 0x00000015 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 82DA92 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 82D9D7 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 82B606 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A61F2A instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 4E40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 5100000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 7100000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A03011 rdtsc

0_2_00A03011

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_009BE17F sidt fword ptr [esp-02h]

0_2_009BE17F

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 3288

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A07EF4 GetSystemInfo,VirtualAlloc,

0_2_00A07EF4

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A03011 rdtsc

0_2_00A03011

Source: C:\Users\user\Desktop\file.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: &$Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00A039A9 GetSystemTime,GetFileTime,

0_2_00A039A9

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\Desktop\file.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\Desktop\file.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	41 Disable or Modify Tools	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Bypass User Account Control	271 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	271 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	24 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Bypass User Account Control	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.XPACK.Gen
file.exe	100%	Joe Sandbox ML

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1532434
Start date and time:	2024-10-13 07:18:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@1/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): SIHClient.exe
Report size getting too big, too many NtProtectVirtualMemory calls found.

Process:	C:\Users\user\Desktop\file.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9332139354733915
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'743'360 bytes
MD5:	94eedad5efd6b4130b472b769b0a5c35
SHA1:	db9d4f3b42ce62fae1ddcdea627390f1705f0fd9
SHA256:	2b87095a88843574715151c409bc2d2f86431f50c6692247b77d3c3a7afd75cd
SHA512:	045d08f017e657094ce29391c3286edba3715ea5ad1d9276bfbae2f3769b99780ff10beb2fc3ac0ea243f67eeb16118dadf42ab2b5e089e9fc26dc01f0d5169d
SSDEEP:	49152:ljsF/bw3IvNQ8L1123f5PlS2zWbEdjlEh2A:xAw4vNQ8L1MhPQ23djOt
TLSH:	35853321BCBE5F16E4AF0B7BCBE6569308F0E431EA49CBAA702B60734106D50D52B5D7
File Content Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........@E.. ...`....@.. ........................E.....P#....`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x854000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE
Time Stamp:	0x652C2850 [Sun Oct 15 17:58:40 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F20D8805D6Ah
vmread dword ptr [edx], ebx
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
sbb al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8055	0x69	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6000	0x59c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x81f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x2000	0x4000	0x1200	d105986ed0c676b21453de9149f3588d	False	0.9338107638888888	data	7.804495319048474	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x6000	0x59c	0x600	aae15e30898a02f09cc86ed48aa06b09	False	0.4140625	data	4.036947054771808	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x8000	0x2000	0x200	ec9cb51e8cb4ea49a56ee3cf434fb69e	False	0.1484375	data	0.9342685949460681	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0xa000	0x2a4000	0x200	e44b64e91fb8edb9163a46684e15d208	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
xnyyorma	0x2ae000	0x1a4000	0x1a3600	685ba43733b5601f6b2ce070c3d71a74	False	0.9947547969448585	data	7.952908636162783	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
coaxywia	0x452000	0x2000	0x600	f95075da28288265e4e88f1e49699dc2	False	0.59765625	data	5.109351678614352	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x454000	0x4000	0x2200	9a0817ed4a5b7cc7df64c5e4c4344d31	False	0.0646829044117647	DOS executable (COM)	0.7316721577006059	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x6090	0x30c	data			0.42948717948717946
RT_MANIFEST	0x63ac	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
kernel32.dll	lstrcpy

Target ID:	0
Start time:	01:18:57
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x820000
File size:	1'743'360 bytes
MD5 hash:	94EEDAD5EFD6B4130B472B769B0A5C35
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.2%
Dynamic/Decrypted Code Coverage:	3.5%
Signature Coverage:	4.1%
Total number of Nodes:	340
Total number of Limit Nodes:	19

Executed Functions

Function 00A07EF4 Relevance: 3.1, APIs: 2, Instructions: 107
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNELBASE(?,-11AA5FEC), ref: 00A07F00
VirtualAlloc.KERNELBASE(00000000,00004000,00001000,00000004), ref: 00A07F61

Memory Dump Source

Source File: 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.1803295756.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804351796.0000000000822000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804382221.0000000000826000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804949959.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805086459.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805114980.0000000000C74000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_file.jbxd

Similarity

API ID: AllocInfoSystemVirtual
String ID:
API String ID: 3440192736-0
Opcode ID: fedfaed17d5b4b85c81288f82ededbdd81e9c760a6b89be20f3ab2dd7de75edf
Instruction ID: 01245c424089d295e8e89d70c63057e7221f5225157f78fb7cdbf495c49cc7db
Opcode Fuzzy Hash: fedfaed17d5b4b85c81288f82ededbdd81e9c760a6b89be20f3ab2dd7de75edf
Instruction Fuzzy Hash: 5A4111B1D0060AEFD729DF60D905B9677ACFF48B40F4000A6A697CE482EA7495D4CBA4

Function 00A00F2F Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,?,?), ref: 00A01040
LoadLibraryExA.KERNELBASE(00000000,?,?), ref: 00A01054

Strings

1002, xrefs: 00A0100A
.exe, xrefs: 00A00F9B
.dll, xrefs: 00A00F77

Memory Dump Source

Source File: 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.1803295756.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804351796.0000000000822000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804382221.0000000000826000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804949959.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805086459.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805114980.0000000000C74000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_file.jbxd

Similarity

API ID: LibraryLoad
String ID: .dll$.exe$1002
API String ID: 1029625771-847511843
Opcode ID: 8d76c6858da23c6f9d54f44af5f691c8fe201d2363cc46783c12b6bbde5b35b5
Instruction ID: 7b18229ad341a605fcc0644a559deb8c6b380b50b9a5b17fe63a4bcaeaed2bf4
Opcode Fuzzy Hash: 8d76c6858da23c6f9d54f44af5f691c8fe201d2363cc46783c12b6bbde5b35b5
Instruction Fuzzy Hash: EB31567590424EEFDF25AF90EA04FAE7B75FF04311F108129F906961A1D73099E0EBA1

Function 00A01435 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,00A013C7,?,00000000,00000000), ref: 00A014F2
GetModuleHandleA.KERNEL32(00000000,?,?,?,00A013C7,?,00000000,00000000), ref: 00A01500

Strings

.dll, xrefs: 00A01468

Memory Dump Source

Source File: 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.1803295756.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804351796.0000000000822000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804382221.0000000000826000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804949959.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805086459.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805114980.0000000000C74000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_file.jbxd

Similarity

API ID: HandleModule
String ID: .dll
API String ID: 4139908857-2738580789
Opcode ID: 8817379b5eaf1054a268c6221333a1f27cb3ac5ac722316b212ca33e08827ab2
Instruction ID: 6f69fee55c3be837ffa4a6cf200c66d11a2d640f17330247aad6c9a434b294ee
Opcode Fuzzy Hash: 8817379b5eaf1054a268c6221333a1f27cb3ac5ac722316b212ca33e08827ab2
Instruction Fuzzy Hash: 731152B120460EFBDB319F64E918BEC7AB1FF40389F444225F513494E0C7B2A8E4DA95

Function 00A03D8F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(00FE1214,-11AA5FEC), ref: 00A03E08
GetFileAttributesA.KERNEL32(00000000,-11AA5FEC), ref: 00A03E16

Strings

@, xrefs: 00A03DBB

Memory Dump Source

Source File: 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.1803295756.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804351796.0000000000822000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804382221.0000000000826000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804949959.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805086459.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805114980.0000000000C74000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_file.jbxd

Similarity

API ID: AttributesFile
String ID: @
API String ID: 3188754299-2726393805
Opcode ID: 49562351db3421a63943072abd362d60f48d39424de05b2d15336c1a3801a381
Instruction ID: f5a7abdc0c8fe8453ff0f4efb766ac263f79c445bbaf7354cef69ee04c62f9f5
Opcode Fuzzy Hash: 49562351db3421a63943072abd362d60f48d39424de05b2d15336c1a3801a381
Instruction Fuzzy Hash: 1601693250410CFBEF21AF24E9097AD7EB8EF40344F208669F603650D1D7B59BA1EB80

Function 009B4DF8 Relevance: 4.6, APIs: 3, Instructions: 124
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 009B4E53
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 009B4E7A
GetNativeSystemInfo.KERNELBASE(?), ref: 009B4ED1

Memory Dump Source

Source File: 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.1803295756.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804351796.0000000000822000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804382221.0000000000826000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804949959.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805086459.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805114980.0000000000C74000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_file.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID:
API String ID: 1247124224-0
Opcode ID: 4620a2f78cfb743750df4fbfa45fc1287465414d4b422f990b49e5b4b5656851
Instruction ID: 9aa715802aeead31f691899bba73ee491d9f508f6cbd6740db71f60f304833e1
Opcode Fuzzy Hash: 4620a2f78cfb743750df4fbfa45fc1287465414d4b422f990b49e5b4b5656851
Instruction Fuzzy Hash: C9513A7140821AEFDB11EF64C949BEE77E8EF04310F11482EE98186A50D7765CA4DF9A

Function 009FFE0F Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathAddExtensionA.KERNELBASE(?,00000000), ref: 009FFE71

Strings

\\?\, xrefs: 009FFECC

Memory Dump Source

Source File: 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.1803295756.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804351796.0000000000822000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804382221.0000000000826000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804949959.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805086459.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805114980.0000000000C74000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_file.jbxd

Similarity

API ID: ExtensionPath
String ID: \\?\
API String ID: 158807944-4282027825
Opcode ID: 6b4642aa9cfe0f05be9527e032fa777b7f9eff7af289625a899a0f67b471047a
Instruction ID: 17265ba237a060a1552b759d328f6e5dd1ee142d5f903d224feff740d66a3afa
Opcode Fuzzy Hash: 6b4642aa9cfe0f05be9527e032fa777b7f9eff7af289625a899a0f67b471047a
Instruction Fuzzy Hash: 51315A36A0060EBFDF219F94CC19BAEBB79FF48305F0010A1FB05A5061EB729A61DB54

Function 00A0151E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009FF85C: GetCurrentThreadId.KERNEL32 ref: 009FF86B
Part of subcall function 009FF85C: Sleep.KERNELBASE(00000005,00050000,00000000), ref: 009FF8AE

GetModuleHandleExA.KERNELBASE(?,?,?), ref: 00A01582

Strings

.dll, xrefs: 00A0153F

Memory Dump Source

Source File: 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.1803295756.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804351796.0000000000822000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804382221.0000000000826000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804949959.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805086459.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805114980.0000000000C74000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_file.jbxd

Similarity

API ID: CurrentHandleModuleSleepThread
String ID: .dll
API String ID: 683542999-2738580789
Opcode ID: 22ce94050ac99d64b98a90fbac697a1636f8d54ab76b28cab45dff3796c8e618
Instruction ID: aa355bed8b447af6690db2f5a5f9e77e94cb5372dd8c5b702611ec72b01390c5
Opcode Fuzzy Hash: 22ce94050ac99d64b98a90fbac697a1636f8d54ab76b28cab45dff3796c8e618
Instruction Fuzzy Hash: 02F01D7210020CBFDF109F64E985BED3BB4FF94354F108125FA178A092D771E9A1AB52

Function 00A03FAB Relevance: 3.1, APIs: 2, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00FE1214,?,?,-11AA5FEC,?,?,?,-11AA5FEC,?), ref: 00A0405D

Part of subcall function 00A03F5D: IsBadWritePtr.KERNEL32(?,00000004), ref: 00A03F6B

CreateFileA.KERNEL32(?,?,?,-11AA5FEC,?,?,?,-11AA5FEC,?), ref: 00A0407D

Memory Dump Source

Source File: 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.1803295756.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804351796.0000000000822000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804382221.0000000000826000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804949959.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805086459.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805114980.0000000000C74000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_file.jbxd

Similarity

API ID: CreateFile$Write
String ID:
API String ID: 1125675974-0
Opcode ID: f48c4aee4076ff52ea52610a15cb1f40e6c940969b21716f611e8a5b3c85233a
Instruction ID: eee35c95309a85e70ce1e11f05d991defb6d2f06091182aee51c33a5cde49e4d
Opcode Fuzzy Hash: f48c4aee4076ff52ea52610a15cb1f40e6c940969b21716f611e8a5b3c85233a
Instruction Fuzzy Hash: 7011297250410EFBDF229F90EE05BAE3E75BF18345F048115BA02644E0C77A8AB1EB51

Function 00A03917 Relevance: 3.0, APIs: 2, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009FF85C: GetCurrentThreadId.KERNEL32 ref: 009FF86B
Part of subcall function 009FF85C: Sleep.KERNELBASE(00000005,00050000,00000000), ref: 009FF8AE

GetCurrentProcess.KERNEL32(-11AA5FEC), ref: 00A03924
DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00A0398A

Memory Dump Source

Source File: 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.1803295756.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804351796.0000000000822000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804382221.0000000000826000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804949959.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805086459.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805114980.0000000000C74000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_file.jbxd

Similarity

API ID: Current$DuplicateHandleProcessSleepThread
String ID:
API String ID: 2846201637-0
Opcode ID: 0b65ae04ff8c4d9a864fcb16df193b0414ea937a66ec3b37adad06a791f38f21
Instruction ID: 9a63dc9cf66f2160bff9bf8dd7c981fbd80212fe060f79f75127bfb059c73610
Opcode Fuzzy Hash: 0b65ae04ff8c4d9a864fcb16df193b0414ea937a66ec3b37adad06a791f38f21
Instruction Fuzzy Hash: A4014B3310014EBBCF22AFA9EC18EEE3B39BF94394B004121FA1290055CB72D562EB61

Function 009FF85C Relevance: 3.0, APIs: 2, Instructions: 33
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 009FF86B
Sleep.KERNELBASE(00000005,00050000,00000000), ref: 009FF8AE

Memory Dump Source

Source File: 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.1803295756.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804351796.0000000000822000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804382221.0000000000826000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804949959.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805086459.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805114980.0000000000C74000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_file.jbxd

Similarity

API ID: CurrentSleepThread
String ID:
API String ID: 1164918020-0
Opcode ID: 8f4b6c5eeca0487dc8872092fb2f383e11fd3c6e49e72bb283761c49bdd024b2
Instruction ID: 27746e8d8f03e67a40775d7a204aa3f9105ec2d5a83fdf8974d75089739220ca
Opcode Fuzzy Hash: 8f4b6c5eeca0487dc8872092fb2f383e11fd3c6e49e72bb283761c49bdd024b2
Instruction Fuzzy Hash: D2F0BE3250110DEBE7218F90C9A876EB3B8FF413AAF2001B9D20395890D7721996EB85

Function 00A08920 Relevance: 1.6, APIs: 1, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.1803295756.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804351796.0000000000822000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804382221.0000000000826000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804949959.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805086459.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805114980.0000000000C74000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 600a0e63277d6b442cc83dbda46948e66705838856fdda208412b9ab0b6e660d
Instruction ID: 0468e28de65b4c6b3fd0c4da922a349cc88a5ab89004d2b9503856a6332398d2
Opcode Fuzzy Hash: 600a0e63277d6b442cc83dbda46948e66705838856fdda208412b9ab0b6e660d
Instruction Fuzzy Hash: 91418371A0020DEFDB24DF14E944BAE77B1FF00390F654055E582AB9D2CB39AD90CB59

Function 00A01F96 Relevance: 1.6, APIs: 1, Instructions: 103
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000,00000010), ref: 00A0204B

Memory Dump Source

Source File: 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.1803295756.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804351796.0000000000822000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804382221.0000000000826000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804949959.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805086459.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805114980.0000000000C74000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 99a7081256bfc52ad671be7ae622d601fc96b60b97ec23064844d6077a203953
Instruction ID: 132963807377b0ad529740375d2992b5389d934879a07d7abc6f8a4dc84f764f
Opcode Fuzzy Hash: 99a7081256bfc52ad671be7ae622d601fc96b60b97ec23064844d6077a203953
Instruction Fuzzy Hash: E5316071900309FAEB209F64EC49FAEBBB8FF44714F208169F615AA1D1C7729A51DB24

Function 00A017B2 Relevance: 1.6, APIs: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000), ref: 00A01834

Memory Dump Source

Source File: 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.1803295756.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804351796.0000000000822000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804382221.0000000000826000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804949959.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805086459.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805114980.0000000000C74000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b0b5802f27130bc2166e39052294704520d64fea7296bf618bdb3daf80dd49e4
Instruction ID: 047378a446f882fe50e090f49d78763f440bd2f5845bd467155dbbdd00804dc9
Opcode Fuzzy Hash: b0b5802f27130bc2166e39052294704520d64fea7296bf618bdb3daf80dd49e4
Instruction Fuzzy Hash: 2D31A572A00209BAE7209F64EC45FD977B8EF04728F208369F611EA0D1C7B2A656CB54

Function 00A0866D Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNELBASE(?,?,0000028A,?,?), ref: 00A0871A

Memory Dump Source

Source File: 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.1803295756.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804351796.0000000000822000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804382221.0000000000826000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804949959.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805086459.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805114980.0000000000C74000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_file.jbxd

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: f11bff13e041cae5ee732c0bf41c9fb08ea371149e8cb25145f341efd72e7bed
Instruction ID: 7eb47b258b309a87283b377574aba912716d6e637505c6cb5c235c8984fba811
Opcode Fuzzy Hash: f11bff13e041cae5ee732c0bf41c9fb08ea371149e8cb25145f341efd72e7bed
Instruction Fuzzy Hash: FF11D671A0122DDFEF204714AC48BEB7B7CEF04B10F2050A5F985920C5DF789D808AA9

Function 04E40D41 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 04E40DCD

Memory Dump Source

Source File: 00000000.00000002.1807637489.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e40000_file.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 64c4d2cde608a9ffd3a60210439e3326993e2c2ce691d99e5e008e48c525e6ca
Instruction ID: feaedfd9cb100034c8b57e2979c9fef87526cbcfd22a3647299495cc624c4b95
Opcode Fuzzy Hash: 64c4d2cde608a9ffd3a60210439e3326993e2c2ce691d99e5e008e48c525e6ca
Instruction Fuzzy Hash: 612115B6D00219CFCB54CF99E484BDEFBF1EB88320F14852AD908AB244D734A545CFA5

Function 04E40D48 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 04E40DCD

Memory Dump Source

Source File: 00000000.00000002.1807637489.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e40000_file.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: b35dba3f139148b40d55da489f9bade0058b1b441124f66bd2b9e3eaceb30f55
Instruction ID: 30375254530521ebf37e4c2def0a82e13bd56d57225b12eecf458759206c2f91
Opcode Fuzzy Hash: b35dba3f139148b40d55da489f9bade0058b1b441124f66bd2b9e3eaceb30f55
Instruction Fuzzy Hash: 842115B6C012189FCB50CF99E884ADEFBF4EB88320F14852AD908AB204D774A544CFA5

Function 04E41510 Relevance: 1.6, APIs: 1, Instructions: 54serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32(?,?,?), ref: 04E41580

Memory Dump Source

Source File: 00000000.00000002.1807637489.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e40000_file.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 69e43c469c2db9636df72ff24e7ab95ee30375c53b267558c3ce03af2af18f1b
Instruction ID: 8b65b26004b099754506cbd5f33bdb3bab63b177524ad22e22388151e3647bc2
Opcode Fuzzy Hash: 69e43c469c2db9636df72ff24e7ab95ee30375c53b267558c3ce03af2af18f1b
Instruction Fuzzy Hash: 4811F6B5D00249DFDB10CF9AD584BDEFBF4EB48324F10842AE559A7250D378A684CFA5

Function 04E41509 Relevance: 1.6, APIs: 1, Instructions: 52serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32(?,?,?), ref: 04E41580

Memory Dump Source

Source File: 00000000.00000002.1807637489.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e40000_file.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: cc59763796d1bf5234c7d8062e699a17b5614b7c6217fbca71414484b48f3c5b
Instruction ID: e0fdaaf7fc8a92e6eb47a0703c6e005ff7f68de6091aa27f5de45a9c7a06bade
Opcode Fuzzy Hash: cc59763796d1bf5234c7d8062e699a17b5614b7c6217fbca71414484b48f3c5b
Instruction Fuzzy Hash: 551126B5D00209CFDB10CF9AD584BDEFBF4BB48320F10842AE959A7250D778A684CFA5

Function 00A04AE3 Relevance: 1.6, APIs: 1, Instructions: 51fileCOMMON

Download Yara Rule

APIs

Part of subcall function 009FF85C: GetCurrentThreadId.KERNEL32 ref: 009FF86B
Part of subcall function 009FF85C: Sleep.KERNELBASE(00000005,00050000,00000000), ref: 009FF8AE

MapViewOfFileEx.KERNELBASE(?,?,?,?,?,?,-11AA5FEC), ref: 00A04B6A

Memory Dump Source

Source File: 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.1803295756.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804351796.0000000000822000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804382221.0000000000826000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804949959.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805086459.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805114980.0000000000C74000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_file.jbxd

Similarity

API ID: CurrentFileSleepThreadView
String ID:
API String ID: 2270672837-0
Opcode ID: 49f76f5bf833461dbc9591cab42551e9042d386fd7374aee36e090aa1f78ffc4
Instruction ID: cb8b2e9245f322b560c01af00e3254c18f0e39333314d951d19b1b94bb62c8ed
Opcode Fuzzy Hash: 49f76f5bf833461dbc9591cab42551e9042d386fd7374aee36e090aa1f78ffc4
Instruction Fuzzy Hash: 7911B7B610014EFACF126FA4ED09EAE3B7AFF5A354B044525FB11550A1C736C871EB61

Function 04E41301 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 04E41367

Memory Dump Source

Source File: 00000000.00000002.1807637489.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e40000_file.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: d0abb873852576491b19ddaa22d849880e4d326bef24f4d5fc52ff7bb509a0c1
Instruction ID: ee70dd3fdd83d5e7fde361b86d3a3f25bdfe7aa925c23d35ed0e4b2310ccf158
Opcode Fuzzy Hash: d0abb873852576491b19ddaa22d849880e4d326bef24f4d5fc52ff7bb509a0c1
Instruction Fuzzy Hash: 1D1146B1900249CFDB10CF9AD584BEEFBF4EF48324F24842AD558A3240C778A580CFA5

Function 00A048CB Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.1803295756.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804351796.0000000000822000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804382221.0000000000826000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804949959.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805086459.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805114980.0000000000C74000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_file.jbxd

Similarity

API ID: CurrentSleepThread
String ID:
API String ID: 1164918020-0
Opcode ID: aaebd99a1bd4090d352f5afca3844824b67edfa9e3343e71d5a56dd466cfa982
Instruction ID: fd065aa015b6fd3d388baeba1ad8e3b418a605faa1aa1137d9a3e9f77eb99751
Opcode Fuzzy Hash: aaebd99a1bd4090d352f5afca3844824b67edfa9e3343e71d5a56dd466cfa982
Instruction Fuzzy Hash: 0F111BB210020EEECF12AFA4E909FAF3B75BF48384F104025FA11860A5C775CA65EB91

Function 04E41308 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 04E41367

Memory Dump Source

Source File: 00000000.00000002.1807637489.0000000004E40000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e40000_file.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 372e307ed279888d46b6aa3f68234c587d652f77e696636d78f52919abef798d
Instruction ID: 62f821ffc43d7d9a18e2fc3f7141d0f05581c38413e1b58fdc79272887958c10
Opcode Fuzzy Hash: 372e307ed279888d46b6aa3f68234c587d652f77e696636d78f52919abef798d
Instruction Fuzzy Hash: AE1148B1800349CFDB10CF9AD449BEEFBF4EB48324F20842AD558A3250C778A584CFA5

Function 00A041AF Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

Part of subcall function 009FF85C: GetCurrentThreadId.KERNEL32 ref: 009FF86B
Part of subcall function 009FF85C: Sleep.KERNELBASE(00000005,00050000,00000000), ref: 009FF8AE

ReadFile.KERNELBASE(?,00000000,?,00000400,?,-11AA5FEC,?,?,00A01EDE,?,?,00000400,?,00000000,?,00000000), ref: 00A0421B

Memory Dump Source

Source File: 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.1803295756.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804351796.0000000000822000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804382221.0000000000826000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804949959.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805086459.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805114980.0000000000C74000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_file.jbxd

Similarity

API ID: CurrentFileReadSleepThread
String ID:
API String ID: 1253362762-0
Opcode ID: cbc304a06912e606ea622cbeb8ce83efa7958a3d7a29b9d6b8918853b0866948
Instruction ID: 59f5619e9348b3e771f759461c13ba8de64c0a1301dfb23cc082fd02a3b74e79
Opcode Fuzzy Hash: cbc304a06912e606ea622cbeb8ce83efa7958a3d7a29b9d6b8918853b0866948
Instruction Fuzzy Hash: 56F0B67620410EBBCF129FA4E919EAE3F76FF99351F004121FB0185061D772C5A1EB61

Function 009FFA2D Relevance: 1.3, APIs: 1, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,?), ref: 009FFA91

Memory Dump Source

Source File: 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.1803295756.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804351796.0000000000822000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804382221.0000000000826000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804949959.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805086459.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805114980.0000000000C74000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_file.jbxd

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 6fab3f730afc7e2c06d7ca3597e7125ea1385cbe460197ad6946ad7dab325f28
Instruction ID: c0538c019e67bffa2ce53ff8628839ca9bdb38b94872bb8f3ec921ad74e0cfa4
Opcode Fuzzy Hash: 6fab3f730afc7e2c06d7ca3597e7125ea1385cbe460197ad6946ad7dab325f28
Instruction Fuzzy Hash: F901D236A0010DFFDF219FA4CC14EAEBB7AEF84750F005171B609A41A1E732CA65DB60

Function 00A08297 Relevance: 1.3, APIs: 1, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00001000,00001000,00000004,?,?,00A08293,?,?,00A07F99,?,?,00A07F99,?,?,00A07F99), ref: 00A082B7

Memory Dump Source

Source File: 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.1803295756.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804351796.0000000000822000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804382221.0000000000826000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804949959.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805086459.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805114980.0000000000C74000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e3aa8db192c7bdec13656a24576690dc9b4245eee357810281f5f7f9af9122f9
Instruction ID: 38d277a9151d03265e0ef3b4c6ee5fe62fc88f9df0216ae55f12b27fbf74bc30
Opcode Fuzzy Hash: e3aa8db192c7bdec13656a24576690dc9b4245eee357810281f5f7f9af9122f9
Instruction Fuzzy Hash: 15F081B1900309EFE7208F04D905B99BBF4FF48B51F208068F59A9BA91D7B598D0CBA4

Function 00A025B0 Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 009FF85C: GetCurrentThreadId.KERNEL32 ref: 009FF86B
Part of subcall function 009FF85C: Sleep.KERNELBASE(00000005,00050000,00000000), ref: 009FF8AE

CloseHandle.KERNELBASE(00A01F73,-11AA5FEC,?,?,00A01F73,?), ref: 00A025EE

Memory Dump Source

Source File: 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.1803295756.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804351796.0000000000822000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804382221.0000000000826000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804949959.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805086459.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805114980.0000000000C74000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_file.jbxd

Similarity

API ID: CloseCurrentHandleSleepThread
String ID:
API String ID: 4003616898-0
Opcode ID: 3d0f1eb4322930a99e918ec6457f3ef0d07144fcf0cb1576196365f8c87f0d3d
Instruction ID: e4f7bb341c48d8ca3e007630fa4f7ff29a973ed000b4a2fc8be9f52f5ae68d3e
Opcode Fuzzy Hash: 3d0f1eb4322930a99e918ec6457f3ef0d07144fcf0cb1576196365f8c87f0d3d
Instruction Fuzzy Hash: 56E04FB320014DB6CE207B78EC2DFAE3F789FD1354B044131B60385491DB69E5E2A769

Function 00A01675 Relevance: 1.3, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,009FF6FB,?,?), ref: 00A0167B

Memory Dump Source

Source File: 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.1803295756.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804351796.0000000000822000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804382221.0000000000826000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804949959.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805086459.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805114980.0000000000C74000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 03c1c0bd21155187c4fdcb039e8be15873d6e63cf9b7ed41dae91f3acf2babf4
Instruction ID: 65bb8cca2e6fd2af98b7f1499758205dc3b3a61461843241e8d848950284d15f
Opcode Fuzzy Hash: 03c1c0bd21155187c4fdcb039e8be15873d6e63cf9b7ed41dae91f3acf2babf4
Instruction Fuzzy Hash: F0B09B3100010C77CB417F51EC0584D7F65FF51355B04C110B54684461C773E560D7D5

Non-executed Functions

Function 0099967E Relevance: 12.9, Strings: 9, Instructions: 1617COMMON

Download Yara Rule

Strings

VJF?, xrefs: 0099A5D8
Vvo=, xrefs: 00999974
=vo, xrefs: 0099A6EB
os, xrefs: 0099A57F
&\/}, xrefs: 00999EEF
#9y, xrefs: 0099A34C
_<a, xrefs: 0099A3E4
bOX), xrefs: 0099A216
I'_w, xrefs: 0099A018

Memory Dump Source

Source File: 00000000.00000002.1804547252.000000000082A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.1803295756.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804351796.0000000000822000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804382221.0000000000826000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804949959.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805086459.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805114980.0000000000C74000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_file.jbxd

Similarity

API ID:
String ID: #9y$&\/}$I'_w$VJF?$Vvo=$_<a$bOX)$=vo$os
API String ID: 0-1076337712
Opcode ID: d1b67b0d4447811f0184e223bbbd8483cf29dc058eef6a684f259c91f4e49c62
Instruction ID: 8e41ee0a8db7b49956c5261cad75aebdc09983902d73cc8e838061a11c9dfe7d
Opcode Fuzzy Hash: d1b67b0d4447811f0184e223bbbd8483cf29dc058eef6a684f259c91f4e49c62
Instruction Fuzzy Hash: FEB217F3A0C2049FE304AE6DDC8567AFBE9EF94620F1A453DEAC4C7744EA3558048697

Function 0099CC15 Relevance: 9.1, Strings: 6, Instructions: 1640COMMON

Download Yara Rule

Strings

Q0S[, xrefs: 0099D7F3
v:1, xrefs: 0099D805
`|;~, xrefs: 0099D8D6
4SS?, xrefs: 0099CD7A
/2uw, xrefs: 0099DB36
Ask, xrefs: 0099D7E6

Memory Dump Source

Source File: 00000000.00000002.1804547252.000000000082A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.1803295756.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804351796.0000000000822000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804382221.0000000000826000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804949959.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805086459.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805114980.0000000000C74000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_file.jbxd

Similarity

API ID:
String ID: Ask$/2uw$4SS?$Q0S[$`|;~$v:1
API String ID: 0-411699891
Opcode ID: 42c80cd76fb479069e917626ec1101481acc99c559a76547ebfd8f02b9ab118b
Instruction ID: 77931b2b7db77710c3d50c6c021437fcc4adfeb4282fab7dfa40cc2cb909f797
Opcode Fuzzy Hash: 42c80cd76fb479069e917626ec1101481acc99c559a76547ebfd8f02b9ab118b
Instruction Fuzzy Hash: EFB2F5F3A0C2109FE304AE29DC8167AF7E9EF94720F1A893DE6C487744E63598418797

Function 009A1DE5 Relevance: 7.9, Strings: 5, Instructions: 1694COMMON

Download Yara Rule

Strings

1v7Y, xrefs: 009A31DA
%Dn, xrefs: 009A2180
7-, xrefs: 009A28C4
!Dn, xrefs: 009A217B
|^&, xrefs: 009A2E77

Memory Dump Source

Source File: 00000000.00000002.1804547252.000000000082A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.1803295756.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804351796.0000000000822000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804382221.0000000000826000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804949959.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805086459.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805114980.0000000000C74000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_file.jbxd

Similarity

API ID:
String ID: !Dn$%Dn$1v7Y$|^&$7-
API String ID: 0-1708577662
Opcode ID: f2a308f1d439e861ee61cbfee89a7ad877314fa2a922feb5f930e1143abd6ed4
Instruction ID: 0ff3d34ebb24c8ed6ff3e3905124114a297beb522efb87f433015016da1e21a7
Opcode Fuzzy Hash: f2a308f1d439e861ee61cbfee89a7ad877314fa2a922feb5f930e1143abd6ed4
Instruction Fuzzy Hash: D7B228F3A082049FE304AE2DEC8567AFBE9EFD4320F1A453DEAC4C7744E97558058696

Function 009A036F Relevance: 6.6, Strings: 4, Instructions: 1608COMMON

Download Yara Rule

Strings

"=w, xrefs: 009A09B6
+Hs, xrefs: 009A12BA
E@dN, xrefs: 009A0B11
%vy, xrefs: 009A1452

Memory Dump Source

Source File: 00000000.00000002.1804547252.000000000082A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.1803295756.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804351796.0000000000822000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804382221.0000000000826000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804949959.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805086459.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805114980.0000000000C74000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_file.jbxd

Similarity

API ID:
String ID: "=w$%vy$+Hs$E@dN
API String ID: 0-1078463195
Opcode ID: 1f6a824c43f640b24c37f43e7a9d72e1e97c2dd3fe58ca469edf4e927f32f151
Instruction ID: b4c549565db05786dbf450de448f0dc0d1ab49061dfa11651064e5b35a942747
Opcode Fuzzy Hash: 1f6a824c43f640b24c37f43e7a9d72e1e97c2dd3fe58ca469edf4e927f32f151
Instruction Fuzzy Hash: AAB2E7F360C2049FE304AE29EC8567AFBE9EF94720F16893DE6C5C3744EA3558058697

Function 00997BE8 Relevance: 6.6, Strings: 4, Instructions: 1600COMMON

Download Yara Rule

Strings

1p{, xrefs: 00997F0C
(/, xrefs: 00998D5C
v&P, xrefs: 00997D46
eXwz, xrefs: 00997E89

Memory Dump Source

Source File: 00000000.00000002.1804547252.000000000082A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.1803295756.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804351796.0000000000822000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804382221.0000000000826000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804949959.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805086459.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805114980.0000000000C74000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_file.jbxd

Similarity

API ID:
String ID: 1p{$eXwz$v&P$(/
API String ID: 0-1030765502
Opcode ID: 6ae9d1de4ef9c4953285b0972b429af790b0bb265be1928f3c9a5d62b53ce98a
Instruction ID: 26efac95706a077ea522d78c68c91506896ea0bd171c18ee1022b44f85d9f91a
Opcode Fuzzy Hash: 6ae9d1de4ef9c4953285b0972b429af790b0bb265be1928f3c9a5d62b53ce98a
Instruction Fuzzy Hash: 6AB204F360C204AFE7086E29EC8567AF7E9EF94720F1A492DE6C5C7344EA3558418693

Function 0099B19B Relevance: 6.5, Strings: 4, Instructions: 1549COMMON

Download Yara Rule

Strings

FW%, xrefs: 0099BE47
YX~{, xrefs: 0099C0AD
+u=, xrefs: 0099B2C5
Ku7?, xrefs: 0099B7AC

Memory Dump Source

Source File: 00000000.00000002.1804547252.000000000082A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.1803295756.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804351796.0000000000822000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804382221.0000000000826000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804949959.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805086459.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805114980.0000000000C74000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_file.jbxd

Similarity

API ID:
String ID: +u=$FW%$Ku7?$YX~{
API String ID: 0-1333385171
Opcode ID: 0dca64854829f68f2d4775cf854c45e6b76ad987b7cd97eeabaeb57a6dcb304f
Instruction ID: e4b75c68e64bedb0faf9b1711b615368c280111a6f67b0fc6231af90e3f151fd
Opcode Fuzzy Hash: 0dca64854829f68f2d4775cf854c45e6b76ad987b7cd97eeabaeb57a6dcb304f
Instruction Fuzzy Hash: 20B215F360C204AFE704AE2DEC8577ABBE5EF94720F1A492DE6C583744EA3558018797

Function 0099F2E4 Relevance: 5.8, Strings: 4, Instructions: 758COMMON

Download Yara Rule

Strings

,}{, xrefs: 0099F76F
)QgZ, xrefs: 0099F880
,W_, xrefs: 0099F2E8
XFm, xrefs: 0099F8D9

Memory Dump Source

Source File: 00000000.00000002.1804547252.000000000082A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.1803295756.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804351796.0000000000822000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804382221.0000000000826000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804949959.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805086459.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805114980.0000000000C74000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_file.jbxd

Similarity

API ID:
String ID: )QgZ$,W_$,}{$XFm
API String ID: 0-3934199372
Opcode ID: 8c81c477c3eece5ee99815cc19993815891da6dfa7f828b78e49bc18726c30e6
Instruction ID: 0d2f90295002395d1f248c96c26ed142c70234157f46ef907dd4de983d930099
Opcode Fuzzy Hash: 8c81c477c3eece5ee99815cc19993815891da6dfa7f828b78e49bc18726c30e6
Instruction Fuzzy Hash: AA3259F3A083049FE7046E2DEC8577ABBE5EB94620F1A463DEAC4C3744EA3558058797

Function 009A399E Relevance: 5.4, Strings: 3, Instructions: 1651COMMON

Download Yara Rule

Strings

yA;, xrefs: 009A4283
b^VL, xrefs: 009A39F0
We5, xrefs: 009A3A8C

Memory Dump Source

Source File: 00000000.00000002.1804547252.000000000082A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.1803295756.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804351796.0000000000822000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804382221.0000000000826000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804949959.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805086459.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805114980.0000000000C74000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_file.jbxd

Similarity

API ID:
String ID: We5$b^VL$yA;
API String ID: 0-884815210
Opcode ID: d0003a6dfca4385a58611d23df8479b698278fb86bd80ca4f7a2d2ed3ac551db
Instruction ID: 1001e8ad56d67ff5bef4bc737b1a5d8438afb35291233a47e3680b742e9ec8f0
Opcode Fuzzy Hash: d0003a6dfca4385a58611d23df8479b698278fb86bd80ca4f7a2d2ed3ac551db
Instruction Fuzzy Hash: 46B207F360C304AFE3046E6DEC85A7ABBE9EBD4720F1A463DE6C4C3744E67558018696

Function 008BA7FA Relevance: 5.2, Strings: 4, Instructions: 162COMMON

Download Yara Rule

Strings

&Z?s, xrefs: 008BA905
1I4, xrefs: 008BA891
sJvg, xrefs: 008BA838
1I4, xrefs: 008BA89C

Memory Dump Source

Source File: 00000000.00000002.1804547252.000000000082A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.1803295756.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804351796.0000000000822000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804382221.0000000000826000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804949959.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805086459.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805114980.0000000000C74000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_file.jbxd

Similarity

API ID:
String ID: &Z?s$1I4$1I4$sJvg
API String ID: 0-2913234596
Opcode ID: 295c214475e748996a62fb486ad6807801d5857d453fd01c0ec6c40c93128ddd
Instruction ID: 8be8f896c41424a2dc6de342cc3a094dd2c698b79d036c0a151d1a41f2d7c58c
Opcode Fuzzy Hash: 295c214475e748996a62fb486ad6807801d5857d453fd01c0ec6c40c93128ddd
Instruction Fuzzy Hash: B25106F3E181105BF308AA2CDC4677ABAD6EBD8310F1B453DEAC9D3380E97958018696

Function 009948F3 Relevance: 3.9, Strings: 2, Instructions: 1358COMMON

Download Yara Rule

Strings

P,/w, xrefs: 0099573C
#as, xrefs: 009954AC

Memory Dump Source

Source File: 00000000.00000002.1804547252.000000000082A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.1803295756.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804351796.0000000000822000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804382221.0000000000826000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804949959.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805086459.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805114980.0000000000C74000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_file.jbxd

Similarity

API ID:
String ID: #as$P,/w
API String ID: 0-2130119002
Opcode ID: 72d404061706b4ec26c4e15e7a5e859a392c115116b6f4796a3d4dc68c10f6a5
Instruction ID: fc3bbbc3837c3fab100f1a72da33c476772da3a3994f63fb865fc980a5747f77
Opcode Fuzzy Hash: 72d404061706b4ec26c4e15e7a5e859a392c115116b6f4796a3d4dc68c10f6a5
Instruction Fuzzy Hash: 2B922BF360C2049FE304AE29EC8577AF7E9EB94320F16863DEAC4C7744E63558058697

Function 00A03011 Relevance: 3.8, Strings: 3, Instructions: 66COMMON

Download Yara Rule

Strings

x, xrefs: 00A030B8
%, xrefs: 00A030B2
shell32.dll, xrefs: 00A0302C

Memory Dump Source

Source File: 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.1803295756.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804351796.0000000000822000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804382221.0000000000826000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804949959.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805086459.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805114980.0000000000C74000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_file.jbxd

Similarity

API ID:
String ID: %$shell32.dll$x
API String ID: 0-999810496
Opcode ID: fa52c3c9bd8b6724eaaa3e2716bd5d5aa1608201b07c68003117f6cea949c9ca
Instruction ID: 47785d822e5241183ba46eaaff79033e4ef7b05ab4a10af8b4450cfddf670c44
Opcode Fuzzy Hash: fa52c3c9bd8b6724eaaa3e2716bd5d5aa1608201b07c68003117f6cea949c9ca
Instruction Fuzzy Hash: 0B116073D0420AEAEB24DF54EA49BAEB7BCFF84704F208056F10399582E37559D58BE1

Function 00A039A9 Relevance: 3.0, APIs: 2, Instructions: 43timeCOMMON

Download Yara Rule

APIs

Part of subcall function 009FF85C: GetCurrentThreadId.KERNEL32 ref: 009FF86B
Part of subcall function 009FF85C: Sleep.KERNELBASE(00000005,00050000,00000000), ref: 009FF8AE

GetSystemTime.KERNEL32(?,-11AA5FEC), ref: 00A039DE
GetFileTime.KERNEL32(?,?,?,?,-11AA5FEC), ref: 00A03A21

Memory Dump Source

Source File: 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.1803295756.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804351796.0000000000822000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804382221.0000000000826000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804949959.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805086459.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805114980.0000000000C74000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_file.jbxd

Similarity

API ID: Time$CurrentFileSleepSystemThread
String ID:
API String ID: 3818558864-0
Opcode ID: 9070b161a775d8da4f8ed2ad4881b700e7dc8ad073ddd309b3057ad8ab8f203a
Instruction ID: af0d6b8478a13fe83564fabe44ded88cebc16a2c9c787e6a3ff8160f2b49eacb
Opcode Fuzzy Hash: 9070b161a775d8da4f8ed2ad4881b700e7dc8ad073ddd309b3057ad8ab8f203a
Instruction Fuzzy Hash: 3E01E83720008AFBCF21AF69E80CE9E7F79FFC5354B104125F65285461C77299A1EB61

Function 00933604 Relevance: 2.7, Strings: 2, Instructions: 194COMMON

Download Yara Rule

Strings

"&vV, xrefs: 00933615
;*, xrefs: 009336D2

Memory Dump Source

Source File: 00000000.00000002.1804547252.000000000082A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.1803295756.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804351796.0000000000822000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804382221.0000000000826000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804949959.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805086459.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805114980.0000000000C74000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_file.jbxd

Similarity

API ID:
String ID: "&vV$;*
API String ID: 0-2995814020
Opcode ID: 761a93aa2261a7f83cfa497db0b1b88719a5bf0109e7cac52a12c0d5c152fb20
Instruction ID: 8abec84db7c858b9320e597b32de9f751ee498e8e64ea234842d0bda699273c5
Opcode Fuzzy Hash: 761a93aa2261a7f83cfa497db0b1b88719a5bf0109e7cac52a12c0d5c152fb20
Instruction Fuzzy Hash: E8519FF3A082045FF3489E3CEC9572B77D6EBC4710F15823DE98987784E9766D058256

Function 00A04867 Relevance: 1.5, APIs: 1, Instructions: 24encryptionCOMMON

Download Yara Rule

APIs

CryptVerifySignatureA.ADVAPI32(?,?,?,?,?,?), ref: 00A048AE

Memory Dump Source

Source File: 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.1803295756.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804351796.0000000000822000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804382221.0000000000826000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804949959.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805086459.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805114980.0000000000C74000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_file.jbxd

Similarity

API ID: CryptSignatureVerify
String ID:
API String ID: 1015439381-0
Opcode ID: 84649ded8abc832ccb920803104653ec84ce0bc7d6e1518528160dafc81f2bfe
Instruction ID: ce688c575c94ab8754d53a218ca7b3a452b10aa0083b8fd396aab370853caa74
Opcode Fuzzy Hash: 84649ded8abc832ccb920803104653ec84ce0bc7d6e1518528160dafc81f2bfe
Instruction Fuzzy Hash: 65F0F83260064EFFCF01CF94D94499C7BB1FF18315B10C529FA1596150D3769A65EF80

Function 008E7B12 Relevance: 1.5, Strings: 1, Instructions: 213COMMON

Download Yara Rule

Strings

KG1?, xrefs: 008E7BB4

Memory Dump Source

Source File: 00000000.00000002.1804547252.000000000082A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.1803295756.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804351796.0000000000822000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804382221.0000000000826000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804949959.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805086459.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805114980.0000000000C74000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_file.jbxd

Similarity

API ID:
String ID: KG1?
API String ID: 0-1757393386
Opcode ID: 61bb8dd31965f654784dfe299a2aeacb6ddbf068501fe37e35181ba38925afa6
Instruction ID: 7ec88c62addee4f7bbf575e6e48a967ff5d654994087a7a86011c0c98b2482ee
Opcode Fuzzy Hash: 61bb8dd31965f654784dfe299a2aeacb6ddbf068501fe37e35181ba38925afa6
Instruction Fuzzy Hash: 0651D5F3A082149FE340AE2DEC8477AB7E5EF94764F26863DDAC483744E93558058692

Function 00949DD8 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1804547252.000000000082A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.1803295756.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804351796.0000000000822000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804382221.0000000000826000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804949959.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805086459.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805114980.0000000000C74000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94a0bb5910aa3aec410d7f220c6795eb61547f9605e26e0bf64747a177a959cc
Instruction ID: 1bb6740a392ef1e5f191c982497377721bb6fb5d00e1e344e959a2026c08b5a4
Opcode Fuzzy Hash: 94a0bb5910aa3aec410d7f220c6795eb61547f9605e26e0bf64747a177a959cc
Instruction Fuzzy Hash: A461F3F3F182105BE3085A2DEC957BAB7D6EBD4720F1B453EAA89D3380E9755C008696

Function 00966C65 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1804547252.000000000082A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.1803295756.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804351796.0000000000822000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804382221.0000000000826000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804949959.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805086459.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805114980.0000000000C74000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 671d8ef3ed7fddf7dfe6ac131c7ee68a4de96a499288da1953410698b6dd245d
Instruction ID: 6ca5b0b437abb6c99c6b8b7b20325e5a3fc000bbc21eb8d5c85f9bfcca083e8f
Opcode Fuzzy Hash: 671d8ef3ed7fddf7dfe6ac131c7ee68a4de96a499288da1953410698b6dd245d
Instruction Fuzzy Hash: 4C51F7B3B083049BF3449E29DC85779B7D6EBD4310F2A893DD6C4C7780DAB998468746

Function 009FE225 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.1803295756.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804351796.0000000000822000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804382221.0000000000826000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804949959.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805086459.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805114980.0000000000C74000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d0dd46b7f019c92334eb91b7923faede66dcbbce96ebf8b7504a460c65bdbdb
Instruction ID: 14faab89af06ba59e3fb1cfcc320498e60b41c0f6f8115038d2585eb935463a7
Opcode Fuzzy Hash: 5d0dd46b7f019c92334eb91b7923faede66dcbbce96ebf8b7504a460c65bdbdb
Instruction Fuzzy Hash: 452162B251C304AFE315BE68DC81B6AF7E5EF58310F06492DE7D4C3340EA7558508A9B

Function 009BE17F Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.1803295756.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804351796.0000000000822000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804382221.0000000000826000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804949959.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805086459.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805114980.0000000000C74000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7f34283938768cd15b7ab180c4eebfe4952537d3defd5c5bd330f1250b1a7cb
Instruction ID: 9a10c2d61f2842324c6106daaeafa9df21ec9dfa1dcb772bb2c975ed908db8a1
Opcode Fuzzy Hash: b7f34283938768cd15b7ab180c4eebfe4952537d3defd5c5bd330f1250b1a7cb
Instruction Fuzzy Hash: F40124B590021A9ADF25CF04C108ADBB7B6FF48360F2682A9D8056BB10D7746D90CF49

Function 00A02EDF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 009FF85C: GetCurrentThreadId.KERNEL32 ref: 009FF86B
Part of subcall function 009FF85C: Sleep.KERNELBASE(00000005,00050000,00000000), ref: 009FF8AE

Part of subcall function 00A03F5D: IsBadWritePtr.KERNEL32(?,00000004), ref: 00A03F6B

wsprintfA.USER32 ref: 00A02F25
LoadImageA.USER32(?,?,?,?,?,?), ref: 00A02FE9

Strings

%8x, xrefs: 00A02F20, 00A02F23
%8x, xrefs: 00A02FB3, 00A02FE6

Memory Dump Source

Source File: 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.1803295756.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804351796.0000000000822000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804382221.0000000000826000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804949959.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805086459.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805114980.0000000000C74000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_file.jbxd

Similarity

API ID: CurrentImageLoadSleepThreadWritewsprintf
String ID: %8x$%8x
API String ID: 2375920415-2046107164
Opcode ID: 3a4e292b31e23eca2faa66904e4f922088c20d2956c7b647bb3515085073645f
Instruction ID: dfaf4767713afd84ca56f515e598d299395769b0134309349018e7ca51c0b5b8
Opcode Fuzzy Hash: 3a4e292b31e23eca2faa66904e4f922088c20d2956c7b647bb3515085073645f
Instruction Fuzzy Hash: 0431067290020EFBDF119FA4DD49FEEBB79FF84310F108125BA11A61A1D7719A61EB60

Function 00A03AB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNEL32(00FE1214,00004020,00000000,-11AA5FEC), ref: 00A03B9D

Strings

@, xrefs: 00A03ADC

Memory Dump Source

Source File: 00000000.00000002.1804547252.00000000009B0000.00000040.00000001.01000000.00000003.sdmp, Offset: 00820000, based on PE: true

Associated: 00000000.00000002.1803295756.0000000000820000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804351796.0000000000822000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804382221.0000000000826000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.000000000082A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ABF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804547252.0000000000ACE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1804949959.0000000000ACF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805086459.0000000000C72000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1805114980.0000000000C74000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_820000_file.jbxd

Similarity

API ID: AttributesFile
String ID: @
API String ID: 3188754299-2726393805
Opcode ID: 8d1c65975e713b108d5f70ea099adb4d63300cddad4da7b033dc37d29fa9bf3c
Instruction ID: 6ab22c3236f376faf9a926aa2fda8de856ad05b4b63ee2a95ed64ee29413109f
Opcode Fuzzy Hash: 8d1c65975e713b108d5f70ea099adb4d63300cddad4da7b033dc37d29fa9bf3c
Instruction Fuzzy Hash: 3D31BC76504709EFCF248F54D844B9EBBB4FF08354F008529F95667690C3B5AAA4DF90

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: file.exePID: 3668, Parent PID: 2580

General

Chronological Activities

Disassembly

Analysis Process: file.exePID: 3668, Parent PID: 2580COMMON

Execution Graph

Graph

Windows Analysis Report
file.exe

Function 00A07EF4 Relevance: 3.1, APIs: 2, Instructions: 107
memoryCOMMON

Function 00A00F2F Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83
libraryCOMMON

Function 00A01435 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
COMMON

Function 00A03D8F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Function 009B4DF8 Relevance: 4.6, APIs: 3, Instructions: 124
registryCOMMON

Function 009FFE0F Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90
COMMON

Function 00A0151E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32
COMMON

Function 00A03FAB Relevance: 3.1, APIs: 2, Instructions: 57
fileCOMMON

Function 00A03917 Relevance: 3.0, APIs: 2, Instructions: 41
COMMON

Function 009FF85C Relevance: 3.0, APIs: 2, Instructions: 33
sleepthreadCOMMON

Function 00A08920 Relevance: 1.6, APIs: 1, Instructions: 112
COMMON

Function 00A01F96 Relevance: 1.6, APIs: 1, Instructions: 103
fileCOMMON

Function 00A017B2 Relevance: 1.6, APIs: 1, Instructions: 92
fileCOMMON