Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1532483
MD5:	a9f52b759fca494d7766e9b094943263
SHA1:	b4313a43474f46e37fb7d9a269edbe595820076d
SHA256:	621a79298dfe13396763f36f88e0c78ce647363ccec593c8e383be94b50bda17
Tags:	exeuser-Bitsight
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

AI detected suspicious sample

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Hides threads from debuggers

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to detect virtual machines (SIDT)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Enables debug privileges

Entry point lies outside standard sections

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 7268 cmdline: "C:\Users\user\Desktop\file.exe" MD5: A9F52B759FCA494D7766E9B094943263)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00494DE5 CryptVerifySignatureA,

0_2_00494DE5

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: file.exe, 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1732160241.0000000004B70000.00000004.00001000.00020000.00000000.sdmp

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002DF035	0_2_002DF035
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003A4070	0_2_003A4070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0042B257	0_2_0042B257
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003CA27D	0_2_003CA27D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004524DD	0_2_004524DD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004334E4	0_2_004334E4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003444CD	0_2_003444CD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0045155D	0_2_0045155D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0042E51B	0_2_0042E51B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004226CD	0_2_004226CD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00427726	0_2_00427726
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0042D843	0_2_0042D843
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0038A833	0_2_0038A833
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002C9992	0_2_002C9992
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0042999C	0_2_0042999C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00425C1D	0_2_00425C1D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0034ECB8	0_2_0034ECB8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002EFC9F	0_2_002EFC9F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00403D85	0_2_00403D85
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0042FE01	0_2_0042FE01
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00341EEB	0_2_00341EEB

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 0048FDDA appears 35 times

Source: file.exe, 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: file.exe

Static PE information: Section: wwfhkpho ZLIB complexity 0.9944766090029762

Source: classification engine

Classification label: mal100.evad.winEXE@1/1@0/0

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior

Source: file.exe

Static file information: File size 1745408 > 1048576

Source: file.exe

Static PE information: Raw size of wwfhkpho is bigger than: 0x100000 < 0x1a4000

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.2b0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;wwfhkpho:EW;coupwjho:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1b54b8 should be: 0x1abd8d

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: wwfhkpho
Source: file.exe	Static PE information: section name: coupwjho
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0044420C push 1D721BB4h; mov dword ptr [esp], eax	0_2_00446C53
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0044420C push eax; mov dword ptr [esp], edi	0_2_00446C62
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00445043 push 45751125h; mov dword ptr [esp], ecx	0_2_00448216
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002DF035 push 2D9C9956h; mov dword ptr [esp], edx	0_2_002DF0CA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002DF035 push esi; mov dword ptr [esp], ebp	0_2_002DF107
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040006B push ecx; mov dword ptr [esp], 6B466272h	0_2_00400092
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040006B push 6DD28A43h; mov dword ptr [esp], eax	0_2_004000CA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040006B push 6468408Bh; mov dword ptr [esp], ecx	0_2_004000F8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040006B push edi; mov dword ptr [esp], eax	0_2_00400136
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040006B push ebp; mov dword ptr [esp], eax	0_2_0040015E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040006B push 19050BE8h; mov dword ptr [esp], edx	0_2_0040018A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0044A073 push ebp; mov dword ptr [esp], esi	0_2_0044A07A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0044A073 push ecx; mov dword ptr [esp], 111865CAh	0_2_0044A09E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0044A073 push eax; mov dword ptr [esp], esi	0_2_0044ADC9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003A4070 push 48882FEAh; mov dword ptr [esp], ecx	0_2_003A40BE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003A4070 push 24C994F8h; mov dword ptr [esp], edx	0_2_003A4179
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003A4070 push 03D685B0h; mov dword ptr [esp], esp	0_2_003A4227
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003A4070 push edx; mov dword ptr [esp], 00000004h	0_2_003A4242
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0044B012 push ebp; mov dword ptr [esp], 35FF0853h	0_2_0044B013
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00455024 push ebp; mov dword ptr [esp], ebx	0_2_00455447
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0044F020 push esi; mov dword ptr [esp], ecx	0_2_0044F030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0044F020 push edx; mov dword ptr [esp], ebx	0_2_0044F069
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0044F020 push 470061E7h; mov dword ptr [esp], esi	0_2_0044F08D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0044F020 push 5EDC4A39h; mov dword ptr [esp], ebp	0_2_0044F0F2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0044F020 push 670D042Ch; mov dword ptr [esp], eax	0_2_0044F166
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0044B02E push edi; mov dword ptr [esp], 33645B9Fh	0_2_0044B03E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00446039 push 2D3A221Bh; mov dword ptr [esp], edx	0_2_00446060
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0044A0D0 push 70301760h; mov dword ptr [esp], edi	0_2_0044A0D8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0044A0D0 push edi; mov dword ptr [esp], 3743E55Bh	0_2_0044BB57
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004450D3 push 1D721BB4h; mov dword ptr [esp], eax	0_2_00446C53
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004450D3 push eax; mov dword ptr [esp], edi	0_2_00446C62

Source: file.exe	Static PE information: section name: entropy: 7.800002789424939
Source: file.exe	Static PE information: section name: wwfhkpho entropy: 7.952143635234095

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2BDFC8 second address: 2BDFD2 instructions: 0x00000000 rdtsc 0x00000002 je 00007FAC88C9C32Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4390BE second address: 4390DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FAC88C187C8h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4390DA second address: 4390F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FAC88C9C334h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4390F4 second address: 439111 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FAC88C187C4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 427270 second address: 427276 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 438708 second address: 43870D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 438994 second address: 4389B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jg 00007FAC88C9C33Fh 0x0000000b jmp 00007FAC88C9C339h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43BBBD second address: 43BBC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43BD09 second address: 43BD0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43BD0D second address: 43BD1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007FAC88C187B6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43BD1E second address: 43BD98 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FAC88C9C326h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jnc 00007FAC88C9C326h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 popad 0x00000015 nop 0x00000016 push 00000000h 0x00000018 push ebx 0x00000019 call 00007FAC88C9C328h 0x0000001e pop ebx 0x0000001f mov dword ptr [esp+04h], ebx 0x00000023 add dword ptr [esp+04h], 00000014h 0x0000002b inc ebx 0x0000002c push ebx 0x0000002d ret 0x0000002e pop ebx 0x0000002f ret 0x00000030 pushad 0x00000031 mov bl, 23h 0x00000033 push ecx 0x00000034 add dword ptr [ebp+122D1C43h], edx 0x0000003a pop ecx 0x0000003b popad 0x0000003c mov dword ptr [ebp+122D2EA6h], eax 0x00000042 mov dword ptr [ebp+122D1C43h], eax 0x00000048 push 00000000h 0x0000004a jbe 00007FAC88C9C32Ch 0x00000050 jg 00007FAC88C9C326h 0x00000056 call 00007FAC88C9C329h 0x0000005b pushad 0x0000005c push edi 0x0000005d pushad 0x0000005e popad 0x0000005f pop edi 0x00000060 push esi 0x00000061 pushad 0x00000062 popad 0x00000063 pop esi 0x00000064 popad 0x00000065 push eax 0x00000066 push eax 0x00000067 push edx 0x00000068 jne 00007FAC88C9C32Ch 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43BD98 second address: 43BDDB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jo 00007FAC88C187B6h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jp 00007FAC88C187C7h 0x00000016 mov eax, dword ptr [eax] 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b je 00007FAC88C187B6h 0x00000021 jmp 00007FAC88C187C0h 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43BDDB second address: 43BE11 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC88C9C334h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 jmp 00007FAC88C9C336h 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43BE11 second address: 43BEA0 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FAC88C187BCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b pushad 0x0000000c mov dword ptr [ebp+122D311Eh], edx 0x00000012 jmp 00007FAC88C187C8h 0x00000017 popad 0x00000018 push eax 0x00000019 mov edx, dword ptr [ebp+122D292Fh] 0x0000001f pop esi 0x00000020 push 00000003h 0x00000022 mov edi, dword ptr [ebp+122D3688h] 0x00000028 cld 0x00000029 push 00000000h 0x0000002b mov dword ptr [ebp+122D311Eh], edi 0x00000031 js 00007FAC88C187BCh 0x00000037 push 00000003h 0x00000039 clc 0x0000003a push 51BB8E8Fh 0x0000003f jmp 00007FAC88C187BEh 0x00000044 add dword ptr [esp], 6E447171h 0x0000004b lea ebx, dword ptr [ebp+124519C5h] 0x00000051 jmp 00007FAC88C187C0h 0x00000056 xchg eax, ebx 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a pushad 0x0000005b popad 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43BEA0 second address: 43BEBC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC88C9C331h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 43BEBC second address: 43BEC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FAC88C187B6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44D9DD second address: 44D9E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45AC3D second address: 45AC41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45B5C2 second address: 45B5CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45B5CD second address: 45B5D3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45B5D3 second address: 45B5D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45B87A second address: 45B880 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45B880 second address: 45B88A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FAC88C9C326h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 452DD9 second address: 452DDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 452DDF second address: 452E0B instructions: 0x00000000 rdtsc 0x00000002 jo 00007FAC88C9C326h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f pushad 0x00000010 popad 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FAC88C9C332h 0x00000019 jo 00007FAC88C9C326h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 452E0B second address: 452E1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 je 00007FAC88C187BCh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 452E1B second address: 452E2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007FAC88C9C32Bh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45C91C second address: 45C920 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45C920 second address: 45C945 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 pushad 0x00000008 jmp 00007FAC88C9C339h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45C945 second address: 45C94B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45FD37 second address: 45FD3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45FF56 second address: 45FF5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45FF5C second address: 45FF60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46770A second address: 46770E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46770E second address: 467721 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FAC88C9C326h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 467721 second address: 46772C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46772C second address: 467731 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 428D12 second address: 428D17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 428D17 second address: 428D1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 466B95 second address: 466B99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 466B99 second address: 466BA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 466BA1 second address: 466BC1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007FAC88C187B6h 0x00000009 pushad 0x0000000a popad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FAC88C187BEh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 466BC1 second address: 466BC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 466D5C second address: 466D90 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC88C187C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push edi 0x0000000b push ebx 0x0000000c jmp 00007FAC88C187C2h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 466D90 second address: 466D9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jl 00007FAC88C9C326h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 466EBC second address: 466EC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 466EC0 second address: 466ECA instructions: 0x00000000 rdtsc 0x00000002 je 00007FAC88C9C326h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 466ECA second address: 466EE7 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FAC88C187BAh 0x00000008 pushad 0x00000009 popad 0x0000000a push edx 0x0000000b pop edx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 jp 00007FAC88C187B6h 0x00000017 jg 00007FAC88C187B6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 466EE7 second address: 466EF0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 467023 second address: 467031 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 467031 second address: 467071 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jp 00007FAC88C9C33Dh 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FAC88C9C339h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46732C second address: 467331 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46A35F second address: 46A363 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46A363 second address: 46A367 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46A63E second address: 46A642 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46A642 second address: 46A66C instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FAC88C187B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007FAC88C187CDh 0x00000013 jmp 00007FAC88C187C7h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46A9F9 second address: 46A9FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46A9FD second address: 46AA07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46AA80 second address: 46AA84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46AFE6 second address: 46AFEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46AFEA second address: 46AFF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46B0BB second address: 46B0C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46B2BD second address: 46B2C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46B2C3 second address: 46B2D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 je 00007FAC88C187B6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46B586 second address: 46B58A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46B58A second address: 46B594 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FAC88C187B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46B594 second address: 46B5B4 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FAC88C9C328h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d jg 00007FAC88C9C326h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jnc 00007FAC88C9C326h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46BB24 second address: 46BB28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46E3E5 second address: 46E3F8 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FAC88C9C326h 0x00000008 jns 00007FAC88C9C326h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46E3F8 second address: 46E428 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC88C187C6h 0x00000009 popad 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FAC88C187BFh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46E428 second address: 46E42C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 432FE3 second address: 432FEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push edi 0x00000006 pop edi 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46EA71 second address: 46EA77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46FE06 second address: 46FE2E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC88C187C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jnl 00007FAC88C187C0h 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47158B second address: 47159B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push ebx 0x00000008 jo 00007FAC88C9C32Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47159B second address: 471621 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 nop 0x00000006 push 00000000h 0x00000008 push edi 0x00000009 call 00007FAC88C187B8h 0x0000000e pop edi 0x0000000f mov dword ptr [esp+04h], edi 0x00000013 add dword ptr [esp+04h], 00000019h 0x0000001b inc edi 0x0000001c push edi 0x0000001d ret 0x0000001e pop edi 0x0000001f ret 0x00000020 ja 00007FAC88C187D1h 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push edx 0x0000002b call 00007FAC88C187B8h 0x00000030 pop edx 0x00000031 mov dword ptr [esp+04h], edx 0x00000035 add dword ptr [esp+04h], 0000001Bh 0x0000003d inc edx 0x0000003e push edx 0x0000003f ret 0x00000040 pop edx 0x00000041 ret 0x00000042 xor dword ptr [ebp+122D2543h], edi 0x00000048 push 00000000h 0x0000004a mov si, 51E5h 0x0000004e push eax 0x0000004f push eax 0x00000050 push edx 0x00000051 pushad 0x00000052 je 00007FAC88C187B6h 0x00000058 push esi 0x00000059 pop esi 0x0000005a popad 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 470858 second address: 47085D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47085D second address: 47087A instructions: 0x00000000 rdtsc 0x00000002 jl 00007FAC88C187C3h 0x00000008 jmp 00007FAC88C187BDh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 473B1B second address: 473B82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b jbe 00007FAC88C9C327h 0x00000011 cmc 0x00000012 push 00000000h 0x00000014 movzx ebx, ax 0x00000017 push 00000000h 0x00000019 xor dword ptr [ebp+1244DE51h], ebx 0x0000001f xchg eax, esi 0x00000020 pushad 0x00000021 je 00007FAC88C9C32Ch 0x00000027 jp 00007FAC88C9C326h 0x0000002d jnc 00007FAC88C9C33Bh 0x00000033 popad 0x00000034 push eax 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 jmp 00007FAC88C9C337h 0x0000003d push edi 0x0000003e pop edi 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 473B82 second address: 473B92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAC88C187BCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 474A71 second address: 474A8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC88C9C333h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 473D4D second address: 473D5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 474A8B second address: 474AE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 mov dword ptr [esp], eax 0x0000000b jmp 00007FAC88C9C32Ah 0x00000010 push 00000000h 0x00000012 mov dword ptr [ebp+122D28E9h], edi 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push eax 0x0000001d call 00007FAC88C9C328h 0x00000022 pop eax 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 add dword ptr [esp+04h], 0000001Ch 0x0000002f inc eax 0x00000030 push eax 0x00000031 ret 0x00000032 pop eax 0x00000033 ret 0x00000034 xchg eax, esi 0x00000035 push ebx 0x00000036 jne 00007FAC88C9C328h 0x0000003c pop ebx 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007FAC88C9C32Ch 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 473D5A second address: 473D5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 474AE8 second address: 474AF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FAC88C9C326h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 476B43 second address: 476B63 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC88C187C5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 476B63 second address: 476B70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnc 00007FAC88C9C326h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 476B70 second address: 476BE0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC88C187BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007FAC88C187B8h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 0000001Bh 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 and di, 54D3h 0x0000002a push 00000000h 0x0000002c mov dword ptr [ebp+122DB420h], esi 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push ecx 0x00000037 call 00007FAC88C187B8h 0x0000003c pop ecx 0x0000003d mov dword ptr [esp+04h], ecx 0x00000041 add dword ptr [esp+04h], 00000016h 0x00000049 inc ecx 0x0000004a push ecx 0x0000004b ret 0x0000004c pop ecx 0x0000004d ret 0x0000004e sub dword ptr [ebp+122D26FDh], esi 0x00000054 push eax 0x00000055 push eax 0x00000056 push edx 0x00000057 pushad 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 476BE0 second address: 476BE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 476BE7 second address: 476BED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 476BED second address: 476BF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 476BF1 second address: 476BF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 477C49 second address: 477C4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 478B30 second address: 478B8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 mov edi, dword ptr [ebp+122D332Ch] 0x0000000f push 00000000h 0x00000011 jmp 00007FAC88C187C1h 0x00000016 or dword ptr [ebp+122D2939h], eax 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push ebx 0x00000021 call 00007FAC88C187B8h 0x00000026 pop ebx 0x00000027 mov dword ptr [esp+04h], ebx 0x0000002b add dword ptr [esp+04h], 00000017h 0x00000033 inc ebx 0x00000034 push ebx 0x00000035 ret 0x00000036 pop ebx 0x00000037 ret 0x00000038 xchg eax, esi 0x00000039 jnl 00007FAC88C187BAh 0x0000003f push eax 0x00000040 pushad 0x00000041 push eax 0x00000042 pushad 0x00000043 popad 0x00000044 pop eax 0x00000045 pushad 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 477DD6 second address: 477DE0 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FAC88C9C326h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 478CAD second address: 478CB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 479FB8 second address: 479FBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 478CB1 second address: 478CB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47ADB6 second address: 47ADCE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FAC88C9C330h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 478DAD second address: 478DB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47EE03 second address: 47EE39 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FAC88C9C32Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov bx, A267h 0x00000011 push 00000000h 0x00000013 add dword ptr [ebp+122D254Fh], ecx 0x00000019 push 00000000h 0x0000001b jnc 00007FAC88C9C32Ch 0x00000021 xchg eax, esi 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 pushad 0x00000026 popad 0x00000027 pushad 0x00000028 popad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47EE39 second address: 47EE52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007FAC88C187BBh 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47FDE5 second address: 47FDE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 480D43 second address: 480D75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FAC88C187C6h 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d je 00007FAC88C187BCh 0x00000013 jl 00007FAC88C187B6h 0x00000019 push eax 0x0000001a push edx 0x0000001b ja 00007FAC88C187B6h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47D020 second address: 47D025 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47D025 second address: 47D02F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FAC88C187B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47D02F second address: 47D0A9 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FAC88C9C326h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d pushad 0x0000000e jmp 00007FAC88C9C32Ah 0x00000013 sbb esi, 24AAE9E5h 0x00000019 popad 0x0000001a push dword ptr fs:[00000000h] 0x00000021 mov ebx, dword ptr [ebp+122D36A8h] 0x00000027 mov dword ptr fs:[00000000h], esp 0x0000002e mov ebx, dword ptr [ebp+122D307Eh] 0x00000034 mov eax, dword ptr [ebp+122D0CBDh] 0x0000003a mov ebx, ecx 0x0000003c push FFFFFFFFh 0x0000003e or dword ptr [ebp+122D2C68h], ebx 0x00000044 nop 0x00000045 jc 00007FAC88C9C33Ah 0x0000004b pushad 0x0000004c jmp 00007FAC88C9C330h 0x00000051 push edx 0x00000052 pop edx 0x00000053 popad 0x00000054 push eax 0x00000055 push eax 0x00000056 push edx 0x00000057 jmp 00007FAC88C9C333h 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47BF88 second address: 47BF8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47BF8E second address: 47BF97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47C05D second address: 47C063 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47C063 second address: 47C086 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007FAC88C9C335h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47C086 second address: 47C08A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 482C4E second address: 482C52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 482C52 second address: 482C64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 jng 00007FAC88C187C0h 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 480EBA second address: 480F52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 push dword ptr fs:[00000000h] 0x0000000f push 00000000h 0x00000011 push ebx 0x00000012 call 00007FAC88C9C328h 0x00000017 pop ebx 0x00000018 mov dword ptr [esp+04h], ebx 0x0000001c add dword ptr [esp+04h], 00000016h 0x00000024 inc ebx 0x00000025 push ebx 0x00000026 ret 0x00000027 pop ebx 0x00000028 ret 0x00000029 mov dword ptr [ebp+1244DF21h], eax 0x0000002f mov dword ptr [ebp+122D1DFEh], ecx 0x00000035 mov dword ptr fs:[00000000h], esp 0x0000003c mov eax, dword ptr [ebp+122D0D39h] 0x00000042 push 00000000h 0x00000044 push ebx 0x00000045 call 00007FAC88C9C328h 0x0000004a pop ebx 0x0000004b mov dword ptr [esp+04h], ebx 0x0000004f add dword ptr [esp+04h], 0000001Dh 0x00000057 inc ebx 0x00000058 push ebx 0x00000059 ret 0x0000005a pop ebx 0x0000005b ret 0x0000005c jmp 00007FAC88C9C32Fh 0x00000061 push ecx 0x00000062 jmp 00007FAC88C9C333h 0x00000067 pop ebx 0x00000068 push FFFFFFFFh 0x0000006a cld 0x0000006b nop 0x0000006c pushad 0x0000006d push eax 0x0000006e push edx 0x0000006f push esi 0x00000070 pop esi 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 481E06 second address: 481E16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAC88C187BCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 481E16 second address: 481E3E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007FAC88C9C335h 0x00000011 jnl 00007FAC88C9C326h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 482E27 second address: 482EB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 js 00007FAC88C187BEh 0x0000000d js 00007FAC88C187B8h 0x00000013 push esi 0x00000014 pop esi 0x00000015 nop 0x00000016 mov bx, di 0x00000019 mov bl, 36h 0x0000001b push dword ptr fs:[00000000h] 0x00000022 mov dword ptr [ebp+122D1B92h], edx 0x00000028 mov dword ptr fs:[00000000h], esp 0x0000002f push 00000000h 0x00000031 push edi 0x00000032 call 00007FAC88C187B8h 0x00000037 pop edi 0x00000038 mov dword ptr [esp+04h], edi 0x0000003c add dword ptr [esp+04h], 00000019h 0x00000044 inc edi 0x00000045 push edi 0x00000046 ret 0x00000047 pop edi 0x00000048 ret 0x00000049 mov eax, dword ptr [ebp+122D14DDh] 0x0000004f mov dword ptr [ebp+1244DF5Ch], edx 0x00000055 push FFFFFFFFh 0x00000057 push 00000000h 0x00000059 push edx 0x0000005a call 00007FAC88C187B8h 0x0000005f pop edx 0x00000060 mov dword ptr [esp+04h], edx 0x00000064 add dword ptr [esp+04h], 00000015h 0x0000006c inc edx 0x0000006d push edx 0x0000006e ret 0x0000006f pop edx 0x00000070 ret 0x00000071 movsx edi, ax 0x00000074 nop 0x00000075 push eax 0x00000076 push edx 0x00000077 jmp 00007FAC88C187BEh 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 488C2C second address: 488C30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 488C30 second address: 488C39 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 488C39 second address: 488C43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49DA41 second address: 49DA45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49DA45 second address: 49DA51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49DA51 second address: 49DA57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49DA57 second address: 49DA89 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC88C9C32Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jng 00007FAC88C9C326h 0x00000013 je 00007FAC88C9C326h 0x00000019 popad 0x0000001a jmp 00007FAC88C9C333h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49FFF1 second address: 49FFF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4DA4 second address: 4A4DBC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FAC88C9C32Ah 0x00000008 pushad 0x00000009 popad 0x0000000a pop esi 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4DBC second address: 4A4DC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4DC2 second address: 4A4DC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4DC6 second address: 4A4DDC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c jmp 00007FAC88C187BAh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4DDC second address: 4A4DE2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4DE2 second address: 4A4DF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAC88C187BDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4DF3 second address: 4A4DF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42C31E second address: 42C335 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC88C187BCh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3B1A second address: 4A3B20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3B20 second address: 4A3B24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3B24 second address: 4A3B28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3B28 second address: 4A3B44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007FAC88C187C4h 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A3B44 second address: 4A3B78 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FAC88C9C330h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c jno 00007FAC88C9C32Eh 0x00000012 pushad 0x00000013 jmp 00007FAC88C9C32Ah 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A411D second address: 4A4124 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4124 second address: 4A412B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A412B second address: 4A4154 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnc 00007FAC88C187CEh 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push edi 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4154 second address: 4A417B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007FAC88C9C32Eh 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FAC88C9C330h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A4423 second address: 4A4468 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC88C187C8h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jg 00007FAC88C187BCh 0x00000011 js 00007FAC88C187B6h 0x00000017 jmp 00007FAC88C187C8h 0x0000001c push edi 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A9C3E second address: 4A9C56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC88C9C32Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 jc 00007FAC88C9C326h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A9C56 second address: 4A9C73 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC88C187C9h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A9F27 second address: 4A9F2D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A9F2D second address: 4A9F46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FAC88C187C1h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA087 second address: 4AA0B5 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FAC88C9C326h 0x00000008 jmp 00007FAC88C9C337h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FAC88C9C32Ah 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA267 second address: 4AA281 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FAC88C187C3h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4256F0 second address: 4256F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4256F4 second address: 4256F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4256F8 second address: 42570C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007FAC88C9C32Ch 0x0000000e jnl 00007FAC88C9C326h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA8A8 second address: 4AA8B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FAC88C187B6h 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AA8B5 second address: 4AA8BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF626 second address: 4AF62A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF62A second address: 4AF630 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF7AA second address: 4AF7AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AFAAA second address: 4AFAB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AFC22 second address: 4AFC28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AFC28 second address: 4AFC34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jo 00007FAC88C9C326h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF1CB second address: 4AF1CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF1CF second address: 4AF1DD instructions: 0x00000000 rdtsc 0x00000002 js 00007FAC88C9C326h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AFF98 second address: 4AFFA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AFFA0 second address: 4AFFA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AFFA6 second address: 4AFFAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AFFAB second address: 4AFFB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B3354 second address: 4B3359 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B3359 second address: 4B335F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B335F second address: 4B3365 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B3365 second address: 4B3369 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 423C2F second address: 423C35 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 468CEC second address: 468CF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 468CF0 second address: 452DD9 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FAC88C187B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov edi, 743212C1h 0x00000012 lea eax, dword ptr [ebp+1247EA55h] 0x00000018 push 00000000h 0x0000001a push esi 0x0000001b call 00007FAC88C187B8h 0x00000020 pop esi 0x00000021 mov dword ptr [esp+04h], esi 0x00000025 add dword ptr [esp+04h], 00000017h 0x0000002d inc esi 0x0000002e push esi 0x0000002f ret 0x00000030 pop esi 0x00000031 ret 0x00000032 jmp 00007FAC88C187BBh 0x00000037 nop 0x00000038 push ecx 0x00000039 jmp 00007FAC88C187BAh 0x0000003e pop ecx 0x0000003f push eax 0x00000040 jmp 00007FAC88C187C8h 0x00000045 nop 0x00000046 push 00000000h 0x00000048 push ebp 0x00000049 call 00007FAC88C187B8h 0x0000004e pop ebp 0x0000004f mov dword ptr [esp+04h], ebp 0x00000053 add dword ptr [esp+04h], 00000016h 0x0000005b inc ebp 0x0000005c push ebp 0x0000005d ret 0x0000005e pop ebp 0x0000005f ret 0x00000060 call dword ptr [ebp+122D17C1h] 0x00000066 pushad 0x00000067 push eax 0x00000068 push edx 0x00000069 push eax 0x0000006a push edx 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 468DDF second address: 468DE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 469241 second address: 4692D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ebx 0x00000006 jno 00007FAC88C187B6h 0x0000000c pop ebx 0x0000000d popad 0x0000000e add dword ptr [esp], 55A6B2C6h 0x00000015 push 00000000h 0x00000017 push ebx 0x00000018 call 00007FAC88C187B8h 0x0000001d pop ebx 0x0000001e mov dword ptr [esp+04h], ebx 0x00000022 add dword ptr [esp+04h], 0000001Ch 0x0000002a inc ebx 0x0000002b push ebx 0x0000002c ret 0x0000002d pop ebx 0x0000002e ret 0x0000002f jmp 00007FAC88C187C1h 0x00000034 call 00007FAC88C187B9h 0x00000039 ja 00007FAC88C187BEh 0x0000003f push eax 0x00000040 jnc 00007FAC88C187BEh 0x00000046 mov eax, dword ptr [esp+04h] 0x0000004a jnl 00007FAC88C187C0h 0x00000050 mov eax, dword ptr [eax] 0x00000052 pushad 0x00000053 push eax 0x00000054 push edx 0x00000055 jc 00007FAC88C187B6h 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4692D0 second address: 4692FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FAC88C9C331h 0x0000000b popad 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 jo 00007FAC88C9C332h 0x00000016 jo 00007FAC88C9C32Ch 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46948D second address: 469492 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 469768 second address: 46976C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46976C second address: 469772 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 469772 second address: 469778 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 469EEC second address: 469EF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 469EF1 second address: 469F16 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FAC88C9C331h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [eax] 0x0000000f push eax 0x00000010 push edx 0x00000011 jnl 00007FAC88C9C328h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 469FC6 second address: 469FCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 469FCA second address: 469FD1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 469FD1 second address: 46A055 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 jmp 00007FAC88C187C2h 0x0000000d lea eax, dword ptr [ebp+1247EA99h] 0x00000013 push 00000000h 0x00000015 push ebp 0x00000016 call 00007FAC88C187B8h 0x0000001b pop ebp 0x0000001c mov dword ptr [esp+04h], ebp 0x00000020 add dword ptr [esp+04h], 00000014h 0x00000028 inc ebp 0x00000029 push ebp 0x0000002a ret 0x0000002b pop ebp 0x0000002c ret 0x0000002d mov edx, dword ptr [ebp+122D3688h] 0x00000033 push eax 0x00000034 jmp 00007FAC88C187C8h 0x00000039 mov dword ptr [esp], eax 0x0000003c cld 0x0000003d lea eax, dword ptr [ebp+1247EA55h] 0x00000043 jmp 00007FAC88C187C9h 0x00000048 nop 0x00000049 push esi 0x0000004a push eax 0x0000004b push edx 0x0000004c push eax 0x0000004d push edx 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46A055 second address: 46A059 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BACAD second address: 4BACDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC88C187C9h 0x00000009 popad 0x0000000a jo 00007FAC88C187BCh 0x00000010 js 00007FAC88C187B6h 0x00000016 push ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BAE32 second address: 4BAE41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FAC88C9C326h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BAE41 second address: 4BAE7E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC88C187C4h 0x00000007 jbe 00007FAC88C187B6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jnl 00007FAC88C187B8h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FAC88C187BCh 0x0000001d push eax 0x0000001e push edx 0x0000001f jg 00007FAC88C187B6h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BAE7E second address: 4BAE82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BAE82 second address: 4BAE8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BAE8A second address: 4BAE94 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FAC88C9C32Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB158 second address: 4BB15F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB15F second address: 4BB176 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FAC88C9C339h 0x00000008 jmp 00007FAC88C9C32Dh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB176 second address: 4BB17F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB2BC second address: 4BB2C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB2C2 second address: 4BB2CC instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FAC88C187B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB5DC second address: 4BB5E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BB754 second address: 4BB75A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C149D second address: 4C14A3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C14A3 second address: 4C14BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e pop ecx 0x0000000f push edi 0x00000010 jmp 00007FAC88C187BBh 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C14BF second address: 4C14C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C331B second address: 4C3321 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C823A second address: 4C8241 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C83AF second address: 4C83B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C874D second address: 4C8753 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C888D second address: 4C8891 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C8891 second address: 4C8895 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C89F8 second address: 4C89FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C89FC second address: 4C8A02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C8A02 second address: 4C8A0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FAC88C187B6h 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC00F second address: 4CC03F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jne 00007FAC88C9C326h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pushad 0x00000010 popad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 push edi 0x00000017 pop edi 0x00000018 jmp 00007FAC88C9C338h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC03F second address: 4CC057 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC88C187C4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC057 second address: 4CC07A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jl 00007FAC88C9C326h 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jp 00007FAC88C9C326h 0x00000012 jmp 00007FAC88C9C331h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC07A second address: 4CC07E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D0599 second address: 4D05AC instructions: 0x00000000 rdtsc 0x00000002 jl 00007FAC88C9C326h 0x00000008 jnp 00007FAC88C9C326h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D08CC second address: 4D08D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D08D5 second address: 4D08D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D08D9 second address: 4D08DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 469981 second address: 469985 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 469985 second address: 4699FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007FAC88C187BCh 0x0000000c jno 00007FAC88C187B6h 0x00000012 popad 0x00000013 mov dword ptr [esp], eax 0x00000016 clc 0x00000017 mov ebx, dword ptr [ebp+1247EA94h] 0x0000001d mov dword ptr [ebp+122D22A6h], edi 0x00000023 add eax, ebx 0x00000025 push 00000000h 0x00000027 push ebx 0x00000028 call 00007FAC88C187B8h 0x0000002d pop ebx 0x0000002e mov dword ptr [esp+04h], ebx 0x00000032 add dword ptr [esp+04h], 0000001Ch 0x0000003a inc ebx 0x0000003b push ebx 0x0000003c ret 0x0000003d pop ebx 0x0000003e ret 0x0000003f jmp 00007FAC88C187BDh 0x00000044 nop 0x00000045 push eax 0x00000046 push edx 0x00000047 pushad 0x00000048 jc 00007FAC88C187B6h 0x0000004e jmp 00007FAC88C187C6h 0x00000053 popad 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4699FC second address: 469A02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 469A02 second address: 469A06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 469A06 second address: 469A1F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FAC88C9C32Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 469A1F second address: 469A25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 469A25 second address: 469AA2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FAC88C9C338h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007FAC88C9C328h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 0000001Ch 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 push 00000004h 0x0000002a jmp 00007FAC88C9C336h 0x0000002f nop 0x00000030 push edx 0x00000031 push ebx 0x00000032 pushad 0x00000033 popad 0x00000034 pop ebx 0x00000035 pop edx 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007FAC88C9C336h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D0DF2 second address: 4D0DF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D0DF8 second address: 4D0DFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D0DFE second address: 4D0E14 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d jnp 00007FAC88C187B6h 0x00000013 pushad 0x00000014 popad 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D0E14 second address: 4D0E1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D0E1B second address: 4D0E21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8894 second address: 4D8898 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8BBE second address: 4D8BC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8BC4 second address: 4D8BCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8BCD second address: 4D8BD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D8BD3 second address: 4D8BD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9495 second address: 4D9499 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9499 second address: 4D94A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D9A29 second address: 4D9A2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE717 second address: 4DE71D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E253E second address: 4E2542 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E2542 second address: 4E2546 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E1858 second address: 4E185E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E185E second address: 4E1862 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E1862 second address: 4E1882 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jnl 00007FAC88C187B6h 0x0000000d pop ecx 0x0000000e popad 0x0000000f jg 00007FAC88C187C6h 0x00000015 push ecx 0x00000016 push eax 0x00000017 pop eax 0x00000018 push edi 0x00000019 pop edi 0x0000001a pop ecx 0x0000001b push eax 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E1DE3 second address: 4E1DF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC88C9C332h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E1DF9 second address: 4E1E21 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FAC88C187B6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c ja 00007FAC88C187BEh 0x00000012 ja 00007FAC88C187BAh 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E1E21 second address: 4E1E27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E1F5F second address: 4E1F67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E1F67 second address: 4E1F79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FAC88C9C326h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push esi 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E210C second address: 4E212E instructions: 0x00000000 rdtsc 0x00000002 ja 00007FAC88C187B6h 0x00000008 jmp 00007FAC88C187C5h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E2295 second address: 4E229B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E229B second address: 4E22A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EBD23 second address: 4EBD3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC88C9C331h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EBD3B second address: 4EBD4E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FAC88C187BEh 0x00000008 pushad 0x00000009 popad 0x0000000a jnp 00007FAC88C187B6h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC3F3 second address: 4EC42B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC88C9C32Fh 0x00000009 pop esi 0x0000000a pop edx 0x0000000b jne 00007FAC88C9C35Fh 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 jmp 00007FAC88C9C339h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC42B second address: 4EC434 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC434 second address: 4EC43C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB363 second address: 4EB36D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FAC88C187B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB36D second address: 4EB371 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F29C9 second address: 4F29CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F2B53 second address: 4F2B59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 501599 second address: 50159F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50159F second address: 5015A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5015A8 second address: 5015B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC88C187BBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 503ED6 second address: 503EFF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FAC88C9C330h 0x00000008 pop edx 0x00000009 push edi 0x0000000a jng 00007FAC88C9C326h 0x00000010 pop edi 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 push edx 0x00000017 pop edx 0x00000018 pushad 0x00000019 popad 0x0000001a push edi 0x0000001b pop edi 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 503EFF second address: 503F04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 506832 second address: 506848 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC88C9C32Ch 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 506848 second address: 50686C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC88C187C4h 0x00000009 popad 0x0000000a pushad 0x0000000b jp 00007FAC88C187B6h 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B0B3 second address: 50B0B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50B0B8 second address: 50B0E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC88C187BCh 0x00000007 pushad 0x00000008 jne 00007FAC88C187B6h 0x0000000e jmp 00007FAC88C187BAh 0x00000013 push esi 0x00000014 pop esi 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 jnp 00007FAC88C187C2h 0x0000001e pushad 0x0000001f pushad 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5156B0 second address: 5156B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5156B4 second address: 5156D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FAC88C187C2h 0x0000000b jnp 00007FAC88C187BCh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51DA8B second address: 51DA8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51DA8F second address: 51DA9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51DA9B second address: 51DA9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C412 second address: 51C418 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C579 second address: 51C57F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C6F2 second address: 51C6FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C6FA second address: 51C6FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C6FE second address: 51C70E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jbe 00007FAC88C187B6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C70E second address: 51C712 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C9E9 second address: 51C9ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C9ED second address: 51C9F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51C9F1 second address: 51CA2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007FAC88C187C2h 0x0000000c popad 0x0000000d pushad 0x0000000e pushad 0x0000000f push esi 0x00000010 pop esi 0x00000011 jno 00007FAC88C187B6h 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FAC88C187C3h 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51CA2E second address: 51CA3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnp 00007FAC88C9C326h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51CDD0 second address: 51CDDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 521E0E second address: 521E1F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC88C9C32Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 521E1F second address: 521E30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 je 00007FAC88C187B6h 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 521E30 second address: 521E71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FAC88C9C326h 0x0000000a popad 0x0000000b jmp 00007FAC88C9C334h 0x00000010 popad 0x00000011 jnp 00007FAC88C9C34Dh 0x00000017 push eax 0x00000018 push edx 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b jmp 00007FAC88C9C337h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 521E71 second address: 521E77 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 521FC4 second address: 521FCA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D3F1 second address: 52D40E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC88C187C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52D40E second address: 52D437 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FAC88C9C32Ch 0x00000008 jnl 00007FAC88C9C326h 0x0000000e jmp 00007FAC88C9C330h 0x00000013 popad 0x00000014 push esi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52ED08 second address: 52ED21 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC88C187BDh 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52ED21 second address: 52ED49 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FAC88C9C326h 0x00000008 jmp 00007FAC88C9C335h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esi 0x00000010 jbe 00007FAC88C9C326h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52ED49 second address: 52ED54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52ED54 second address: 52ED58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52ED58 second address: 52ED6C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC88C187BCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53AD0E second address: 53AD1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FAC88C9C326h 0x0000000a ja 00007FAC88C9C326h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53AD1E second address: 53AD4C instructions: 0x00000000 rdtsc 0x00000002 je 00007FAC88C187B6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FAC88C187BAh 0x00000012 jmp 00007FAC88C187C5h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53AD4C second address: 53AD70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ebx 0x00000008 jmp 00007FAC88C9C339h 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53DDC5 second address: 53DDCF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 544D72 second address: 544D78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5455D5 second address: 5455D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5455D9 second address: 5455F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FAC88C9C32Bh 0x0000000f jno 00007FAC88C9C326h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 545761 second address: 54576B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FAC88C187B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54576B second address: 545786 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FAC88C9C326h 0x00000008 jmp 00007FAC88C9C32Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 545786 second address: 54579D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jnc 00007FAC88C187BEh 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54579D second address: 5457A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5457A1 second address: 5457C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FAC88C187C7h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548F53 second address: 548F5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548F5E second address: 548F68 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FAC88C187B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42DD70 second address: 42DD74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42DD74 second address: 42DD8A instructions: 0x00000000 rdtsc 0x00000002 jg 00007FAC88C187B6h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 jo 00007FAC88C187B6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42DD8A second address: 42DDB5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jnl 00007FAC88C9C326h 0x0000000d pushad 0x0000000e popad 0x0000000f pop ecx 0x00000010 pushad 0x00000011 jmp 00007FAC88C9C32Ah 0x00000016 pushad 0x00000017 popad 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a popad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 jp 00007FAC88C9C326h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42DDB5 second address: 42DDD3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAC88C187BBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FAC88C187BDh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42DDD3 second address: 42DDE6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FAC88C9C32Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54DF54 second address: 54DF5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F7CB second address: 54F7DC instructions: 0x00000000 rdtsc 0x00000002 jg 00007FAC88C9C32Ch 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F7DC second address: 54F80D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC88C187BDh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f jmp 00007FAC88C187BCh 0x00000014 jmp 00007FAC88C187BDh 0x00000019 pop edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54F80D second address: 54F82B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007FAC88C9C326h 0x00000009 jmp 00007FAC88C9C333h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552F76 second address: 552F7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 552F7A second address: 552F92 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007FAC88C9C330h 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54A00B second address: 54A010 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548AD5 second address: 548AE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAC88C9C32Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548AE8 second address: 548AEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548AEC second address: 548AF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548AF7 second address: 548B0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FAC88C187B6h 0x0000000a popad 0x0000000b popad 0x0000000c jng 00007FAC88C187C6h 0x00000012 push eax 0x00000013 push edx 0x00000014 push edi 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548B0D second address: 548B13 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 549ED9 second address: 549EE3 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FAC88C187C2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46CE0B second address: 46CE0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46D02F second address: 46D033 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 2BD77D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 45E6E7 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 468E41 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 4F47A9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 2C1D2E instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 4D50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 4FB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 4EC0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0044DA26 rdtsc

0_2_0044DA26

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0044D6D4 sidt fword ptr [esp-02h]

0_2_0044D6D4

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 7432

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00498486 GetSystemInfo,VirtualAlloc,

0_2_00498486

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0044DA26 rdtsc

0_2_0044DA26

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0044DA26 LdrInitializeThunk,

0_2_0044DA26

Source: C:\Users\user\Desktop\file.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00493F27 GetSystemTime,GetFileTime,

0_2_00493F27

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\Desktop\file.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\Desktop\file.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	41 Disable or Modify Tools	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Bypass User Account Control	271 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	271 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	24 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Bypass User Account Control	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.XPACK.Gen
file.exe	100%	Joe Sandbox ML

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1532483
Start date and time:	2024-10-13 12:18:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@1/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtProtectVirtualMemory calls found.

Process:	C:\Users\user\Desktop\file.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.93186125424167
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'745'408 bytes
MD5:	a9f52b759fca494d7766e9b094943263
SHA1:	b4313a43474f46e37fb7d9a269edbe595820076d
SHA256:	621a79298dfe13396763f36f88e0c78ce647363ccec593c8e383be94b50bda17
SHA512:	10ad96278b5daa05be68302921e66ed2caa1a5b84cef2211afa3331979df61650c224e3befc75ff5f28789e548f61be87ec2b421dc83997945686c19098a8e40
SSDEEP:	49152:85L4ZmvCPStpA0W4fbN4X1SDchS955OUF3KjxPf:85Ln/plGFSDooOjxP
TLSH:	D885333622422535F9E67537A12132756DB0AE2F0934E3C93ED8F83DD4634BE639C862
File Content Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$........... E.. ...`....@.. .......................`E......T....`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x852000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE
Time Stamp:	0x652C2850 [Sun Oct 15 17:58:40 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FAC8872901Ah
jo 00007FAC88729030h
add byte ptr [eax], al
jmp 00007FAC8872B015h
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8055	0x69	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6000	0x59c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x81f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x2000	0x4000	0x1200	30a4093c0ad26636cf569e076592ab26	False	0.9331597222222222	data	7.800002789424939	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x6000	0x59c	0x600	aae15e30898a02f09cc86ed48aa06b09	False	0.4140625	data	4.036947054771808	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x8000	0x2000	0x200	ec9cb51e8cb4ea49a56ee3cf434fb69e	False	0.1484375	data	0.9342685949460681	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0xa000	0x2a2000	0x200	98abb53967ccc4f43dfab23991edc34b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
wwfhkpho	0x2ac000	0x1a4000	0x1a4000	c1ce8d0e7ecb2fa9ecd3affed84211c2	False	0.9944766090029762	data	7.952143635234095	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
coupwjho	0x450000	0x2000	0x400	bf1670e6940930e119eac7029112457c	False	0.861328125	data	6.434208935689177	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x452000	0x4000	0x2200	f29421281883eb19d71a5dc96df70faf	False	0.04641544117647059	DOS executable (COM)	0.455945901473841	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x6090	0x30c	data			0.42948717948717946
RT_MANIFEST	0x63ac	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
kernel32.dll	lstrcpy

Target ID:	0
Start time:	06:19:02
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x2b0000
File size:	1'745'408 bytes
MD5 hash:	A9F52B759FCA494D7766E9B094943263
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.8%
Dynamic/Decrypted Code Coverage:	3.3%
Signature Coverage:	3.9%
Total number of Nodes:	363
Total number of Limit Nodes:	12

Executed Functions

Function 00498486 Relevance: 3.1, APIs: 2, Instructions: 107memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?,-12015FEC), ref: 00498492
VirtualAlloc.KERNELBASE(00000000,00004000,00001000,00000004), ref: 004984F3

Memory Dump Source

Source File: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID: AllocInfoSystemVirtual
String ID:
API String ID: 3440192736-0
Opcode ID: 9928841ef0b8675a65ea03442327e630db8cebbf7aae9e33faab4fdb6eb334d2
Instruction ID: 1903f9d6b6a5413cd899a863f32f0ec0e6f51c038b133281de0cd25154455d85
Opcode Fuzzy Hash: 9928841ef0b8675a65ea03442327e630db8cebbf7aae9e33faab4fdb6eb334d2
Instruction Fuzzy Hash: 354110B1D00206EBE735DF64C945F97BAACFB49700F0005ABA243CE982EB6895D4C7E4

Function 0044DA26 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ecf45a556cbc1a27b11faa2f45444057ea563d45989ca97750fe09bb7d8e8df
Instruction ID: 36b6c6834c4eecfc7d47e019f37ced66de6b048ce6405854ddac6ea411427e7a
Opcode Fuzzy Hash: 3ecf45a556cbc1a27b11faa2f45444057ea563d45989ca97750fe09bb7d8e8df
Instruction Fuzzy Hash: CF118C62154AA26EE3124B159891BED7764FFC2734F24C7AEE0519A8D3C319480BD226

Function 004914AD Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,?,?), ref: 004915BE
LoadLibraryExA.KERNELBASE(00000000,?,?), ref: 004915D2

Strings

.dll, xrefs: 004914F5
.exe, xrefs: 00491519
1002, xrefs: 00491588

Memory Dump Source

Source File: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID: LibraryLoad
String ID: .dll$.exe$1002
API String ID: 1029625771-847511843
Opcode ID: 0a2af394f99b530874db384a59a70f962515d02a4f1397d6f56cb6da5dc99a82
Instruction ID: bc4b3fc03de2e782f3dd646e32b175e6106d75f79b3709b7e3abd14ee3f50789
Opcode Fuzzy Hash: 0a2af394f99b530874db384a59a70f962515d02a4f1397d6f56cb6da5dc99a82
Instruction Fuzzy Hash: 63316D71400206BFCF25AF51D904AAE7F75BF44365F12467BF80296171C7389AA0EB9A

Function 004919B3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,00491945,?,00000000,00000000), ref: 00491A70
GetModuleHandleA.KERNEL32(00000000,?,?,?,00491945,?,00000000,00000000), ref: 00491A7E

Strings

.dll, xrefs: 004919E6

Memory Dump Source

Source File: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID: HandleModule
String ID: .dll
API String ID: 4139908857-2738580789
Opcode ID: d11d31a1efd7759970b32c8d9aec8a4184c5a24010a2969df2627615de6c1dde
Instruction ID: 56443833d662a87cb4c19033b184279c525d30319c5f4cfe09228b969eeac0cb
Opcode Fuzzy Hash: d11d31a1efd7759970b32c8d9aec8a4184c5a24010a2969df2627615de6c1dde
Instruction Fuzzy Hash: A6112E70605207EBEF30AF61DA097AE7EB0BF00349F005237E506445F1C7799D99EA89

Function 0049430D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(00D3122C,-12015FEC), ref: 00494386
GetFileAttributesA.KERNEL32(00000000,-12015FEC), ref: 00494394

Strings

@, xrefs: 00494339

Memory Dump Source

Source File: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID: AttributesFile
String ID: @
API String ID: 3188754299-2726393805
Opcode ID: 6e4ba5eb31d6339c3210f3ee137cd3c856cdba0d09ef3ff9627b756c051d140d
Instruction ID: 28163c1ccb2ae42fa03dde330bd7f78a282f9b7a16df78817756f8f83cd3324d
Opcode Fuzzy Hash: 6e4ba5eb31d6339c3210f3ee137cd3c856cdba0d09ef3ff9627b756c051d140d
Instruction Fuzzy Hash: C3018171604205FADF31AF64D909B9D7E70BF80348F60813BE90265591C7795A93EB89

Function 0044420C Relevance: 4.6, APIs: 3, Instructions: 106
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 00445C7B
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 00445CA2
GetNativeSystemInfo.KERNELBASE(?), ref: 00445CF9

Memory Dump Source

Source File: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID:
API String ID: 1247124224-0
Opcode ID: a3359b06e01080ccfd9518b0eb7ddf4d88c07882782948258547f7c2707ba2ee
Instruction ID: a8ca752b6376185ff879d1afdd27dca3709c658843ee29f5642eddbe3ea19dd4
Opcode Fuzzy Hash: a3359b06e01080ccfd9518b0eb7ddf4d88c07882782948258547f7c2707ba2ee
Instruction Fuzzy Hash: EE413DB140460EDFEF11DF64C8897EE77A4EF05305F10052ADA8282A41E7BA5CA4CF9E

Function 00491780 Relevance: 4.6, APIs: 3, Instructions: 87
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0048FDDA: GetCurrentThreadId.KERNEL32 ref: 0048FDE9

GetModuleFileNameA.KERNEL32(00000000,?,0000028B,-12015FEC,00000000,?), ref: 004917C0
GetFullPathNameA.KERNEL32(?,0000028B,?,00000000,-12015FEC,?), ref: 00491810
GetModuleFileNameA.KERNELBASE(?,?,?,?), ref: 00491889

Memory Dump Source

Source File: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID: Name$FileModule$CurrentFullPathThread
String ID:
API String ID: 2082183393-0
Opcode ID: c0d241149b9d2ba5ff51891768078d845b78920fe4f22a98dd678b976d76cc44
Instruction ID: 43a9d18cb6a494623b08b94859b5389ef15c8e339e6ba854df7b6bc0649712ea
Opcode Fuzzy Hash: c0d241149b9d2ba5ff51891768078d845b78920fe4f22a98dd678b976d76cc44
Instruction Fuzzy Hash: 45318B31A0024AEFEF21EF54DD88FAEBBB5FF45344F0002A6F50696160C7745995DB61

Function 0049038D Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathAddExtensionA.KERNELBASE(?,00000000), ref: 004903EF

Strings

\\?\, xrefs: 0049044A

Memory Dump Source

Source File: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID: ExtensionPath
String ID: \\?\
API String ID: 158807944-4282027825
Opcode ID: 23ca05ade9618279f2337bc8ce78be608e256ca9fea49274cbc64a05e29b671c
Instruction ID: ea73f8c80edd0e10fe48f3ac35f27ffb0350dcc0bd57f9b3dff596465d78e547
Opcode Fuzzy Hash: 23ca05ade9618279f2337bc8ce78be608e256ca9fea49274cbc64a05e29b671c
Instruction Fuzzy Hash: 34313E76A0020ABFDF22DF94ED09F9E7F76BF04704F00016AFA01A5150E37A99A1DB59

Function 04D90D42 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 04D90DCD

Strings

=hy, xrefs: 04D90D6A

Memory Dump Source

Source File: 00000000.00000002.1871522306.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d90000_file.jbxd

Similarity

API ID: ManagerOpen
String ID: =hy
API String ID: 1889721586-2859422337
Opcode ID: cfd10a3e971858380536e608544fa62044c6a6f2cb415a7e022e1afc0094ba01
Instruction ID: f4b17694b2f5cc5eb45ac70ed369e9692521a0722445ff9c1605f388d280efd1
Opcode Fuzzy Hash: cfd10a3e971858380536e608544fa62044c6a6f2cb415a7e022e1afc0094ba01
Instruction Fuzzy Hash: 992137B58012189FCB50DF99E884BDEFBF5FB88310F14811AD818AB245C734A944CBA4

Function 04D90D48 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 04D90DCD

Strings

=hy, xrefs: 04D90D6A

Memory Dump Source

Source File: 00000000.00000002.1871522306.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d90000_file.jbxd

Similarity

API ID: ManagerOpen
String ID: =hy
API String ID: 1889721586-2859422337
Opcode ID: a55d5385f4fcfa801e75e15dad33ffaf6eec28d04cb6f240dab1f16025b6d0ce
Instruction ID: da830892005e853c693bd3868d2df42049b933b0d34ed75975bf06b32bc2e2bd
Opcode Fuzzy Hash: a55d5385f4fcfa801e75e15dad33ffaf6eec28d04cb6f240dab1f16025b6d0ce
Instruction Fuzzy Hash: B72115B6C012189FCB50DF99E884ADEFBF5FB88310F15861AD918AB245D734A944CBA4

Function 04D91509 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 04D91580

Strings

=hy, xrefs: 04D9152F

Memory Dump Source

Source File: 00000000.00000002.1871522306.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d90000_file.jbxd

Similarity

API ID: ControlService
String ID: =hy
API String ID: 253159669-2859422337
Opcode ID: 9a57db09c9e60118f356f8bf291768b210d0de2c609c1c6fa6bfc887e59a1ea6
Instruction ID: 1cb95adea2456d6b080f4b953a3ce9d035d430458313a388eeeed52fe463343a
Opcode Fuzzy Hash: 9a57db09c9e60118f356f8bf291768b210d0de2c609c1c6fa6bfc887e59a1ea6
Instruction Fuzzy Hash: 1A2114B19003499FDB10CF9AC584BDEFBF4EB48320F11842AE559A7340D778AA44CFA5

Function 04D91510 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 04D91580

Strings

=hy, xrefs: 04D9152F

Memory Dump Source

Source File: 00000000.00000002.1871522306.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d90000_file.jbxd

Similarity

API ID: ControlService
String ID: =hy
API String ID: 253159669-2859422337
Opcode ID: f5bbe0b0c1f1e3ed0cc968d2875b68b094825ce622e2ec52f683c6a969ae36b6
Instruction ID: 50e581ea9092aa12a422a3abe95359815d515ede8b298f080516015c56a29080
Opcode Fuzzy Hash: f5bbe0b0c1f1e3ed0cc968d2875b68b094825ce622e2ec52f683c6a969ae36b6
Instruction Fuzzy Hash: DE1114B19003499FDB10CF9AC484BDEFBF4EB48320F10802AE519A3240D378AA44CFA5

Function 04D91301 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 04D91367

Strings

=hy, xrefs: 04D91322

Memory Dump Source

Source File: 00000000.00000002.1871522306.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d90000_file.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID: =hy
API String ID: 2216092060-2859422337
Opcode ID: e5af7787ad885e3ccbae633fde2facfc63771c71ca1662edf610cf9c045c4673
Instruction ID: 4190c456dae7e3e1c7fa3fa6b58de7177c904ba233c7c8592ff1333947029c31
Opcode Fuzzy Hash: e5af7787ad885e3ccbae633fde2facfc63771c71ca1662edf610cf9c045c4673
Instruction Fuzzy Hash: 8A1136B1800249CFDB10DF9AD445BDEFBF4EF48320F24841AD558A3681C778A944CFA5

Function 04D91308 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 04D91367

Strings

=hy, xrefs: 04D91322

Memory Dump Source

Source File: 00000000.00000002.1871522306.0000000004D90000.00000040.00000800.00020000.00000000.sdmp, Offset: 04D90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4d90000_file.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID: =hy
API String ID: 2216092060-2859422337
Opcode ID: 7a8bb842d5870a950eb1d8abe8f803b0e27147edde2053b78445641212085cb7
Instruction ID: 00b58e84ebb47cc9ae6585249c8e179f951c21a5a588549350d75293d4c59cc3
Opcode Fuzzy Hash: 7a8bb842d5870a950eb1d8abe8f803b0e27147edde2053b78445641212085cb7
Instruction Fuzzy Hash: 021133B1800349CFDB10DF9AC845BDEFBF8EB48320F20842AD558A3280C778A944CFA5

Function 00491A9C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0048FDDA: GetCurrentThreadId.KERNEL32 ref: 0048FDE9

GetModuleHandleExA.KERNELBASE(?,?,?), ref: 00491B00

Strings

.dll, xrefs: 00491ABD

Memory Dump Source

Source File: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID: CurrentHandleModuleThread
String ID: .dll
API String ID: 2752942033-2738580789
Opcode ID: 3bd31126e0a383ef4473da5dc8049f45ebc5f612e7322abaf51d1e2378fbf8c8
Instruction ID: a3d136216e1abcf2ae5bab15c636ba6b389b0e8b7c7791b9a37dce1b42634f9f
Opcode Fuzzy Hash: 3bd31126e0a383ef4473da5dc8049f45ebc5f612e7322abaf51d1e2378fbf8c8
Instruction Fuzzy Hash: EEF06D31204206AFCF10EF55C949AAE7BB1BF58354F518136FE0249162D778C861EB55

Function 00494529 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00D3122C,?,?,-12015FEC,?,?,?,-12015FEC,?), ref: 004945DB

Part of subcall function 004944DB: IsBadWritePtr.KERNEL32(?,00000004), ref: 004944E9

CreateFileA.KERNEL32(?,?,?,-12015FEC,?,?,?,-12015FEC,?), ref: 004945FB

Memory Dump Source

Source File: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID: CreateFile$Write
String ID:
API String ID: 1125675974-0
Opcode ID: bef48d24f5fc963e1639e8b3378cf8f256282a1e8e16b16f2a1fcdc70c9a945a
Instruction ID: 58322f0178eb730894cced6bc3edaa14a4015bb51d24b796c10bf369f0b3b27c
Opcode Fuzzy Hash: bef48d24f5fc963e1639e8b3378cf8f256282a1e8e16b16f2a1fcdc70c9a945a
Instruction Fuzzy Hash: 9C111A7140414AFBCF129F91D909FAE3E72BF84358F054126BA0114161C33A89A3EB89

Function 00493E95 Relevance: 3.0, APIs: 2, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 0048FDDA: GetCurrentThreadId.KERNEL32 ref: 0048FDE9

GetCurrentProcess.KERNEL32(-12015FEC), ref: 00493EA2
DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00493F08

Memory Dump Source

Source File: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID: Current$DuplicateHandleProcessThread
String ID:
API String ID: 3748180921-0
Opcode ID: e9074e972a110d9aece9ac8b5d602bb232c82b4d404d1f8eab8df1a155df25db
Instruction ID: 11f9f3b4cff1b2720c5543fc51138117299c9cfccf069b3cf91d84c0077a640e
Opcode Fuzzy Hash: e9074e972a110d9aece9ac8b5d602bb232c82b4d404d1f8eab8df1a155df25db
Instruction Fuzzy Hash: 4401FB3350010AAB8F22AF95DD09CAF3F75FF99359B044937F90194025C73AC562EBA5

Function 004918BA Relevance: 3.0, APIs: 2, Instructions: 39COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,?,-12015FEC,?,00000000,?,?), ref: 00491900
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,-12015FEC,?,00000000,?,?), ref: 0049191F

Memory Dump Source

Source File: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID: ByteCharFileModuleMultiNameWide
String ID:
API String ID: 1532159127-0
Opcode ID: e9c31d86e47d73300e80c8cd2f7fc8cc7f2b392ce2acf45b4c278de152eea924
Instruction ID: 95aa7ebb450c97de7b69d9a4b71f8c731d61e9834196555edfc86366e80e9c0b
Opcode Fuzzy Hash: e9c31d86e47d73300e80c8cd2f7fc8cc7f2b392ce2acf45b4c278de152eea924
Instruction Fuzzy Hash: 5E01D67290024AFBDF129F94CD14EAE7F72FF49354F204569F911AA1A0C7358661EB44

Function 00498EB2 Relevance: 1.6, APIs: 1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 166ab6db3e5b96a79e57ac1170412a08a96bb01f418e644f815f29f3bc75b295
Instruction ID: 2db760cf8bebee38f7ff8f3026a993eb340b5304c8f39a2b7b5cbb3a4d1940d6
Opcode Fuzzy Hash: 166ab6db3e5b96a79e57ac1170412a08a96bb01f418e644f815f29f3bc75b295
Instruction Fuzzy Hash: 25419171A00205EFDF21CF18D944BAABFB1FF02314F14446EE556AA282D77DAD90CB59

Function 00492514 Relevance: 1.6, APIs: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000,00000010), ref: 004925C9

Memory Dump Source

Source File: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3f227491a992828001be16b928389e8b9cc867e05dc9ce3700e8442976b54462
Instruction ID: e51c4348929be91709a67e172bade54cfa64bfdaaed856abd2b8f9067db013aa
Opcode Fuzzy Hash: 3f227491a992828001be16b928389e8b9cc867e05dc9ce3700e8442976b54462
Instruction Fuzzy Hash: 4A31A471900205FBDF209F65DD45FAEBBB8FF04324F20817AF505AA2A1C7759952CB58

Function 00491D30 Relevance: 1.6, APIs: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000), ref: 00491DB2

Memory Dump Source

Source File: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ad46244119372bc0729e4fa65e27bb5d1b2bbbb27f0060125c17d61d0080b181
Instruction ID: 192badb4ab7595cc33b8634e4a8eb894c052ff50fa2ebbd5898a0d8db61e59d8
Opcode Fuzzy Hash: ad46244119372bc0729e4fa65e27bb5d1b2bbbb27f0060125c17d61d0080b181
Instruction Fuzzy Hash: CF31D9B1A40605BEEF209F64EC45F9A7BB8FF00724F20436AF611EA1E1D775A541CB58

Function 00498BFF Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNELBASE(?,?,0000028A,?,?), ref: 00498CAC

Memory Dump Source

Source File: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: 37aa4a5ed2594c45e185c997b7a49a466339746754a3b51015c0fba03bf846ea
Instruction ID: 10891519240299964282365495a39cb5b9671b2d2481ab2b9ed6cafa58a64018
Opcode Fuzzy Hash: 37aa4a5ed2594c45e185c997b7a49a466339746754a3b51015c0fba03bf846ea
Instruction Fuzzy Hash: 2D118471A022259BEF206A088C48BEB7B6CAB46755F1040BBE9059B141DF7C9D819ABD

Function 00495061 Relevance: 1.6, APIs: 1, Instructions: 51fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0048FDDA: GetCurrentThreadId.KERNEL32 ref: 0048FDE9

MapViewOfFileEx.KERNELBASE(?,?,?,?,?,?,-12015FEC), ref: 004950E8

Memory Dump Source

Source File: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID: CurrentFileThreadView
String ID:
API String ID: 1949693742-0
Opcode ID: c1a3c13f960aee6fc475ae0fff81bea2d5f82a9647b9f510702cd71fb2e0da81
Instruction ID: 0eda50789296e83c1d15392fe6552f268372023ea907bf324ef308469d6da42a
Opcode Fuzzy Hash: c1a3c13f960aee6fc475ae0fff81bea2d5f82a9647b9f510702cd71fb2e0da81
Instruction Fuzzy Hash: FE11B73250060AEFCF12AFA5DD0ADAF3F66BF98344B104526F91155021C73A8576EBA9

Function 00494E49 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 436999628a452d182cec4f06492e39f7184a2a5bb420d5b76e330e5f065a7d15
Instruction ID: 2db1630b0928b9685762918b247ec0af8d15701c0cb1f0ff2507117b12c6e43c
Opcode Fuzzy Hash: 436999628a452d182cec4f06492e39f7184a2a5bb420d5b76e330e5f065a7d15
Instruction Fuzzy Hash: A811793250020AFACF12AFA9C909E9F3FB5BF84354F00853AB90145161D739C967EB65

Function 0049472D Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0048FDDA: GetCurrentThreadId.KERNEL32 ref: 0048FDE9

ReadFile.KERNELBASE(?,00000000,?,00000400,?,-12015FEC,?,?,0049245C,?,?,00000400,?,00000000,?,00000000), ref: 00494799

Memory Dump Source

Source File: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID: CurrentFileReadThread
String ID:
API String ID: 2348311434-0
Opcode ID: 4cb470ace43c316693a6c17f2fdf7a98448dcbfe0ea603229e25ef5ef3cdce7f
Instruction ID: 4b88aade4d6470e6102f30ee78c675ed8ce843bf74b10e4c09f91bc3d2b28de6
Opcode Fuzzy Hash: 4cb470ace43c316693a6c17f2fdf7a98448dcbfe0ea603229e25ef5ef3cdce7f
Instruction Fuzzy Hash: CCF03C3610010EABCF127F95D909D9E3F76BF95354F004576FA0145071D73AC4A2EBA5

Function 00445FF1 Relevance: 1.5, APIs: 1, Instructions: 27libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 00446020

Memory Dump Source

Source File: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 01255d8a328d931298ffb24de40db813fd0f3061733c9898047bf536a91346a8
Instruction ID: 3ac1e8dc258c4d0050563f67df23adb223e95801a67091af05301b00e203b93e
Opcode Fuzzy Hash: 01255d8a328d931298ffb24de40db813fd0f3061733c9898047bf536a91346a8
Instruction Fuzzy Hash: BCE0397124C604DFE7022E65DC8966EF7E4FF99320F260A2DD7C183600EA791462EB5B

Function 0048FFAB Relevance: 1.3, APIs: 1, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,?), ref: 0049000F

Memory Dump Source

Source File: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: c29cfd61338ff30cb521a874c14e9b1e9df948b5adfca43ee868b3a476af590a
Instruction ID: 85cc55a35368a9b5ff0eb06c7b9f6b02c8977c0ef787020ffc7af927869f72b2
Opcode Fuzzy Hash: c29cfd61338ff30cb521a874c14e9b1e9df948b5adfca43ee868b3a476af590a
Instruction Fuzzy Hash: 5401E832A04109BFCF229FA9EC04E9EBF76FF49345F005176E502A4160EB368661DB64

Function 00498829 Relevance: 1.3, APIs: 1, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00001000,00001000,00000004,?,?,00498825,?,?,0049852B,?,?,0049852B,?,?,0049852B), ref: 00498849

Memory Dump Source

Source File: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8590435d33da19d0ced825b33bff69d794c83479a74519289e1aeb2491fa9212
Instruction ID: 6da86c78928a0de7d1f02d4eb6e93a7816a683446b189cb4d8d93b3eee89c73b
Opcode Fuzzy Hash: 8590435d33da19d0ced825b33bff69d794c83479a74519289e1aeb2491fa9212
Instruction Fuzzy Hash: A9F0D1B1A00205EFDB20CF08CD05B99BFA4FF46751F108029F44AAF691D7B598C0CBA4

Function 00492B2E Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 0048FDDA: GetCurrentThreadId.KERNEL32 ref: 0048FDE9

CloseHandle.KERNELBASE(004924F1,-12015FEC,?,?,004924F1,?), ref: 00492B6C

Memory Dump Source

Source File: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID: CloseCurrentHandleThread
String ID:
API String ID: 3305057742-0
Opcode ID: f6f6a47d4cc08f9cd3a60a5898d1ab4df07b95efe46840086e61aee2096f3a9e
Instruction ID: 41a5aac185b8e181317edb5ba176613a860702c27bfb60ef503d6ff8da1dd00c
Opcode Fuzzy Hash: f6f6a47d4cc08f9cd3a60a5898d1ab4df07b95efe46840086e61aee2096f3a9e
Instruction Fuzzy Hash: A4E04FA264410AB6CE107F6ADA0ED5E2FB8AFD03987004637B50285422DB7CD197D7A9

Function 00491BF3 Relevance: 1.3, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,0048FC79,?,?), ref: 00491BF9

Memory Dump Source

Source File: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 6386ce080980d38c013ed4ef3eefa13f056dd39503278f8558ee5511511e5e3b
Instruction ID: 772432d0e3e19c13de766e52908acf66e2aaeb75976280b110eee0c4b2354289
Opcode Fuzzy Hash: 6386ce080980d38c013ed4ef3eefa13f056dd39503278f8558ee5511511e5e3b
Instruction Fuzzy Hash: 53B0923110450DBBCF01BF52EC0684DBF7ABF117A8B00C1B1BA0A44132DB7AE9609BD4

Non-executed Functions

Function 00425C1D Relevance: 15.4, Strings: 11, Instructions: 1654COMMON

Download Yara Rule

Strings

9kDs, xrefs: 004264E3
sIoy, xrefs: 00426F9B
`m", xrefs: 00425CEE
spw_, xrefs: 004267BA
*v<, xrefs: 004268D6
`5zV, xrefs: 00425CDF
GYM_, xrefs: 004261D9
91U, xrefs: 00426771
yQR, xrefs: 00425F9C
fr, xrefs: 004266BD
{To, xrefs: 00426EC8

Memory Dump Source

Source File: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID:
String ID: *v<$91U$9kDs$GYM_$`5zV$`m"$fr$sIoy$spw_$yQR${To
API String ID: 0-2217333776
Opcode ID: e860ac34c77fb4e7fdf0f3fc3241a25f15f1ba8186fe0306d7d8495e4ac77a9c
Instruction ID: d96534ec62657a0b06ff24d64296e2b490ab99dce288ed40fb9269d6cd1f3f81
Opcode Fuzzy Hash: e860ac34c77fb4e7fdf0f3fc3241a25f15f1ba8186fe0306d7d8495e4ac77a9c
Instruction Fuzzy Hash: 3AB2F6F360C2009FD3086E2DEC9567AFBE9EBD4720F1A453EE6C5C3744EA3598418696

Function 0042FE01 Relevance: 14.1, Strings: 10, Instructions: 1632COMMON

Download Yara Rule

Strings

[D{l, xrefs: 0043066E
gJj4, xrefs: 00430169
Csk=, xrefs: 00430442
X3?, xrefs: 00430C73
Nx~~, xrefs: 00430BC3
z_o_, xrefs: 0043118A
Pj<, xrefs: 0042FF6F
~Kw~, xrefs: 004309FC
z1A), xrefs: 00430034
i,k, xrefs: 0043088D

Memory Dump Source

Source File: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID:
String ID: Csk=$Nx~~$Pj<$X3?$[D{l$gJj4$i,k$z1A)$z_o_$~Kw~
API String ID: 0-3808860871
Opcode ID: 6d978a2f16f9fb2692efcd04142961a62e0f4caed3f706bd6199b5abfaa052c9
Instruction ID: b7459859b2cab4f97fc066a8f3c58d64dfaa4ca62e016fcb2879c26ceb4c05bf
Opcode Fuzzy Hash: 6d978a2f16f9fb2692efcd04142961a62e0f4caed3f706bd6199b5abfaa052c9
Instruction Fuzzy Hash: 9EB22AF3A082049FD304AE2DEC8567AB7EAEFD4720F1A853DEAC4C3744E63559158693

Function 0042E51B Relevance: 10.2, Strings: 7, Instructions: 1427COMMON

Download Yara Rule

Strings

DVw, xrefs: 0042EE8E
kWU}, xrefs: 0042F058
D8~{, xrefs: 0042F289
1RW, xrefs: 0042E71D
:me(, xrefs: 0042E53B
WBc&, xrefs: 0042F201
q_, xrefs: 0042EE2E

Memory Dump Source

Source File: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID:
String ID: 1RW$:me($D8~{$DVw$WBc&$kWU}$q_
API String ID: 0-1722245468
Opcode ID: 15072bb746c9c1c1216d8363d505a6ca82c6d85fb636f7d57d298ec199b20bd6
Instruction ID: 815a8d5869a0494655e033eee5c15403ac1a9054a2bec02d775bd5abb3627b8c
Opcode Fuzzy Hash: 15072bb746c9c1c1216d8363d505a6ca82c6d85fb636f7d57d298ec199b20bd6
Instruction Fuzzy Hash: 40A2F9F360C6049FE304AE2DEC8567ABBE9EF94720F1A493DE6C4C3744E63598058697

Function 00427726 Relevance: 9.1, Strings: 6, Instructions: 1630COMMON

Download Yara Rule

Strings

<9, xrefs: 00427A39
dW[_, xrefs: 00427CF0
'D_, xrefs: 00427C8F
u"W8, xrefs: 00428856
e_, xrefs: 0042852B
[S]}, xrefs: 00427CCB

Memory Dump Source

Source File: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID:
String ID: 'D_$<9$[S]}$dW[_$e_$u"W8
API String ID: 0-562665035
Opcode ID: 81f4b0265c721cdda6e9fde81a654ef34a701cb542e336640470c5aca672fd37
Instruction ID: e4381252f4652ef671491b56460a4032a2c9c60ba68c97ce504fbcb87e4d0b9e
Opcode Fuzzy Hash: 81f4b0265c721cdda6e9fde81a654ef34a701cb542e336640470c5aca672fd37
Instruction Fuzzy Hash: BBB2D3F360C204AFE3046E2DEC8567AFBE9EB94720F1A493DE6C4C7740E67598058696

Function 0042999C Relevance: 7.2, Strings: 5, Instructions: 986COMMON

Download Yara Rule

Strings

2k~, xrefs: 00429E2E
p;Wh, xrefs: 00429A8E
YQj, xrefs: 00429E06
Lk{, xrefs: 00429E8E
a+^?, xrefs: 0042A3F1

Memory Dump Source

Source File: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID:
String ID: 2k~$YQj$a+^?$p;Wh$Lk{
API String ID: 0-3571747624
Opcode ID: 078ef344c49a3b2e5d228f8ab6e90db56a7fbc6146ccce9712e9651aa1291ace
Instruction ID: 9d65f831c105904f30f658693129812d4e40b05dec7353f5d27347725d0ca609
Opcode Fuzzy Hash: 078ef344c49a3b2e5d228f8ab6e90db56a7fbc6146ccce9712e9651aa1291ace
Instruction Fuzzy Hash: 175228F36082149FE3046E2DEC8567AFBE9EF94320F16853DEAC4D3744E93598018697

Function 004334E4 Relevance: 6.6, Strings: 4, Instructions: 1644COMMON

Download Yara Rule

Strings

Oa/, xrefs: 00433D3E
Qb, xrefs: 00433A88
<"], xrefs: 0043482A
W 0, xrefs: 00433F0B

Memory Dump Source

Source File: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID:
String ID: <"]$Oa/$Qb$W 0
API String ID: 0-267832420
Opcode ID: 2a0a67470ce32276fab9241dbcb0f01207439e3e23ba5ece6459b6a7e0367f8e
Instruction ID: cbc83f649192895afdec7f0bce7f196640bf24b17a588f36d4487ceac394b3a9
Opcode Fuzzy Hash: 2a0a67470ce32276fab9241dbcb0f01207439e3e23ba5ece6459b6a7e0367f8e
Instruction Fuzzy Hash: D5B2E5F360C204AFE3046E2DEC8567AFBE9EF94720F1A453DE6C4C7744EA3598058696

Function 004226CD Relevance: 6.5, Strings: 4, Instructions: 1520COMMON

Download Yara Rule

Strings

r_n, xrefs: 00423547
""~^, xrefs: 0042284F
MB?", xrefs: 00422AFC
t*<, xrefs: 00422C7A

Memory Dump Source

Source File: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID:
String ID: ""~^$MB?"$r_n$t*<
API String ID: 0-2841853812
Opcode ID: 223e1fd01eee1bc515a539901b9773b01f877182cf5f6a15ab9c5c481e7719cf
Instruction ID: 5490f2e9e23082de3f200f5871aef7ed1355e049a7ee835bf02e538679c80fee
Opcode Fuzzy Hash: 223e1fd01eee1bc515a539901b9773b01f877182cf5f6a15ab9c5c481e7719cf
Instruction Fuzzy Hash: 31A206F360C2049FE704AE29EC8567ABBE9EF94320F1A493DE6C4C7740EA3558058797

Function 002EFC9F Relevance: 3.9, Strings: 3, Instructions: 117COMMON

Download Yara Rule

Strings

W(cw, xrefs: 002EFCD1
DRF, xrefs: 002EFD2C
a,]v, xrefs: 002EFD12

Memory Dump Source

Source File: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID:
String ID: DRF$W(cw$a,]v
API String ID: 0-3639012341
Opcode ID: 68bb65b79cbd4182257a5a07f04caa427f9de64a0ddbfee8c29f284f70ca1cb4
Instruction ID: fed71653a167515cad5fcf0a7900a4716482ce1a41c1811e0bcb597e6b3931c1
Opcode Fuzzy Hash: 68bb65b79cbd4182257a5a07f04caa427f9de64a0ddbfee8c29f284f70ca1cb4
Instruction Fuzzy Hash: 5F31F4F3F082281BF3196D69DD89776B286DBD0310F1B423EDE4893785F8765D098195

Function 0042B257 Relevance: 3.7, Strings: 2, Instructions: 1217COMMON

Download Yara Rule

Strings

.z, xrefs: 0042B9CC
5Emz, xrefs: 0042B670

Memory Dump Source

Source File: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID:
String ID: .z$5Emz
API String ID: 0-800251600
Opcode ID: 9683ff0cfc0aec86ad4abff3f10bf20637867e0c373beff610819ca7e3af5808
Instruction ID: e947b74c5f9a1f6fd07f5cfffd3a369bb7eceab36d5e20c2cf66264b69b7d6bc
Opcode Fuzzy Hash: 9683ff0cfc0aec86ad4abff3f10bf20637867e0c373beff610819ca7e3af5808
Instruction Fuzzy Hash: 5782D6F360C2149FE304AE29EC4567AFBE9EFD4720F16892DE6C4C3744EA3598058697

Function 00493F27 Relevance: 3.0, APIs: 2, Instructions: 43timeCOMMON

Download Yara Rule

APIs

Part of subcall function 0048FDDA: GetCurrentThreadId.KERNEL32 ref: 0048FDE9

GetSystemTime.KERNEL32(?,-12015FEC), ref: 00493F5C
GetFileTime.KERNEL32(?,?,?,?,-12015FEC), ref: 00493F9F

Memory Dump Source

Source File: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID: Time$CurrentFileSystemThread
String ID:
API String ID: 2191017843-0
Opcode ID: 855d4340cfe80edb654ebff06b924568a347ea0a13b5c9f9f988b2c05821842f
Instruction ID: c62e3487555be80a2ea19ec4dae620bb344d8faa400a8847ded0b1d412025462
Opcode Fuzzy Hash: 855d4340cfe80edb654ebff06b924568a347ea0a13b5c9f9f988b2c05821842f
Instruction Fuzzy Hash: 6101283220044AEBCF21AF5AD90DD8E7F75FFC6311B014236F40285425CB3989A6EBA6

Function 00494DE5 Relevance: 1.5, APIs: 1, Instructions: 24encryptionCOMMON

Download Yara Rule

APIs

CryptVerifySignatureA.ADVAPI32(?,?,?,?,?,?), ref: 00494E2C

Memory Dump Source

Source File: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID: CryptSignatureVerify
String ID:
API String ID: 1015439381-0
Opcode ID: f0499bcdc3c3cd7a7331774349a8e552255da156db362fea23c87970d7202342
Instruction ID: ff43119084b8c1d185cbfb1348675e25d9735896f21db4c9a59557e283d67330
Opcode Fuzzy Hash: f0499bcdc3c3cd7a7331774349a8e552255da156db362fea23c87970d7202342
Instruction Fuzzy Hash: 16F0F832A0110EEFCF02CF94CA0499D7B72FF59345B10812AF90596210D3759A72EF45

Function 0042D843 Relevance: 1.5, Strings: 1, Instructions: 252COMMON

Download Yara Rule

Strings

u^, xrefs: 0042D9BF

Memory Dump Source

Source File: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID:
String ID: u^
API String ID: 0-3811572924
Opcode ID: bc7b38379d7819d3e072dfa1994e688eec7024cd2e58517ba63a3958881edd3c
Instruction ID: 067a141995ab623fdd4d494aa1df0553bd2c27fbde19d07d469da897e82aa706
Opcode Fuzzy Hash: bc7b38379d7819d3e072dfa1994e688eec7024cd2e58517ba63a3958881edd3c
Instruction Fuzzy Hash: D6715BF390C208AFD3107E69EC8577AFBD9DB54660F168A2DEAC487704E6369804C6D3

Function 0034ECB8 Relevance: 1.4, Strings: 1, Instructions: 159COMMON

Download Yara Rule

Strings

M65, xrefs: 0034ED71

Memory Dump Source

Source File: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID:
String ID: M65
API String ID: 0-1805846946
Opcode ID: fc98bf51a090cd38be9e9569639102d7b7b4f8b6eef344b9b2ae32f38ba70be8
Instruction ID: d7680b4723d50bb843a014efe3363c38d2b093b837a96c38b8f9fe0e557ff05c
Opcode Fuzzy Hash: fc98bf51a090cd38be9e9569639102d7b7b4f8b6eef344b9b2ae32f38ba70be8
Instruction Fuzzy Hash: E0413BF3B0C6005FF7086919DC8177AB7DAEBE8311F1A853DA78583784ED7A5C048695

Function 003444CD Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

d~G, xrefs: 003444D1

Memory Dump Source

Source File: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID:
String ID: d~G
API String ID: 0-1478745295
Opcode ID: 8dd003748314ca8612cc7ed43125c6638e463a8a3833c1859a07fe218c011c61
Instruction ID: f1b8b78ffbdb81a171ea44781523a1b489ae156e37708d26262ef20ff04d7b76
Opcode Fuzzy Hash: 8dd003748314ca8612cc7ed43125c6638e463a8a3833c1859a07fe218c011c61
Instruction Fuzzy Hash: F14117F3A082106BE3086E6CEC957BABBD9EF55320F1B093EDAC5D3780E57559048692

Function 002C9992 Relevance: 1.4, Strings: 1, Instructions: 138COMMON

Download Yara Rule

Strings

{tw{, xrefs: 002C9A11

Memory Dump Source

Source File: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID:
String ID: {tw{
API String ID: 0-1764458376
Opcode ID: d80a45e3703c2c078d36b6d6f3d8412501ca729098548d4feb3afafca2ce2478
Instruction ID: dd606c3c601daeb4e4fa4470757af8efb09a4b16ab52f39995cbd5e16062c1c7
Opcode Fuzzy Hash: d80a45e3703c2c078d36b6d6f3d8412501ca729098548d4feb3afafca2ce2478
Instruction Fuzzy Hash: B3416AF39082148FE3006E1DEC997B7FBC9EB90320F2A443DDB85C7380E93568148686

Function 0045155D Relevance: 1.4, Strings: 1, Instructions: 135COMMON

Download Yara Rule

Strings

D"~o, xrefs: 004516D8

Memory Dump Source

Source File: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID:
String ID: D"~o
API String ID: 0-1649060425
Opcode ID: a6ee6972eef56ef72ac38bb02f87556063c7f4625d96475d936be3133a984eb4
Instruction ID: 454ce473c138cf4e472c9a4788d54deb38011eb0d8f46b699a36e2ff5fb63038
Opcode Fuzzy Hash: a6ee6972eef56ef72ac38bb02f87556063c7f4625d96475d936be3133a984eb4
Instruction Fuzzy Hash: AC4160B251D700AFD305AF19E88167EFBE9EF94320F26492EE2C486610E7354484CB57

Function 004524DD Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

}\u, xrefs: 004525E9

Memory Dump Source

Source File: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID:
String ID: }\u
API String ID: 0-3397853299
Opcode ID: 9f6d8e87cccebc8e7f2aa5717ed89a1821eba27a94e21c7a07cd8d4193b86c96
Instruction ID: f519fa0c83d930ed141bd68b80af35f007be1cba1640282b6d8aed5462eb3dca
Opcode Fuzzy Hash: 9f6d8e87cccebc8e7f2aa5717ed89a1821eba27a94e21c7a07cd8d4193b86c96
Instruction Fuzzy Hash: 293128F3A0C010EFD3089A19CD61B7EB6E5EB98311F26453FE9C6D7680E66848069387

Function 00403D85 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a97cfd0dd4d4a454979b4967234e25944e217e4c150fa86f2cf031184e811cf
Instruction ID: 7bf7c957f9a1637403845da474c2b48d4363729b0eb2edf13dde85dbb7b4862f
Opcode Fuzzy Hash: 6a97cfd0dd4d4a454979b4967234e25944e217e4c150fa86f2cf031184e811cf
Instruction Fuzzy Hash: 09714BB3F5162647F3540879CD983A26583DBE5320F3F82398B586BBC5DC7E5D0A5284

Function 00341EEB Relevance: .2, Instructions: 204COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da21f2f1c1f24b19603c33f6a840dc36b697616e6b54fe2d910ad69b3f291e3d
Instruction ID: 0664c095dc30d0e49446c9e0baf3e9342da48eaf7b68c4eaafdec3691128d972
Opcode Fuzzy Hash: da21f2f1c1f24b19603c33f6a840dc36b697616e6b54fe2d910ad69b3f291e3d
Instruction Fuzzy Hash: E15124F3D086149BE308AF29DC4577BBBE6EBD4320F0B853DDAC943784E93959058686

Function 003CA27D Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5181d92b0218804df25f5c461dfff56fa1d79945c11c24a05c05d21ba97b473
Instruction ID: fb4d77b272f041b04e90bb40f71906807872ed813a174ae2ee923708c09f0295
Opcode Fuzzy Hash: e5181d92b0218804df25f5c461dfff56fa1d79945c11c24a05c05d21ba97b473
Instruction Fuzzy Hash: F6518CF3A186005BF7086D2CEC5677AB3D5EB90320F29423EEB95D37C4E97898054196

Function 003A4070 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d94041a198a8ea78618cb74d2f43e648010a7d1ab52b29bd01014fd83b774739
Instruction ID: b7f0a8ac508a996a823289d6ced6d2351c1b536838f02171633c6bbca0e595b2
Opcode Fuzzy Hash: d94041a198a8ea78618cb74d2f43e648010a7d1ab52b29bd01014fd83b774739
Instruction Fuzzy Hash: B651F5F3A082005FE3046E3DDC9937A7AD6EB94320F2B463CEAD4C7784D97959468296

Function 002DF035 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fe34b755576bb9b47ff42909c058836bb40fbdd2d61b152bb2a5caf19936aec
Instruction ID: 9ec8d63e33fe3ab1753d30d8de6a48e6627189f797f8a7b85479cf836ed1c84c
Opcode Fuzzy Hash: 6fe34b755576bb9b47ff42909c058836bb40fbdd2d61b152bb2a5caf19936aec
Instruction Fuzzy Hash: DA416DF3A092046BE3092E19EC167BAB7DADFD4331F19863EE682C2784FD7958014256

Function 0038A833 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a8fbe1f3cc3365d0769f2a8fce1d58098ca0e9f0be012ea57963b4efc8c06c6
Instruction ID: 4b42d956252b075fba49f6237cbca60ac1b002f20fce280c18795602da03fc13
Opcode Fuzzy Hash: 4a8fbe1f3cc3365d0769f2a8fce1d58098ca0e9f0be012ea57963b4efc8c06c6
Instruction Fuzzy Hash: 8F41A0B3A056108BF340AE29CC457ABB7D2EBC4710F2B857DCAC857784D97D58468782

Function 0044D6D4 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63e12dc5d81eff9dd7a93182ab942599e9a85025a2a98279e0b84f4377869f52
Instruction ID: a203ccb781f90002a4d6c5a6d2fb9a8af1f6a3dd78c4eb0206a38387558ee0b9
Opcode Fuzzy Hash: 63e12dc5d81eff9dd7a93182ab942599e9a85025a2a98279e0b84f4377869f52
Instruction Fuzzy Hash: 59E04F360141019ED7019F54C84599FFBF4FF19310F248845E444CB762C2354C41CB2A

Function 0049345D Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0048FDDA: GetCurrentThreadId.KERNEL32 ref: 0048FDE9

Part of subcall function 004944DB: IsBadWritePtr.KERNEL32(?,00000004), ref: 004944E9

wsprintfA.USER32 ref: 004934A3
LoadImageA.USER32(?,?,?,?,?,?), ref: 00493567

Strings

%8x, xrefs: 00493531, 00493564
%8x, xrefs: 0049349E, 004934A1

Memory Dump Source

Source File: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID: CurrentImageLoadThreadWritewsprintf
String ID: %8x$%8x
API String ID: 439219941-2046107164
Opcode ID: 0c2259bc812a6ab1510c3d17d63b57599e0ebe339775de28416d8c6099f742fb
Instruction ID: a1e97731f31d84518e7fa5181404a6b06cdff715de5b5d1bfd6819e848f96894
Opcode Fuzzy Hash: 0c2259bc812a6ab1510c3d17d63b57599e0ebe339775de28416d8c6099f742fb
Instruction Fuzzy Hash: A8313671A0010ABBCF119F94DD09EAEBF79FF88310F108526F511A6161C7359A22DB95

Function 0049402E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNEL32(00D3122C,00004020,00000000,-12015FEC), ref: 0049411B

Strings

@, xrefs: 0049405A

Memory Dump Source

Source File: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID: AttributesFile
String ID: @
API String ID: 3188754299-2726393805
Opcode ID: 538d1446281001693304685aaaa29a2b66d8f93bfa9d148276e0df6e719b64dc
Instruction ID: e16c48d5a287ecc3c7a8ffeb8ee3c95f7814377a3851095387572f935ee4aee4
Opcode Fuzzy Hash: 538d1446281001693304685aaaa29a2b66d8f93bfa9d148276e0df6e719b64dc
Instruction Fuzzy Hash: C431A971904205EFCF248F44C848B8EBFB0FF48350F00852AE55667690C3B8AAA6DF84

Function 00494A8E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 0048FDDA: GetCurrentThreadId.KERNEL32 ref: 0048FDE9

GetFileSize.KERNEL32(?,#I,-12015FEC,?,?,004923E0,?,00000000), ref: 00494AF5

Strings

#I, xrefs: 00494AEF
#I, xrefs: 00494ADA

Memory Dump Source

Source File: 00000000.00000002.1865448684.0000000000441000.00000040.00000001.01000000.00000003.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000000.00000002.1865165483.00000000002B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865285395.00000000002B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865417705.00000000002B6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.00000000002BA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000054D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865448684.000000000055C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1865986984.000000000055D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866197692.0000000000700000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1866257724.0000000000702000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2b0000_file.jbxd

Similarity

API ID: CurrentFileSizeThread
String ID: #I$#I
API String ID: 94952809-2960256536
Opcode ID: 0041ce6979504ecc5a97434d57cf6cc264108ad83096002553189f5f173796a5
Instruction ID: ed9c1626bf8b27e212cffb8a19ac2330f929f5441845e8a680814697f6249e2a
Opcode Fuzzy Hash: 0041ce6979504ecc5a97434d57cf6cc264108ad83096002553189f5f173796a5
Instruction Fuzzy Hash: ED019E71100109EBCF21AF5AD908F5E3BB8BB90369F008237A402865A0C73CE896CB59

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: file.exePID: 7268, Parent PID: 2580

General

Chronological Activities

Disassembly

Analysis Process: file.exePID: 7268, Parent PID: 2580COMMON

Execution Graph

Graph

Windows Analysis Report
file.exe

Function 004914AD Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83
libraryCOMMON

Function 004919B3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
COMMON

Function 0049430D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Function 0044420C Relevance: 4.6, APIs: 3, Instructions: 106
registryCOMMON

Function 00491780 Relevance: 4.6, APIs: 3, Instructions: 87
COMMON

Function 0049038D Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90
COMMON

Function 04D90D42 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 62
COMMON

Function 04D90D48 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 59
COMMON

Function 04D91509 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56
serviceCOMMON

Function 04D91510 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54
serviceCOMMON

Function 04D91301 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48
COMMON

Function 04D91308 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47
COMMON

Function 00491A9C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32
COMMON