Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1532858
MD5:	5447bc45a84b461600e8677f1f130cca
SHA1:	1d11ff9172370a8a73b2342e9d129760eadd92a2
SHA256:	1b16d450185a72ab32f6b20370fcdf53d505f77940db387355938f25ce51813d
Tags:	exeuser-Bitsight
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Hides threads from debuggers

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to detect virtual machines (SIDT)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Enables debug privileges

Entry point lies outside standard sections

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 2452 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 5447BC45A84B461600E8677F1F130CCA)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: file.exe

Virustotal: Detection: 54%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D6E547 CryptVerifySignatureA,

0_2_00D6E547

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: file.exe, 00000000.00000003.2065044458.00000000052E0000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2198963075.0000000000B92000.00000040.00000001.01000000.00000003.sdmp

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CFE00F	0_2_00CFE00F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D064F8	0_2_00D064F8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D014FF	0_2_00D014FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CFC59E	0_2_00CFC59E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CF98B2	0_2_00CF98B2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D04A83	0_2_00D04A83
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D0BB7A	0_2_00D0BB7A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CFAB03	0_2_00CFAB03
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C79D4C	0_2_00C79D4C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D26D25	0_2_00D26D25
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D07F73	0_2_00D07F73

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00D6953C appears 35 times

Source: file.exe, 00000000.00000002.2199733456.0000000000B96000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000002.2201321857.000000000155E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: file.exe

Static PE information: Section: kcbkgpof ZLIB complexity 0.9948704154191617

Source: classification engine

Classification label: mal100.evad.winEXE@1/1@0/0

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

Virustotal: Detection: 54%

Source: file.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application
Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior

Source: file.exe

Static file information: File size 1735680 > 1048576

Source: file.exe

Static PE information: Raw size of kcbkgpof is bigger than: 0x100000 < 0x1a1800

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.b90000.0.unpack :EW;.rsrc:W;.idata :W; :EW;kcbkgpof:EW;fpbbzirp:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1b0f0f should be: 0x1b60d2

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: kcbkgpof
Source: file.exe	Static PE information: section name: fpbbzirp
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D1DA91 push edx; mov dword ptr [esp], eax	0_2_00D1DB04
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D250D0 push edi; mov dword ptr [esp], eax	0_2_00D250E8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D250D0 push edi; mov dword ptr [esp], ecx	0_2_00D25119
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D200DA push 23758B9Eh; mov dword ptr [esp], eax	0_2_00D2012F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D200DA push esi; mov dword ptr [esp], eax	0_2_00D2113E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D1E0DB push edi; mov dword ptr [esp], 4F2FBBE1h	0_2_00D1E0F5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D1E0DB push ebx; mov dword ptr [esp], 76FD5D87h	0_2_00D1E103
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C270F2 push 3ADEE700h; mov dword ptr [esp], edx	0_2_00C27188
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C270F2 push edi; mov dword ptr [esp], 1406F0FDh	0_2_00C2719B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BCE0F9 push 41585EC6h; mov dword ptr [esp], ebx	0_2_00BCE114
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BCE0F9 push 5FE4DB60h; mov dword ptr [esp], esi	0_2_00BCE162
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BCE0F9 push esi; mov dword ptr [esp], esp	0_2_00BCE18A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D210B7 push ecx; mov dword ptr [esp], 7D3EC3C7h	0_2_00D210E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D1D049 push eax; mov dword ptr [esp], ebp	0_2_00D20F65
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D20077 push 31083204h; mov dword ptr [esp], ebp	0_2_00D2105F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CFE00F push ecx; mov dword ptr [esp], eax	0_2_00CFE014
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CFE00F push esi; mov dword ptr [esp], esp	0_2_00CFE033
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CFE00F push edi; mov dword ptr [esp], ecx	0_2_00CFE08D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CFE00F push eax; mov dword ptr [esp], 2EE83007h	0_2_00CFE0A2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CFE00F push esi; mov dword ptr [esp], 1FDD5AD2h	0_2_00CFE0AE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CFE00F push edi; mov dword ptr [esp], esi	0_2_00CFE1A2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CFE00F push edx; mov dword ptr [esp], eax	0_2_00CFE253
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CFE00F push ebp; mov dword ptr [esp], esi	0_2_00CFE260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CFE00F push 391E20DEh; mov dword ptr [esp], ebx	0_2_00CFE2FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CFE00F push 0E5A9E39h; mov dword ptr [esp], edi	0_2_00CFE30D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CFE00F push ecx; mov dword ptr [esp], 6CC6B333h	0_2_00CFE31F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CFE00F push edi; mov dword ptr [esp], edx	0_2_00CFE4B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CFE00F push 5D10BAF4h; mov dword ptr [esp], eax	0_2_00CFE4EA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CFE00F push ebx; mov dword ptr [esp], edx	0_2_00CFE51E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CFE00F push eax; mov dword ptr [esp], esp	0_2_00CFE58F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CFE00F push eax; mov dword ptr [esp], esi	0_2_00CFE5B3

Source: file.exe	Static PE information: section name: entropy: 7.811568321640306
Source: file.exe	Static PE information: section name: kcbkgpof entropy: 7.953227771060923

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0F769 second address: D0F784 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 jmp 00007FDE3CFF2274h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0F784 second address: D0F7A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FDE3D69CA47h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0F8D4 second address: D0F8E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b jne 00007FDE3CFF2268h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0F8E7 second address: D0F8ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0F8ED second address: D0F935 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FDE3CFF226Fh 0x0000000e push ecx 0x0000000f jmp 00007FDE3CFF2275h 0x00000014 jnl 00007FDE3CFF2266h 0x0000001a pop ecx 0x0000001b jmp 00007FDE3CFF226Bh 0x00000020 push eax 0x00000021 push edx 0x00000022 jng 00007FDE3CFF2266h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0FABD second address: D0FAC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0FC63 second address: D0FC77 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007FDE3CFF2266h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0FC77 second address: D0FC7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0FDCF second address: D0FDDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pushad 0x0000000d popad 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0FF33 second address: D0FF37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D12DEB second address: D12E45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE3CFF226Eh 0x00000009 popad 0x0000000a push eax 0x0000000b push ebx 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pop ebx 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 js 00007FDE3CFF227Ch 0x0000001d mov eax, dword ptr [eax] 0x0000001f push edi 0x00000020 je 00007FDE3CFF226Ch 0x00000026 jno 00007FDE3CFF2266h 0x0000002c pop edi 0x0000002d mov dword ptr [esp+04h], eax 0x00000031 push eax 0x00000032 push edx 0x00000033 jng 00007FDE3CFF2268h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D12E45 second address: D12E4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D12E4B second address: D12E4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D12E4F second address: D12EA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 push 00000000h 0x0000000b push edi 0x0000000c call 00007FDE3D69CA38h 0x00000011 pop edi 0x00000012 mov dword ptr [esp+04h], edi 0x00000016 add dword ptr [esp+04h], 0000001Bh 0x0000001e inc edi 0x0000001f push edi 0x00000020 ret 0x00000021 pop edi 0x00000022 ret 0x00000023 and esi, 2FA50C84h 0x00000029 mov ecx, dword ptr [ebp+122D393Fh] 0x0000002f push 00000003h 0x00000031 mov cx, ax 0x00000034 push 00000000h 0x00000036 mov si, 0EDBh 0x0000003a push 00000003h 0x0000003c movzx ecx, si 0x0000003f push C2C66363h 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 push esi 0x00000049 pop esi 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D12EA2 second address: D12EAC instructions: 0x00000000 rdtsc 0x00000002 je 00007FDE3CFF2266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D12EAC second address: D12EB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D12F38 second address: D12F3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1317C second address: D13191 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FDE3D69CA36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c jl 00007FDE3D69CA3Eh 0x00000012 push ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D13191 second address: D131AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 pushad 0x0000000a jmp 00007FDE3CFF226Fh 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D131AE second address: D131B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D131B2 second address: D131C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007FDE3CFF2268h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D131C5 second address: D131EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE3D69CA43h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jnc 00007FDE3D69CA36h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D131EA second address: D131F4 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FDE3CFF2266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D248CF second address: D248D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D248D5 second address: D248DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D248DA second address: D248E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D317EB second address: D317F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D317F1 second address: D317F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D31C0B second address: D31C11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D31C11 second address: D31C15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D31C15 second address: D31C1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D31C1B second address: D31C25 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FDE3D69CA3Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D31D8F second address: D31D99 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FDE3CFF226Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D31D99 second address: D31DB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FDE3D69CA41h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D31DB6 second address: D31DBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D31DBE second address: D31DC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D31F14 second address: D31F19 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3208C second address: D32098 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FDE3D69CA36h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D32098 second address: D320AD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FDE3CFF226Bh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D320AD second address: D320B3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3239E second address: D323D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE3CFF2272h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDE3CFF2274h 0x00000011 jo 00007FDE3CFF2266h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D33236 second address: D33240 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FDE3D69CA36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D33240 second address: D3324A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FDE3CFF2266h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3324A second address: D3324E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D33519 second address: D33521 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D388FE second address: D38902 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D38902 second address: D38927 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FDE3CFF2266h 0x00000008 jmp 00007FDE3CFF2271h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jnp 00007FDE3CFF226Eh 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3AD4B second address: D3AD51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3AD51 second address: D3AD56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D39EC6 second address: D39ECC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D39ECC second address: D39ED0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3AFBA second address: D3AFBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3AFBE second address: D3AFE1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007FDE3CFF2276h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3AFE1 second address: D3B026 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE3D69CA3Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c pushad 0x0000000d jmp 00007FDE3D69CA43h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 jmp 00007FDE3D69CA41h 0x0000001a popad 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f push esi 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3F128 second address: D3F144 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE3CFF226Ah 0x00000009 pop ebx 0x0000000a jmp 00007FDE3CFF226Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3F144 second address: D3F149 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3F540 second address: D3F552 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007FDE3CFF2266h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3F552 second address: D3F560 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE3D69CA3Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3F944 second address: D3F94E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3F94E second address: D3F961 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE3D69CA3Ch 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3F961 second address: D3F968 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D432E1 second address: D432EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007FDE3D69CA36h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D435D1 second address: D435D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D435D7 second address: D435DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D43C17 second address: D43C20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D43C20 second address: D43C32 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jo 00007FDE3D69CA38h 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D43C32 second address: D43C60 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FDE3CFF226Fh 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c push ecx 0x0000000d sub esi, dword ptr [ebp+122D2779h] 0x00000013 pop esi 0x00000014 add edi, dword ptr [ebp+122D263Ah] 0x0000001a push eax 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e jc 00007FDE3CFF2266h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D43D0B second address: D43D18 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D43DE0 second address: D43DF4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE3CFF226Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4507C second address: D45080 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D45080 second address: D4508A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47867 second address: D4786B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4590A second address: D45926 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007FDE3CFF2271h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4786B second address: D47875 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D45926 second address: D4592B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47875 second address: D47900 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FDE3D69CA36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c jmp 00007FDE3D69CA48h 0x00000011 nop 0x00000012 mov esi, ebx 0x00000014 push 00000000h 0x00000016 sub dword ptr [ebp+122D2685h], edi 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push esi 0x00000021 call 00007FDE3D69CA38h 0x00000026 pop esi 0x00000027 mov dword ptr [esp+04h], esi 0x0000002b add dword ptr [esp+04h], 00000019h 0x00000033 inc esi 0x00000034 push esi 0x00000035 ret 0x00000036 pop esi 0x00000037 ret 0x00000038 pushad 0x00000039 jmp 00007FDE3D69CA47h 0x0000003e mov ecx, 4B4B23C1h 0x00000043 popad 0x00000044 xchg eax, ebx 0x00000045 jmp 00007FDE3D69CA3Bh 0x0000004a push eax 0x0000004b push eax 0x0000004c push edx 0x0000004d jnl 00007FDE3D69CA3Ch 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D48DEA second address: D48DEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D49965 second address: D4996F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FDE3D69CA36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4996F second address: D499FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE3CFF2272h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007FDE3CFF2268h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 00000019h 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 mov esi, dword ptr [ebp+122D37BBh] 0x0000002a mov dword ptr [ebp+1245B429h], edx 0x00000030 push 00000000h 0x00000032 mov esi, 56D53400h 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push ebp 0x0000003c call 00007FDE3CFF2268h 0x00000041 pop ebp 0x00000042 mov dword ptr [esp+04h], ebp 0x00000046 add dword ptr [esp+04h], 00000016h 0x0000004e inc ebp 0x0000004f push ebp 0x00000050 ret 0x00000051 pop ebp 0x00000052 ret 0x00000053 add dword ptr [ebp+1245B18Fh], eax 0x00000059 jmp 00007FDE3CFF2276h 0x0000005e xchg eax, ebx 0x0000005f push ebx 0x00000060 pushad 0x00000061 push eax 0x00000062 push edx 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D499FB second address: D49A15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FDE3D69CA36h 0x0000000a popad 0x0000000b pop ebx 0x0000000c push eax 0x0000000d pushad 0x0000000e jne 00007FDE3D69CA38h 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D49A15 second address: D49A19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4A50A second address: D4A50E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4A50E second address: D4A52A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE3CFF2278h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4A52A second address: D4A534 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FDE3D69CA3Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4A534 second address: D4A545 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jp 00007FDE3CFF2266h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4A545 second address: D4A54F instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDE3D69CA36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D02A83 second address: D02A89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D02A89 second address: D02AE2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FDE3D69CA46h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e jnl 00007FDE3D69CA3Ah 0x00000014 pushad 0x00000015 jmp 00007FDE3D69CA44h 0x0000001a jbe 00007FDE3D69CA36h 0x00000020 jbe 00007FDE3D69CA36h 0x00000026 jmp 00007FDE3D69CA3Ah 0x0000002b popad 0x0000002c push eax 0x0000002d push edx 0x0000002e push ebx 0x0000002f pop ebx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4ECC0 second address: D4ECEA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FDE3CFF2274h 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f jp 00007FDE3CFF2266h 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 popad 0x00000018 push ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D500ED second address: D5015C instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FDE3D69CA36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007FDE3D69CA38h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 0000001Bh 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 xor dword ptr [ebp+122D2132h], eax 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push ebp 0x00000032 call 00007FDE3D69CA38h 0x00000037 pop ebp 0x00000038 mov dword ptr [esp+04h], ebp 0x0000003c add dword ptr [esp+04h], 0000001Bh 0x00000044 inc ebp 0x00000045 push ebp 0x00000046 ret 0x00000047 pop ebp 0x00000048 ret 0x00000049 mov edi, 0EB25BD3h 0x0000004e push 00000000h 0x00000050 mov bh, E7h 0x00000052 xchg eax, esi 0x00000053 push eax 0x00000054 push edx 0x00000055 jbe 00007FDE3D69CA38h 0x0000005b push ebx 0x0000005c pop ebx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5015C second address: D50161 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D50383 second address: D50387 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D513D4 second address: D513DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FDE3CFF2266h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D522AC second address: D522B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D513DF second address: D513E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D522B1 second address: D522B6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5321D second address: D53227 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FDE3CFF2266h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D54101 second address: D54107 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D513E4 second address: D513EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D522B6 second address: D522D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a jmp 00007FDE3D69CA42h 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D53227 second address: D5322B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D54107 second address: D5410B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D522D7 second address: D5235C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007FDE3CFF2268h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 0000001Ch 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 push dword ptr fs:[00000000h] 0x00000029 cmc 0x0000002a mov dword ptr fs:[00000000h], esp 0x00000031 mov dword ptr [ebp+12443C30h], edi 0x00000037 mov eax, dword ptr [ebp+122D0DE5h] 0x0000003d mov di, ax 0x00000040 add edi, dword ptr [ebp+122D1867h] 0x00000046 push FFFFFFFFh 0x00000048 mov dword ptr [ebp+122D1A4Dh], edi 0x0000004e jmp 00007FDE3CFF2275h 0x00000053 nop 0x00000054 push eax 0x00000055 push edx 0x00000056 jmp 00007FDE3CFF2275h 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5322B second address: D532BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jno 00007FDE3D69CA3Ah 0x0000000f nop 0x00000010 movsx edi, si 0x00000013 push dword ptr fs:[00000000h] 0x0000001a push 00000000h 0x0000001c push ebx 0x0000001d call 00007FDE3D69CA38h 0x00000022 pop ebx 0x00000023 mov dword ptr [esp+04h], ebx 0x00000027 add dword ptr [esp+04h], 00000014h 0x0000002f inc ebx 0x00000030 push ebx 0x00000031 ret 0x00000032 pop ebx 0x00000033 ret 0x00000034 mov ebx, dword ptr [ebp+122D391Fh] 0x0000003a mov ebx, dword ptr [ebp+122D36ABh] 0x00000040 mov dword ptr fs:[00000000h], esp 0x00000047 jmp 00007FDE3D69CA3Dh 0x0000004c mov eax, dword ptr [ebp+122D1221h] 0x00000052 push 00000000h 0x00000054 push eax 0x00000055 call 00007FDE3D69CA38h 0x0000005a pop eax 0x0000005b mov dword ptr [esp+04h], eax 0x0000005f add dword ptr [esp+04h], 00000018h 0x00000067 inc eax 0x00000068 push eax 0x00000069 ret 0x0000006a pop eax 0x0000006b ret 0x0000006c push FFFFFFFFh 0x0000006e mov dword ptr [ebp+12482B3Ch], eax 0x00000074 nop 0x00000075 push eax 0x00000076 push edx 0x00000077 jnc 00007FDE3D69CA38h 0x0000007d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D55D2E second address: D55D34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5410B second address: D54171 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push edi 0x0000000a mov dword ptr [ebp+122D1BE3h], edi 0x00000010 pop ebx 0x00000011 push dword ptr fs:[00000000h] 0x00000018 sbb di, CAB8h 0x0000001d mov dword ptr fs:[00000000h], esp 0x00000024 push 00000000h 0x00000026 push eax 0x00000027 call 00007FDE3D69CA38h 0x0000002c pop eax 0x0000002d mov dword ptr [esp+04h], eax 0x00000031 add dword ptr [esp+04h], 0000001Ah 0x00000039 inc eax 0x0000003a push eax 0x0000003b ret 0x0000003c pop eax 0x0000003d ret 0x0000003e add dword ptr [ebp+1246C864h], ebx 0x00000044 mov eax, dword ptr [ebp+122D16CDh] 0x0000004a pushad 0x0000004b movzx ebx, dx 0x0000004e stc 0x0000004f popad 0x00000050 push FFFFFFFFh 0x00000052 mov edi, dword ptr [ebp+122D3667h] 0x00000058 nop 0x00000059 pushad 0x0000005a push eax 0x0000005b push edx 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D54171 second address: D54175 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D54175 second address: D5417E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5417E second address: D5419A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FDE3CFF2273h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5419A second address: D541B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDE3D69CA48h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D56D34 second address: D56D38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D56D38 second address: D56D59 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FDE3D69CA48h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D56D59 second address: D56D5E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D57DCF second address: D57DD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D57DD3 second address: D57DD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D58D4E second address: D58D52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5C502 second address: D5C506 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5E46A second address: D5E4AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 mov edi, 58963D56h 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push ecx 0x00000013 call 00007FDE3D69CA38h 0x00000018 pop ecx 0x00000019 mov dword ptr [esp+04h], ecx 0x0000001d add dword ptr [esp+04h], 0000001Ah 0x00000025 inc ecx 0x00000026 push ecx 0x00000027 ret 0x00000028 pop ecx 0x00000029 ret 0x0000002a push 00000000h 0x0000002c mov dword ptr [ebp+122D2FB6h], ecx 0x00000032 push eax 0x00000033 push eax 0x00000034 push edx 0x00000035 push edi 0x00000036 pushad 0x00000037 popad 0x00000038 pop edi 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5E4AB second address: D5E4B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDE3CFF226Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D60547 second address: D6058A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE3D69CA48h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c jnl 00007FDE3D69CA36h 0x00000012 jbe 00007FDE3D69CA36h 0x00000018 pop esi 0x00000019 pop esi 0x0000001a pushad 0x0000001b jmp 00007FDE3D69CA40h 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6058A second address: D60593 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5B5C0 second address: D5B5C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5B5C6 second address: D5B5CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5B5CA second address: D5B5CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5B5CE second address: D5B678 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b jnl 00007FDE3CFF2276h 0x00000011 push dword ptr fs:[00000000h] 0x00000018 xor edi, dword ptr [ebp+122D1F9Fh] 0x0000001e mov dword ptr fs:[00000000h], esp 0x00000025 push 00000000h 0x00000027 push edx 0x00000028 call 00007FDE3CFF2268h 0x0000002d pop edx 0x0000002e mov dword ptr [esp+04h], edx 0x00000032 add dword ptr [esp+04h], 0000001Ch 0x0000003a inc edx 0x0000003b push edx 0x0000003c ret 0x0000003d pop edx 0x0000003e ret 0x0000003f jmp 00007FDE3CFF226Bh 0x00000044 mov eax, dword ptr [ebp+122D1261h] 0x0000004a push 00000000h 0x0000004c push ebx 0x0000004d call 00007FDE3CFF2268h 0x00000052 pop ebx 0x00000053 mov dword ptr [esp+04h], ebx 0x00000057 add dword ptr [esp+04h], 00000019h 0x0000005f inc ebx 0x00000060 push ebx 0x00000061 ret 0x00000062 pop ebx 0x00000063 ret 0x00000064 mov edi, dword ptr [ebp+122D1A1Eh] 0x0000006a push FFFFFFFFh 0x0000006c movzx edi, cx 0x0000006f nop 0x00000070 push eax 0x00000071 push edx 0x00000072 jmp 00007FDE3CFF2271h 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5E607 second address: D5E60B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D68116 second address: D6811A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6811A second address: D68126 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D68126 second address: D6812C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFA63A second address: CFA63E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D67A32 second address: D67A38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D67B9D second address: D67BA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D67BA3 second address: D67BA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D71651 second address: D716A0 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FDE3D69CA42h 0x00000008 jc 00007FDE3D69CA38h 0x0000000e pushad 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 popad 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e jmp 00007FDE3D69CA44h 0x00000023 jnl 00007FDE3D69CA36h 0x00000029 popad 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d pop eax 0x0000002e je 00007FDE3D69CA36h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D716A0 second address: D716A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D79198 second address: D7919F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7EFF7 second address: D7F01C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE3CFF226Fh 0x00000007 jmp 00007FDE3CFF226Ah 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jo 00007FDE3CFF2268h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0B154 second address: D0B161 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jc 00007FDE3D69CA42h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0B161 second address: D0B167 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7DDDE second address: D7DDE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7DDE4 second address: D7DDEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7DDEC second address: D7DDF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7DDF9 second address: D7DDFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7EBAD second address: D7EBB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7EBB1 second address: D7EBE1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE3CFF2274h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FDE3CFF2274h 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D838CA second address: D838D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D838D0 second address: D838D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89D8B second address: D89D8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89D8F second address: D89D9F instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FDE3CFF2266h 0x00000008 js 00007FDE3CFF2266h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89D9F second address: D89DA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89DA5 second address: D89DBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE3CFF2272h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89DBB second address: D89DC5 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FDE3D69CA36h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89DC5 second address: D89DD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jp 00007FDE3CFF2266h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89DD5 second address: D89DFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDE3D69CA49h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89023 second address: D8902D instructions: 0x00000000 rdtsc 0x00000002 je 00007FDE3CFF2266h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8902D second address: D89036 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89036 second address: D8903C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89462 second address: D89466 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89466 second address: D8946A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8946A second address: D89472 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89472 second address: D8949D instructions: 0x00000000 rdtsc 0x00000002 ja 00007FDE3CFF226Ch 0x00000008 jmp 00007FDE3CFF2276h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8949D second address: D894AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FDE3D69CA36h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D894AC second address: D894B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D894B0 second address: D894B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D894B6 second address: D894CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007FDE3CFF2266h 0x00000009 je 00007FDE3CFF2266h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D894CA second address: D894CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D894CE second address: D894D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D894D2 second address: D894D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8964F second address: D89655 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89655 second address: D89665 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a jnc 00007FDE3D69CA36h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89665 second address: D89669 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89770 second address: D89776 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89776 second address: D8977A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8977A second address: D8977E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8977E second address: D89788 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2787F second address: D27887 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D27887 second address: D2788C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89C11 second address: D89C33 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE3D69CA3Eh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push eax 0x0000000d pop eax 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 jp 00007FDE3D69CA36h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D884A1 second address: D884B3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FDE3CFF226Ah 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D41902 second address: D41907 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D41907 second address: D41CC1 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FDE3CFF226Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007FDE3CFF2275h 0x00000010 xchg eax, ebx 0x00000011 mov cl, 28h 0x00000013 push dword ptr fs:[00000000h] 0x0000001a mov dword ptr [ebp+124472D4h], ecx 0x00000020 mov dword ptr fs:[00000000h], esp 0x00000027 sub dword ptr [ebp+122D2177h], ecx 0x0000002d mov dword ptr [ebp+124775F7h], esp 0x00000033 xor dword ptr [ebp+122D2536h], edx 0x00000039 cmp dword ptr [ebp+122D37A3h], 00000000h 0x00000040 jne 00007FDE3CFF23ABh 0x00000046 cmp dword ptr [ebp+122D3907h], 00000000h 0x0000004d jne 00007FDE3CFF2333h 0x00000053 cmp dword ptr [ebp+122D36DFh], 00000000h 0x0000005a jne 00007FDE3CFF2358h 0x00000060 mov byte ptr [ebp+122D24F3h], 0000006Ch 0x00000067 mov dword ptr [ebp+122D2912h], edx 0x0000006d mov eax, DB057083h 0x00000072 push 00000000h 0x00000074 push ebp 0x00000075 call 00007FDE3CFF2268h 0x0000007a pop ebp 0x0000007b mov dword ptr [esp+04h], ebp 0x0000007f add dword ptr [esp+04h], 00000015h 0x00000087 inc ebp 0x00000088 push ebp 0x00000089 ret 0x0000008a pop ebp 0x0000008b ret 0x0000008c jns 00007FDE3CFF226Ch 0x00000092 push eax 0x00000093 push ecx 0x00000094 push esi 0x00000095 push eax 0x00000096 push edx 0x00000097 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D41E86 second address: D41E92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ebx 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D41E92 second address: D41E96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D41E96 second address: D41E9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D41E9A second address: D41ECB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007FDE3CFF226Ch 0x0000000c jg 00007FDE3CFF2266h 0x00000012 popad 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FDE3CFF2277h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D41ECB second address: D41EFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a jmp 00007FDE3D69CA44h 0x0000000f jng 00007FDE3D69CA38h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c pushad 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D41EFA second address: D41F00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D41F00 second address: D41F49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FDE3D69CA46h 0x0000000a popad 0x0000000b pop eax 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007FDE3D69CA38h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 00000016h 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 push E7E02F29h 0x0000002b push edi 0x0000002c push eax 0x0000002d push edx 0x0000002e jo 00007FDE3D69CA36h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D42047 second address: D42050 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D42203 second address: D42207 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D42207 second address: D4220D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4220D second address: D4221C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4221C second address: D42221 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D422DC second address: D422EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jnp 00007FDE3D69CA36h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D428A6 second address: D428AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D428AB second address: D428B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D428B0 second address: D428BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D42A7D second address: D42A87 instructions: 0x00000000 rdtsc 0x00000002 js 00007FDE3D69CA3Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D42A87 second address: D42AC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jl 00007FDE3CFF2270h 0x0000000d pushad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 jg 00007FDE3CFF2266h 0x00000016 popad 0x00000017 mov eax, dword ptr [esp+04h] 0x0000001b jne 00007FDE3CFF2275h 0x00000021 mov eax, dword ptr [eax] 0x00000023 push eax 0x00000024 push edx 0x00000025 jc 00007FDE3CFF2268h 0x0000002b pushad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D42C54 second address: D42C60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D42C60 second address: D42C75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE3CFF2270h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D42C75 second address: D2787F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007FDE3D69CA38h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 00000017h 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 mov dword ptr [ebp+122D1C3Ah], ecx 0x00000029 call dword ptr [ebp+122D1AB5h] 0x0000002f push eax 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 push esi 0x00000034 pop esi 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8E6EA second address: D8E6F0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8E6F0 second address: D8E6F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8E6F5 second address: D8E712 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE3CFF2277h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8E712 second address: D8E721 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FDE3D69CA36h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8E721 second address: D8E749 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FDE3CFF2266h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FDE3CFF2278h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8E749 second address: D8E768 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDE3D69CA49h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8EA20 second address: D8EA31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FDE3CFF226Ch 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8EA31 second address: D8EA6A instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDE3D69CA43h 0x00000008 jmp 00007FDE3D69CA3Dh 0x0000000d jo 00007FDE3D69CA3Ch 0x00000013 js 00007FDE3D69CA36h 0x00000019 pop edx 0x0000001a pop eax 0x0000001b pushad 0x0000001c jno 00007FDE3D69CA3Ch 0x00000022 pushad 0x00000023 jng 00007FDE3D69CA36h 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8EBE5 second address: D8EBF8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007FDE3CFF226Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8EBF8 second address: D8EC25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007FDE3D69CA45h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FDE3D69CA3Dh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8EC25 second address: D8EC4B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FDE3CFF2266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FDE3CFF2278h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8EC4B second address: D8EC4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8EC4F second address: D8EC59 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FDE3CFF2266h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8ED97 second address: D8ED9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8ED9D second address: D8EDC0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE3CFF2271h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jo 00007FDE3CFF2266h 0x00000010 jng 00007FDE3CFF2266h 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D939AD second address: D939D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 js 00007FDE3D69CA36h 0x0000000f jns 00007FDE3D69CA36h 0x00000015 popad 0x00000016 pushad 0x00000017 jne 00007FDE3D69CA36h 0x0000001d jnp 00007FDE3D69CA36h 0x00000023 pushad 0x00000024 popad 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D93C65 second address: D93C69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D93C69 second address: D93C6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D93EF3 second address: D93EF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D93EF8 second address: D93EFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D93EFD second address: D93F0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FDE3CFF2266h 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D93F0D second address: D93F24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jnp 00007FDE3D69CA3Ah 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push edx 0x00000011 pop edx 0x00000012 pushad 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9364C second address: D93663 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE3CFF2273h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D94402 second address: D94408 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF8B14 second address: CF8B2E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE3CFF226Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9A0CF second address: D9A0D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9A0D4 second address: D9A0D9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9A25C second address: D9A27A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE3D69CA40h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jne 00007FDE3D69CA36h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9A27A second address: D9A27E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9A27E second address: D9A288 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9A288 second address: D9A28C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9CB59 second address: D9CB65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 js 00007FDE3D69CA36h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9CB65 second address: D9CB69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA0C40 second address: DA0C44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA0C44 second address: DA0C4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA0C4A second address: DA0C51 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA0C51 second address: DA0C59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA1395 second address: DA1399 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA1399 second address: DA139F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA139F second address: DA13C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FDE3D69CA49h 0x00000008 pushad 0x00000009 popad 0x0000000a jc 00007FDE3D69CA36h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push edi 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA13C8 second address: DA13CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA13CC second address: DA13EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jo 00007FDE3D69CA3Ah 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007FDE3D69CA3Bh 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA13EE second address: DA13F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FDE3CFF2266h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5B5C second address: DA5B6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jne 00007FDE3D69CA36h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5B6D second address: DA5B71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5B71 second address: DA5B81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FDE3D69CA36h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5B81 second address: DA5B85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5B85 second address: DA5BA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 js 00007FDE3D69CA70h 0x0000000d pushad 0x0000000e jmp 00007FDE3D69CA43h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5D32 second address: DA5D41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5D41 second address: DA5D47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5D47 second address: DA5D4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5FDC second address: DA5FF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDE3D69CA3Dh 0x00000009 jg 00007FDE3D69CA36h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5FF3 second address: DA6019 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FDE3CFF2278h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA6019 second address: DA601E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA619A second address: DA61B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FDE3CFF226Eh 0x0000000e ja 00007FDE3CFF2266h 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA61B8 second address: DA61D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE3D69CA43h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA61D7 second address: DA61E1 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FDE3CFF2266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA61E1 second address: DA61E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA61E8 second address: DA6235 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE3CFF2270h 0x00000009 jmp 00007FDE3CFF2272h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FDE3CFF226Ch 0x00000016 jmp 00007FDE3CFF2278h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D42660 second address: D42664 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D42664 second address: D4266E instructions: 0x00000000 rdtsc 0x00000002 jno 00007FDE3CFF2266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4266E second address: D426C4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov di, 00E8h 0x0000000f mov ebx, dword ptr [ebp+124775DEh] 0x00000015 jmp 00007FDE3D69CA3Fh 0x0000001a add eax, ebx 0x0000001c push 00000000h 0x0000001e push edx 0x0000001f call 00007FDE3D69CA38h 0x00000024 pop edx 0x00000025 mov dword ptr [esp+04h], edx 0x00000029 add dword ptr [esp+04h], 00000016h 0x00000031 inc edx 0x00000032 push edx 0x00000033 ret 0x00000034 pop edx 0x00000035 ret 0x00000036 push eax 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007FDE3D69CA3Fh 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D426C4 second address: D426E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov cx, 5361h 0x00000011 push 00000004h 0x00000013 mov dx, 51C4h 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D426E2 second address: D426EC instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FDE3D69CA36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D094F0 second address: D094F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAA528 second address: DAA536 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FDE3D69CA36h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAA536 second address: DAA540 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FDE3CFF2266h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAA540 second address: DAA548 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB2C06 second address: DB2C0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB2C0F second address: DB2C19 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FDE3D69CA3Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB0C82 second address: DB0C86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB0C86 second address: DB0C8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB0C8A second address: DB0C9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007FDE3CFF226Ah 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB0C9A second address: DB0CAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDE3D69CA3Bh 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB0CAB second address: DB0CAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB0CAF second address: DB0CB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB0E0B second address: DB0E10 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB1260 second address: DB1264 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB14F2 second address: DB14F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB14F6 second address: DB1511 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jmp 00007FDE3D69CA3Fh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB1511 second address: DB152A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FDE3CFF2266h 0x0000000a popad 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e pushad 0x0000000f popad 0x00000010 jne 00007FDE3CFF2266h 0x00000016 push edi 0x00000017 pop edi 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB180D second address: DB1820 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FDE3D69CA36h 0x0000000a pop ebx 0x0000000b jl 00007FDE3D69CA3Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB1820 second address: DB1824 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB1B3F second address: DB1B49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB1B49 second address: DB1B54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB1B54 second address: DB1B58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB1B58 second address: DB1B6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a jmp 00007FDE3CFF226Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB1B6E second address: DB1B72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB1E25 second address: DB1E2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB20AF second address: DB20B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FDE3D69CA36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB20B9 second address: DB20CB instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FDE3CFF2266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jbe 00007FDE3CFF226Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB2941 second address: DB294F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jg 00007FDE3D69CA3Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB294F second address: DB295D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 jc 00007FDE3CFF2266h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB6A6A second address: DB6A94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE3D69CA47h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007FDE3D69CA36h 0x00000012 jnc 00007FDE3D69CA36h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB6A94 second address: DB6A98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB5B31 second address: DB5B35 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB613D second address: DB6143 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB6143 second address: DB6175 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE3D69CA3Ah 0x00000009 popad 0x0000000a jmp 00007FDE3D69CA3Ah 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FDE3D69CA47h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB630A second address: DB6310 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB6310 second address: DB6316 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB6316 second address: DB631F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB631F second address: DB6323 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB6456 second address: DB645C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC1005 second address: DC1022 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FDE3D69CA36h 0x0000000a jg 00007FDE3D69CA36h 0x00000010 popad 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 ja 00007FDE3D69CA36h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC1022 second address: DC1026 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC1026 second address: DC102A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC0A2F second address: DC0A37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC0A37 second address: DC0A53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 js 00007FDE3D69CA42h 0x0000000d jnp 00007FDE3D69CA36h 0x00000013 jne 00007FDE3D69CA36h 0x00000019 push esi 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC0A53 second address: DC0A6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 jmp 00007FDE3CFF2272h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC0A6E second address: DC0A8A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FDE3D69CA43h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC4F64 second address: DC4F95 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE3CFF226Ah 0x00000007 pushad 0x00000008 jmp 00007FDE3CFF226Fh 0x0000000d jno 00007FDE3CFF2266h 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push ebx 0x00000019 ja 00007FDE3CFF2266h 0x0000001f push esi 0x00000020 pop esi 0x00000021 pop ebx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC4F95 second address: DC4F9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCB10F second address: DCB11E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jbe 00007FDE3CFF2266h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCB11E second address: DCB124 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCB124 second address: DCB135 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 jng 00007FDE3CFF226Eh 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCB27B second address: DCB286 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCB3B7 second address: DCB3EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE3CFF2279h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a jmp 00007FDE3CFF2274h 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDB714 second address: DDB718 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDB718 second address: DDB71E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDB24C second address: DDB261 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE3D69CA41h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDE113 second address: DDE13C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FDE3CFF2266h 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007FDE3CFF2277h 0x00000011 push edx 0x00000012 pop edx 0x00000013 push esi 0x00000014 pop esi 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDE13C second address: DDE144 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DDE144 second address: DDE14A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE3114 second address: DE3119 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE3264 second address: DE3293 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FDE3CFF226Ah 0x00000008 pushad 0x00000009 popad 0x0000000a push edx 0x0000000b pop edx 0x0000000c jmp 00007FDE3CFF226Bh 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push ebx 0x00000014 pushad 0x00000015 ja 00007FDE3CFF2266h 0x0000001b push edx 0x0000001c pop edx 0x0000001d jg 00007FDE3CFF2266h 0x00000023 popad 0x00000024 pushad 0x00000025 push edx 0x00000026 pop edx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF6739 second address: DF674E instructions: 0x00000000 rdtsc 0x00000002 js 00007FDE3D69CA38h 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d jng 00007FDE3D69CA36h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF674E second address: DF677C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE3CFF2279h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007FDE3CFF226Ch 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF4F83 second address: DF4F8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FDE3D69CA36h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF4F8D second address: DF4FAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FDE3CFF2276h 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF5115 second address: DF514E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007FDE3D69CA42h 0x0000000c pop eax 0x0000000d pushad 0x0000000e jmp 00007FDE3D69CA49h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF514E second address: DF5152 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF5152 second address: DF515F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF56E7 second address: DF5704 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE3CFF2279h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF5846 second address: DF5877 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 je 00007FDE3D69CA36h 0x0000000b push esi 0x0000000c pop esi 0x0000000d jmp 00007FDE3D69CA47h 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 jp 00007FDE3D69CA4Ah 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF5877 second address: DF587D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF59E5 second address: DF59E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF59E9 second address: DF59F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pushad 0x0000000a popad 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF9DA1 second address: DF9DA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFB98C second address: DFB99F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jnp 00007FDE3CFF2266h 0x0000000d ja 00007FDE3CFF2266h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E065CE second address: E065D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E065D2 second address: E065D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E065D6 second address: E065DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E098CF second address: E098D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E098D4 second address: E09907 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FDE3D69CA3Ah 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007FDE3D69CA40h 0x00000012 jmp 00007FDE3D69CA44h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E16495 second address: E1649B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1649B second address: E164A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E164A1 second address: E164C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FDE3CFF2272h 0x00000009 popad 0x0000000a push edi 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pushad 0x0000000e popad 0x0000000f pop edi 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E199D6 second address: E199FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FDE3D69CA49h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E199FA second address: E199FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E199FE second address: E19A32 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE3D69CA44h 0x00000007 jng 00007FDE3D69CA36h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push edi 0x00000014 jmp 00007FDE3D69CA3Dh 0x00000019 pop edi 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B012 second address: E1B02B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 popad 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FDE3CFF226Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B02B second address: E1B05C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007FDE3D69CA49h 0x0000000f push eax 0x00000010 jmp 00007FDE3D69CA3Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1B05C second address: E1B061 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E20DE3 second address: E20DF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 jnc 00007FDE3D69CA36h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E200D0 second address: E200D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E200D4 second address: E200D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E20533 second address: E2053F instructions: 0x00000000 rdtsc 0x00000002 jns 00007FDE3CFF2266h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2053F second address: E20572 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FDE3D69CA3Fh 0x00000010 js 00007FDE3D69CA4Dh 0x00000016 jmp 00007FDE3D69CA41h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E20572 second address: E20590 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 popad 0x0000000a pushad 0x0000000b push esi 0x0000000c pop esi 0x0000000d jmp 00007FDE3CFF226Fh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E225F4 second address: E2260D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE3D69CA3Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a jo 00007FDE3D69CA36h 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C149 second address: E2C153 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FDE3CFF226Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2C153 second address: E2C160 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jc 00007FDE3D69CA36h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2695C second address: E26966 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FDE3CFF2266h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E26966 second address: E26980 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FDE3D69CA46h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E26980 second address: E26984 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E254BB second address: E254C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FDE3D69CA36h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E254C7 second address: E254FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FDE3CFF226Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FDE3CFF226Dh 0x00000010 jmp 00007FDE3CFF2274h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E257B6 second address: E257BB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D45D5C second address: D45D60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B9DA0A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D41950 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: DCEFF1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: BA2021 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 54C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 56E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 54E0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D2A01F rdtsc

0_2_00D2A01F

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D259B8 sidt fword ptr [esp-02h]

0_2_00D259B8

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 6720

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D759E5 GetSystemInfo,VirtualAlloc,

0_2_00D759E5

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2199766235.0000000000D17000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2199766235.0000000000D17000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D2A01F rdtsc

0_2_00D2A01F

Source: C:\Users\user\Desktop\file.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2199766235.0000000000D17000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: nXProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00D6D689 GetSystemTime,GetFileTime,

0_2_00D6D689

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\Desktop\file.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\Desktop\file.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	41 Disable or Modify Tools	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Bypass User Account Control	271 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	271 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	24 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Bypass User Account Control	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	55%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.XPACK.Gen
file.exe	100%	Joe Sandbox ML

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1532858
Start date and time:	2024-10-14 02:17:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@1/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, ctldl.windowsupdate.com
Report size getting too big, too many NtProtectVirtualMemory calls found.

Process:	C:\Users\user\Desktop\file.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.932645555761411
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'735'680 bytes
MD5:	5447bc45a84b461600e8677f1f130cca
SHA1:	1d11ff9172370a8a73b2342e9d129760eadd92a2
SHA256:	1b16d450185a72ab32f6b20370fcdf53d505f77940db387355938f25ce51813d
SHA512:	60bf2f16f8277ac8548e581f83b705aec30553211b81fae0e99480c35d8736b085d21ae7e9c65b1d9058a092f4b09ec2f133e51637931ec12ed3b68ea8cbca3f
SSDEEP:	24576:hI/d7RmgSg8o1gnxaKQNhx7Y1k+QBEpokAaVE/jFdocOGCrtCbbJn7tUgoD31:OpQhIvx81jQ3koDo1G+in7fU1
TLSH:	3085331667C380F7C44BF1BAB37D216FAE4A99433095F7FA861802176D72B952E83709
File Content Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............D.. ...`....@.. ....................... E...........`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x84e000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE
Time Stamp:	0x652C2850 [Sun Oct 15 17:58:40 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FDE3D246A8Ah
cvtps2pd xmm3, qword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [esi-80h], bl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], cl
add eax, dword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8055	0x69	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6000	0x59c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x81f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x2000	0x4000	0x1200	76c5d4ed06ef9f278d16327f9e553151	False	0.9340277777777778	data	7.811568321640306	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x6000	0x59c	0x600	aae15e30898a02f09cc86ed48aa06b09	False	0.4140625	data	4.036947054771808	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x8000	0x2000	0x200	ec9cb51e8cb4ea49a56ee3cf434fb69e	False	0.1484375	data	0.9342685949460681	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0xa000	0x2a0000	0x200	486cce44b53f1b21e57b9bf983c6ee73	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
kcbkgpof	0x2aa000	0x1a2000	0x1a1800	f23e30bb9dab1484c8c1b097f24a0847	False	0.9948704154191617	data	7.953227771060923	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
fpbbzirp	0x44c000	0x2000	0x600	e8b2f4bd6067939fad7f1ea8560a49ba	False	0.5618489583333334	data	4.9404232889629975	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x44e000	0x4000	0x2200	dc0e49803b74c951700f9d626747f977	False	0.04377297794117647	DOS executable (COM)	0.4358641194834045	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x6090	0x30c	data			0.42948717948717946
RT_MANIFEST	0x63ac	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
kernel32.dll	lstrcpy

Target ID:	0
Start time:	20:17:57
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xb90000
File size:	1'735'680 bytes
MD5 hash:	5447BC45A84B461600E8677F1F130CCA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.8%
Dynamic/Decrypted Code Coverage:	3.4%
Signature Coverage:	3.9%
Total number of Nodes:	356
Total number of Limit Nodes:	20

Executed Functions

Function 00D759E5 Relevance: 3.1, APIs: 2, Instructions: 107
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNELBASE(?,-11735FEC), ref: 00D759F1
VirtualAlloc.KERNELBASE(00000000,00004000,00001000,00000004), ref: 00D75A52

Memory Dump Source

Source File: 00000000.00000002.2199766235.0000000000D17000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2198776112.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198963075.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199733456.0000000000B96000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2200825127.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201144676.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201161413.0000000000FDF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID: AllocInfoSystemVirtual
String ID:
API String ID: 3440192736-0
Opcode ID: 0d47c8626abbf43e52116e2c24cd99cd7c0aaf6f8e808e91b9d28a1a4a8a6c51
Instruction ID: 9c401ab31116ef67491fdb8628fc01f6710598829b6513548bebdd9da73a7a32
Opcode Fuzzy Hash: 0d47c8626abbf43e52116e2c24cd99cd7c0aaf6f8e808e91b9d28a1a4a8a6c51
Instruction Fuzzy Hash: 0E4112B2940606AED725CFA0DC49FAAB7ACFF18740F044867B207DD582F7B095D487A5

Function 00D6AC0F Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,?,?), ref: 00D6AD20
LoadLibraryExA.KERNELBASE(00000000,?,?), ref: 00D6AD34

Strings

1002, xrefs: 00D6ACEA
.dll, xrefs: 00D6AC57
.exe, xrefs: 00D6AC7B

Memory Dump Source

Source File: 00000000.00000002.2199766235.0000000000D17000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2198776112.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198963075.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199733456.0000000000B96000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2200825127.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201144676.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201161413.0000000000FDF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID: LibraryLoad
String ID: .dll$.exe$1002
API String ID: 1029625771-847511843
Opcode ID: 7f4e5317841ac8059484a7b185a1fa555cf1bf7f95f19158b18ced33be2f428b
Instruction ID: 9793ddf2118ee58b0a575e07655e90927cccf3b6b8d96d452fa18fc969ffac10
Opcode Fuzzy Hash: 7f4e5317841ac8059484a7b185a1fa555cf1bf7f95f19158b18ced33be2f428b
Instruction Fuzzy Hash: 8F319A75500109FFCF21AF68D904AAD7B75FF48301F15806AF982AA161E732D9A0DFB2

Function 00D6B115 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,00D6B0A7,?,00000000,00000000), ref: 00D6B1D2
GetModuleHandleA.KERNEL32(00000000,?,?,?,00D6B0A7,?,00000000,00000000), ref: 00D6B1E0

Strings

.dll, xrefs: 00D6B148

Memory Dump Source

Source File: 00000000.00000002.2199766235.0000000000D17000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2198776112.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198963075.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199733456.0000000000B96000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2200825127.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201144676.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201161413.0000000000FDF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID: HandleModule
String ID: .dll
API String ID: 4139908857-2738580789
Opcode ID: 299d2eb61fa7063dc722f9bd4cd4bbe4d2dbf678b5b2898d7e17819e24964c78
Instruction ID: c8076f4b5a55b8c1204ae235c3687136d2b4d957765411c66ad44eaa3488e65a
Opcode Fuzzy Hash: 299d2eb61fa7063dc722f9bd4cd4bbe4d2dbf678b5b2898d7e17819e24964c78
Instruction Fuzzy Hash: F2111870204B09BBEB319F24C82DB697BA5FF11355F040127E902844A0D77ED9E4DAB2

Function 00D6DA6F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(0158A294,-11735FEC), ref: 00D6DAE8
GetFileAttributesA.KERNEL32(00000000,-11735FEC), ref: 00D6DAF6

Strings

@, xrefs: 00D6DA9B

Memory Dump Source

Source File: 00000000.00000002.2199766235.0000000000D17000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2198776112.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198963075.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199733456.0000000000B96000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2200825127.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201144676.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201161413.0000000000FDF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID: AttributesFile
String ID: @
API String ID: 3188754299-2726393805
Opcode ID: 9ad787e7611c6faea9712a125cf07f31c6ebc9f7fd97d2bb1353ce2b6a154679
Instruction ID: b3b4af53b7d272d051bf6682f2437675ef41d30a8536c24c963eb71895eadfeb
Opcode Fuzzy Hash: 9ad787e7611c6faea9712a125cf07f31c6ebc9f7fd97d2bb1353ce2b6a154679
Instruction Fuzzy Hash: 3D018130B0C205FBDF26DF94E90979CBE76FF10340F248165E54265091D7B29A94EB70

Function 00D1C031 Relevance: 4.6, APIs: 3, Instructions: 67
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 00D1C080
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 00D1C0A7
GetNativeSystemInfo.KERNELBASE(?), ref: 00D1C0FE

Memory Dump Source

Source File: 00000000.00000002.2199766235.0000000000D17000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2198776112.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198963075.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199733456.0000000000B96000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2200825127.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201144676.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201161413.0000000000FDF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID:
API String ID: 1247124224-0
Opcode ID: c16f007a13765c4d834b3da41ecc748b92a1b86f27dff519852f349ada0339a0
Instruction ID: e4e245c933c14e0a9d7410fb7f8a5316a548e4da018528d2c736d40f9b16b1b4
Opcode Fuzzy Hash: c16f007a13765c4d834b3da41ecc748b92a1b86f27dff519852f349ada0339a0
Instruction Fuzzy Hash: 593116B505460EAEEF11DF90C848BEE3AA8EF08305F140425E98682D50EBB65CE4DF6D

Function 00D69AEF Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathAddExtensionA.KERNELBASE(?,00000000), ref: 00D69B51

Strings

\\?\, xrefs: 00D69BAC

Memory Dump Source

Source File: 00000000.00000002.2199766235.0000000000D17000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2198776112.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198963075.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199733456.0000000000B96000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2200825127.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201144676.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201161413.0000000000FDF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID: ExtensionPath
String ID: \\?\
API String ID: 158807944-4282027825
Opcode ID: 236148f55e04054b14aafd1d11c57e043819f5f4bdc45cd56bf498a7cf2f1bac
Instruction ID: e5ca2350bd144cc78f5d652469c9f46643a59c2cf81ea57fee0558e860ee04e5
Opcode Fuzzy Hash: 236148f55e04054b14aafd1d11c57e043819f5f4bdc45cd56bf498a7cf2f1bac
Instruction Fuzzy Hash: 02312C35A0020AFFDF21DF99CC19B9EB7BAFF59715F041065FA00A5060E7729A61DB60

Function 00D6B1FE Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D6953C: GetCurrentThreadId.KERNEL32 ref: 00D6954B
Part of subcall function 00D6953C: Sleep.KERNELBASE(00000005,00050000,00000000), ref: 00D6958E

GetModuleHandleExA.KERNELBASE(?,?,?), ref: 00D6B262

Strings

.dll, xrefs: 00D6B21F

Memory Dump Source

Source File: 00000000.00000002.2199766235.0000000000D17000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2198776112.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198963075.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199733456.0000000000B96000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2200825127.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201144676.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201161413.0000000000FDF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID: CurrentHandleModuleSleepThread
String ID: .dll
API String ID: 683542999-2738580789
Opcode ID: 02cabd6863b0dd5d8a6f3836d5e937be2a5d3c8f29384a3cd9fe973116f24c08
Instruction ID: 88e194366a620796d750893c3763628433f2f6f9d2d7064eecc7e6e76260e874
Opcode Fuzzy Hash: 02cabd6863b0dd5d8a6f3836d5e937be2a5d3c8f29384a3cd9fe973116f24c08
Instruction Fuzzy Hash: E8F09072200204AFDF12DF54D865B6EBBE8FF18360F108022FE1586052D731C5A09A31

Function 00D6DC8B Relevance: 3.1, APIs: 2, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(0158A294,?,?,-11735FEC,?,?,?,-11735FEC,?), ref: 00D6DD3D

Part of subcall function 00D6DC3D: IsBadWritePtr.KERNEL32(?,00000004), ref: 00D6DC4B

CreateFileA.KERNEL32(?,?,?,-11735FEC,?,?,?,-11735FEC,?), ref: 00D6DD5D

Memory Dump Source

Source File: 00000000.00000002.2199766235.0000000000D17000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2198776112.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198963075.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199733456.0000000000B96000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2200825127.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201144676.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201161413.0000000000FDF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID: CreateFile$Write
String ID:
API String ID: 1125675974-0
Opcode ID: fa72365555026ac5d6710127727481ebe6e31c625ec12bbe2cf9da40067c984b
Instruction ID: dedce1a43313d9b5d3ef171dc77e3afc57cdf1ee0a314570366858c45ba6706e
Opcode Fuzzy Hash: fa72365555026ac5d6710127727481ebe6e31c625ec12bbe2cf9da40067c984b
Instruction Fuzzy Hash: 0E111431A0024AFBCF22AF90EC05B9D7B72FF18344F194126B98215061C772C9A5EBB1

Function 00D6D5F7 Relevance: 3.0, APIs: 2, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D6953C: GetCurrentThreadId.KERNEL32 ref: 00D6954B
Part of subcall function 00D6953C: Sleep.KERNELBASE(00000005,00050000,00000000), ref: 00D6958E

GetCurrentProcess.KERNEL32(-11735FEC), ref: 00D6D604
DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00D6D66A

Memory Dump Source

Source File: 00000000.00000002.2199766235.0000000000D17000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2198776112.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198963075.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199733456.0000000000B96000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2200825127.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201144676.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201161413.0000000000FDF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID: Current$DuplicateHandleProcessSleepThread
String ID:
API String ID: 2846201637-0
Opcode ID: 4ca66452b59c616756c5719c4e6d15b98556291a18cf770353c4f80c163e39d3
Instruction ID: ff819d0a268f52ee055698b809376cc8c9712f40fe7f520dcd65a3681370a4ac
Opcode Fuzzy Hash: 4ca66452b59c616756c5719c4e6d15b98556291a18cf770353c4f80c163e39d3
Instruction Fuzzy Hash: ED01197260014EBB8F22AFA4EC04D9E7F7AFF98750B048512FA0A94011D732D162EB71

Function 00D6953C Relevance: 3.0, APIs: 2, Instructions: 33
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00D6954B
Sleep.KERNELBASE(00000005,00050000,00000000), ref: 00D6958E

Memory Dump Source

Source File: 00000000.00000002.2199766235.0000000000D17000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2198776112.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198963075.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199733456.0000000000B96000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2200825127.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201144676.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201161413.0000000000FDF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID: CurrentSleepThread
String ID:
API String ID: 1164918020-0
Opcode ID: ddb64248b0a70661cceee43e4dc0b5e3b8cf1f7efb6786b4db44758f90e268f8
Instruction ID: f8490e7b6d4332fc89e56802b4a989f264d5f6e3e9638ac7363b420f732726e4
Opcode Fuzzy Hash: ddb64248b0a70661cceee43e4dc0b5e3b8cf1f7efb6786b4db44758f90e268f8
Instruction Fuzzy Hash: 9BF0E931101605EFEB329F64C95875EF7B8FF4572DF200179D50241181D7715D95DAE2

Function 00D76411 Relevance: 1.6, APIs: 1, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2199766235.0000000000D17000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2198776112.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198963075.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199733456.0000000000B96000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2200825127.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201144676.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201161413.0000000000FDF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23be7e148a56f18962ff0a2f2dbcc3e79591bea3ea112637df9f7456bf9d904e
Instruction ID: f21bdf95d5e45490510d7d6a40a91b079132f2e8ec85ad6708155af9a9f200b9
Opcode Fuzzy Hash: 23be7e148a56f18962ff0a2f2dbcc3e79591bea3ea112637df9f7456bf9d904e
Instruction Fuzzy Hash: D4418AB1904A05EFDB31CF10C944BAD7BB1FB04314F28C455E84AAA195F371ED90EB61

Function 00D6BC76 Relevance: 1.6, APIs: 1, Instructions: 103
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000,00000010), ref: 00D6BD2B

Memory Dump Source

Source File: 00000000.00000002.2199766235.0000000000D17000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2198776112.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198963075.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199733456.0000000000B96000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2200825127.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201144676.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201161413.0000000000FDF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 9928a0ed1f43e681fd67da68b0b2fab4fe9900ac46f722725928833bb7532635
Instruction ID: 8a72f1736b16663da56ce75747df0fa0b5e7c06f4955ae1c24254cd134bf1624
Opcode Fuzzy Hash: 9928a0ed1f43e681fd67da68b0b2fab4fe9900ac46f722725928833bb7532635
Instruction Fuzzy Hash: 7C313D71600204BBDB209F65DC45F9DBBB8EF48724F24816AF605EA191C771AA91CF20

Function 00D6B492 Relevance: 1.6, APIs: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000), ref: 00D6B514

Memory Dump Source

Source File: 00000000.00000002.2199766235.0000000000D17000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2198776112.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198963075.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199733456.0000000000B96000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2200825127.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201144676.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201161413.0000000000FDF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a0377691686ac0d7c7a0f6b6c90780d7ac338aee908b69a61745d55a208dd9b9
Instruction ID: 944a860ea3cb05543f9a5fc618bfb947b1f05abe880be087e2c33f38a2bb2304
Opcode Fuzzy Hash: a0377691686ac0d7c7a0f6b6c90780d7ac338aee908b69a61745d55a208dd9b9
Instruction Fuzzy Hash: C1318171640204BFEB309F64DC45F99B7B8EB04738F20826AF611EA1D1D7B2A681CB64

Function 00D7615E Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNELBASE(?,?,0000028A,?,?), ref: 00D7620B

Memory Dump Source

Source File: 00000000.00000002.2199766235.0000000000D17000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2198776112.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198963075.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199733456.0000000000B96000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2200825127.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201144676.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201161413.0000000000FDF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: d3a8562bd35cd36f6c74b17a99398e5dce368a723e39743053883c264e471247
Instruction ID: a6939ba34eb568dca4d34b3f713d5c4bcb7a5854237c1681abbb61826d5472ff
Opcode Fuzzy Hash: d3a8562bd35cd36f6c74b17a99398e5dce368a723e39743053883c264e471247
Instruction Fuzzy Hash: C211E972E01A249FEBB05A058C48BEA777CEF19B58F14C0A5EC4D9A442F770DD808BB5

Function 054C0D48 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 054C0DCD

Memory Dump Source

Source File: 00000000.00000002.2202987761.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54c0000_file.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 97ab503cb9b3d9b4b3a6120dde49de01095586dff46b427400880bce91edf33d
Instruction ID: 4281ef1bca794bad1d97a6960345714219c754b9c809ecc0b145417c14193a11
Opcode Fuzzy Hash: 97ab503cb9b3d9b4b3a6120dde49de01095586dff46b427400880bce91edf33d
Instruction Fuzzy Hash: A821F0BA805218DBCB50DF99D888ADEBBB4FB88310F14815AD909AB204D774A940CBA5

Function 054C0D42 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 054C0DCD

Memory Dump Source

Source File: 00000000.00000002.2202987761.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54c0000_file.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 30339d7525485c6adc9af45dd58b734c94dc88ae20f7eb035b3cfc35ea21148d
Instruction ID: df79a26a0200ae5d0ab4cf2fbf065b326998f0f2c3d23eb51749791203a7729a
Opcode Fuzzy Hash: 30339d7525485c6adc9af45dd58b734c94dc88ae20f7eb035b3cfc35ea21148d
Instruction Fuzzy Hash: 6B2132BAC00218CFCB50CF99D988ADEBBB4FF88310F14825AD909AB304D734A540CBA1

Function 054C1509 Relevance: 1.6, APIs: 1, Instructions: 54serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32(?,?,?), ref: 054C1580

Memory Dump Source

Source File: 00000000.00000002.2202987761.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54c0000_file.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: aebc808c78a4b26427055cac8ff33bfc8c16d59a0e6e742ecf4a35ddb402baae
Instruction ID: e0c47ebbeaf7c1adf651dbfb0f6fac648d83c02717e94a07b776e1cdaf885baa
Opcode Fuzzy Hash: aebc808c78a4b26427055cac8ff33bfc8c16d59a0e6e742ecf4a35ddb402baae
Instruction Fuzzy Hash: 962100B59002498FDB10CFAAC584BDEBBF4FF48320F14842AE559A3250D378AA44CFA1

Function 054C1510 Relevance: 1.6, APIs: 1, Instructions: 54serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32(?,?,?), ref: 054C1580

Memory Dump Source

Source File: 00000000.00000002.2202987761.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54c0000_file.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 97a0672f4ab7d634bdc149ff4043d7196dd70b726369d9128f0d12c2b5d6ae8d
Instruction ID: 5ebac32cd3ba53ab082d82c1c587e9b2c30715472affd2417de20fbecaeae7f0
Opcode Fuzzy Hash: 97a0672f4ab7d634bdc149ff4043d7196dd70b726369d9128f0d12c2b5d6ae8d
Instruction Fuzzy Hash: 1111D0B59002499FDB10DF9AC584BDEFBF4EB48320F10846AE959A3251D378AA44CFA5

Function 00D6E7C3 Relevance: 1.6, APIs: 1, Instructions: 51fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D6953C: GetCurrentThreadId.KERNEL32 ref: 00D6954B
Part of subcall function 00D6953C: Sleep.KERNELBASE(00000005,00050000,00000000), ref: 00D6958E

MapViewOfFileEx.KERNELBASE(?,?,?,?,?,?,-11735FEC), ref: 00D6E84A

Memory Dump Source

Source File: 00000000.00000002.2199766235.0000000000D17000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2198776112.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198963075.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199733456.0000000000B96000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2200825127.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201144676.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201161413.0000000000FDF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID: CurrentFileSleepThreadView
String ID:
API String ID: 2270672837-0
Opcode ID: db732a7e8e6769bc57e766a7f524f10c1f2a9d22c28d6be891aa71f0db4df2f1
Instruction ID: 0b4fb8401babc4a43bee16f110ab564ac3c7f7a1f600231ec5b17a8b54eef420
Opcode Fuzzy Hash: db732a7e8e6769bc57e766a7f524f10c1f2a9d22c28d6be891aa71f0db4df2f1
Instruction Fuzzy Hash: 9F11DB3650014AFBCF12AFA5DC05C9E7F6AFF98344B444421FA1156062D736C572EBB1

Function 00D6E5AB Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2199766235.0000000000D17000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2198776112.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198963075.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199733456.0000000000B96000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2200825127.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201144676.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201161413.0000000000FDF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID: CurrentSleepThread
String ID:
API String ID: 1164918020-0
Opcode ID: 6854038a52939e220ff6ae6f0595400732f4d2dfe6834a732dd8109c74800cac
Instruction ID: 1b8e863c0ad3e047ac37bb846a640a8c46337b07adb23a0e5f681d089c184d00
Opcode Fuzzy Hash: 6854038a52939e220ff6ae6f0595400732f4d2dfe6834a732dd8109c74800cac
Instruction Fuzzy Hash: EB112D7610020AEBCF129FE4C909E9E7BB9EF54344F044915F9129A061D736C661EFB0

Function 054C1308 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 054C1367

Memory Dump Source

Source File: 00000000.00000002.2202987761.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54c0000_file.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 9f389b951b317d2888da749c919fd8ae3a8919e094b9ad77ebd01667000a3e44
Instruction ID: 6dd15916ae35630798985e59bf29199f3a4fed4dabcdf00369274f98eeb116b1
Opcode Fuzzy Hash: 9f389b951b317d2888da749c919fd8ae3a8919e094b9ad77ebd01667000a3e44
Instruction Fuzzy Hash: CB1122B5800249CFDB10DF9AC585BEEBBF8EF48324F20846AD518A3250C778A944CBA5

Function 054C1301 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 054C1367

Memory Dump Source

Source File: 00000000.00000002.2202987761.00000000054C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54c0000_file.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 081ca82a934c2e7e270ee872d192fa8421b30cd83104bd29d522caa533829ad0
Instruction ID: 007dad5eaa4dc5ccd8529f96898d00593df68fc587e6b1e5a1fdd6e7c0728e14
Opcode Fuzzy Hash: 081ca82a934c2e7e270ee872d192fa8421b30cd83104bd29d522caa533829ad0
Instruction Fuzzy Hash: A11122B5800209CFDB10DF9AC589BEEBBF4EF48324F24846AD558A3651D378A944CFA5

Function 00D6DE8F Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D6953C: GetCurrentThreadId.KERNEL32 ref: 00D6954B
Part of subcall function 00D6953C: Sleep.KERNELBASE(00000005,00050000,00000000), ref: 00D6958E

ReadFile.KERNELBASE(?,00000000,?,00000400,?,-11735FEC,?,?,00D6BBBE,?,?,00000400,?,00000000,?,00000000), ref: 00D6DEFB

Memory Dump Source

Source File: 00000000.00000002.2199766235.0000000000D17000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2198776112.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198963075.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199733456.0000000000B96000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2200825127.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201144676.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201161413.0000000000FDF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID: CurrentFileReadSleepThread
String ID:
API String ID: 1253362762-0
Opcode ID: 479b9843e258742193eab5246fd3a2a1363a0754b70b7956b9d15d7746dde04d
Instruction ID: aad96b046fde41ff80bdd4d81566468a414c9b4a4b4b7b369136750a5dd0c45b
Opcode Fuzzy Hash: 479b9843e258742193eab5246fd3a2a1363a0754b70b7956b9d15d7746dde04d
Instruction Fuzzy Hash: 1CF0E73260014AFBCF12AFA8EC19D9E7F6AEF58340F044451FA428A022D732C5A1EB71

Function 00D1DA91 Relevance: 1.5, APIs: 1, Instructions: 37libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 00D1DAFD

Memory Dump Source

Source File: 00000000.00000002.2199766235.0000000000D17000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2198776112.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198963075.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199733456.0000000000B96000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2200825127.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201144676.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201161413.0000000000FDF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 216250f55e84f3dd934b4bc772c7e8c78995f72349c0764fc73261300a5d32a6
Instruction ID: 985c560a08f2a15d6094853b1a18731b0e35d335a4f192831fba8751c3ebcd72
Opcode Fuzzy Hash: 216250f55e84f3dd934b4bc772c7e8c78995f72349c0764fc73261300a5d32a6
Instruction Fuzzy Hash: C801E4B250C600DFD7062F28E8495BEFBE9EF98710F02482EE5C586250D7754890CB53

Function 00D6AE72 Relevance: 1.5, APIs: 1, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00D6A628,00D6A628), ref: 00D6AEBD

Memory Dump Source

Source File: 00000000.00000002.2199766235.0000000000D17000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2198776112.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198963075.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199733456.0000000000B96000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2200825127.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201144676.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201161413.0000000000FDF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 996cac1e3c4c34e2063fba79ea812d8df03ba3211051b8ef61b2532dd4f8b3de
Instruction ID: d66d815c7410cafbdc021a86abe3bfcc4d3091e2c3fe711b8c0be0cc466eca00
Opcode Fuzzy Hash: 996cac1e3c4c34e2063fba79ea812d8df03ba3211051b8ef61b2532dd4f8b3de
Instruction Fuzzy Hash: A2E0ED31200904B78E127F7CC91985E7B16EE95350B158022B99774053DB33C651EE73

Function 00D6970D Relevance: 1.3, APIs: 1, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,?), ref: 00D69771

Memory Dump Source

Source File: 00000000.00000002.2199766235.0000000000D17000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2198776112.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198963075.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199733456.0000000000B96000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2200825127.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201144676.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201161413.0000000000FDF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 758efeaa7446c7664a8fc7f4e75d3098c9142ee0bb438b0b77a5a4da949220a2
Instruction ID: 628b7e47840c760a3ea39f30f6f903c047101522500847e4856d4afeeb5572a2
Opcode Fuzzy Hash: 758efeaa7446c7664a8fc7f4e75d3098c9142ee0bb438b0b77a5a4da949220a2
Instruction Fuzzy Hash: DA01E436A00109BFCF219FA5CC14DDEBFBAEF88381F040271B911A5061D7328A62DBA4

Function 00D75D88 Relevance: 1.3, APIs: 1, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00001000,00001000,00000004,?,?,00D75D84,?,?,00D75A8A,?,?,00D75A8A,?,?,00D75A8A), ref: 00D75DA8

Memory Dump Source

Source File: 00000000.00000002.2199766235.0000000000D17000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2198776112.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198963075.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199733456.0000000000B96000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2200825127.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201144676.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201161413.0000000000FDF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2a6cd0fbd7c26dddef65640125cb581686f3ab1aeb746763385f91005c7b3b3a
Instruction ID: 5cbfaeed22fed10c5ff57dcee7d07b380a4997af2b9073ff557bc9a83db94d48
Opcode Fuzzy Hash: 2a6cd0fbd7c26dddef65640125cb581686f3ab1aeb746763385f91005c7b3b3a
Instruction Fuzzy Hash: C7F081B1A00606EFE7218F15CD08B59BBA5FF54751F208069F44B9F591F3B198E0CB65

Function 00D6C290 Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 00D6953C: GetCurrentThreadId.KERNEL32 ref: 00D6954B
Part of subcall function 00D6953C: Sleep.KERNELBASE(00000005,00050000,00000000), ref: 00D6958E

CloseHandle.KERNELBASE(00D6BC53,-11735FEC,?,?,00D6BC53,?), ref: 00D6C2CE

Memory Dump Source

Source File: 00000000.00000002.2199766235.0000000000D17000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2198776112.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198963075.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199733456.0000000000B96000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2200825127.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201144676.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201161413.0000000000FDF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID: CloseCurrentHandleSleepThread
String ID:
API String ID: 4003616898-0
Opcode ID: 46f086e89755fe5f8354ae8dcea92d574f26286435b9ce54d68cc8cc803b0b21
Instruction ID: 7623cc2545b924cca3c9f5d92acdfc32df170002c6e753713824cfa7e02adbd9
Opcode Fuzzy Hash: 46f086e89755fe5f8354ae8dcea92d574f26286435b9ce54d68cc8cc803b0b21
Instruction Fuzzy Hash: 04E04F72200541A7CE22BAB8D829D6E7F6CDFA9354B000132F94295152EB32D195D675

Function 00D6B355 Relevance: 1.3, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,00D693DB,?,?), ref: 00D6B35B

Memory Dump Source

Source File: 00000000.00000002.2199766235.0000000000D17000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2198776112.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198963075.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199733456.0000000000B96000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2200825127.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201144676.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201161413.0000000000FDF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 5afdbdd940ae162ad3f9fd86629b4e51cd4e888cd2e1c2eed61c03d846e2f9e0
Instruction ID: 700cb69598b1b496620ce44600f27f988e49d332e3d9f28e674073fd81740e88
Opcode Fuzzy Hash: 5afdbdd940ae162ad3f9fd86629b4e51cd4e888cd2e1c2eed61c03d846e2f9e0
Instruction Fuzzy Hash: EEB09B31100508BBCF11BF51DC05C4D7F65FF153547008111F50544031C776D5619BA5

Non-executed Functions

Function 00D04A83 Relevance: 7.9, Strings: 5, Instructions: 1623COMMON

Download Yara Rule

Strings

Ij_, xrefs: 00D05A50
@9y, xrefs: 00D04C30
rzoo, xrefs: 00D0512E
AUZv, xrefs: 00D0543C
GToo, xrefs: 00D055D7

Memory Dump Source

Source File: 00000000.00000002.2199766235.0000000000B9A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2198776112.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198963075.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199733456.0000000000B96000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000D17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2200825127.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201144676.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201161413.0000000000FDF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: @9y$AUZv$GToo$rzoo$Ij_
API String ID: 0-1263636462
Opcode ID: 21600636ce7d7608d0ed1b32a286c1e5ea2a5995051635c4e449907f5eecae34
Instruction ID: 8886e82e01644512f1d926f8d1d0e3e5c96441a066eb5bd38aedc5cba44c5292
Opcode Fuzzy Hash: 21600636ce7d7608d0ed1b32a286c1e5ea2a5995051635c4e449907f5eecae34
Instruction Fuzzy Hash: EAB206F360C2009FE308AE29EC8567AFBE5EF94720F16893DEAC5C3744E63558158697

Function 00CFAB03 Relevance: 7.8, Strings: 5, Instructions: 1571COMMON

Download Yara Rule

Strings

l|o, xrefs: 00CFB455
j7, xrefs: 00CFB77A
6^, xrefs: 00CFB21A
L?/, xrefs: 00CFB8AB
zyG|, xrefs: 00CFBB07

Memory Dump Source

Source File: 00000000.00000002.2199766235.0000000000B9A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2198776112.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198963075.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199733456.0000000000B96000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000D17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2200825127.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201144676.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201161413.0000000000FDF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: 6^$L?/$j7$l|o$zyG|
API String ID: 0-2736753875
Opcode ID: 8a37610bda5e98ee7f6bfb8b06d9f2d40594dcff47660d013782ba3ca613c8b1
Instruction ID: dac0b2c3036a6bea15c1a62f40ef51ac1a61136460ff2f0c97a19ad9b68aec31
Opcode Fuzzy Hash: 8a37610bda5e98ee7f6bfb8b06d9f2d40594dcff47660d013782ba3ca613c8b1
Instruction Fuzzy Hash: 62B2F7F3A0C2009FE3086F29DC8567ABBE5EB94720F16893DEAC5C7744EA3558058797

Function 00D07F73 Relevance: 7.8, Strings: 5, Instructions: 1547COMMON

Download Yara Rule

Strings

o0r, xrefs: 00D0850E
++wr, xrefs: 00D087D0
c=?, xrefs: 00D08A4B
5*m{, xrefs: 00D08F90
Fcw{, xrefs: 00D080E1

Memory Dump Source

Source File: 00000000.00000002.2199766235.0000000000B9A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2198776112.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198963075.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199733456.0000000000B96000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000D17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2200825127.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201144676.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201161413.0000000000FDF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: ++wr$5*m{$Fcw{$c=?$o0r
API String ID: 0-1232880388
Opcode ID: 4bb9b0efdc03c20d15d4e0225d03b20581631e0d8d0d8ad6d1a119636bdf9c89
Instruction ID: 0ca34bcd0c2a1fce007c9da69d1ac3b459bf175427fb25b42e8a8e41345f082d
Opcode Fuzzy Hash: 4bb9b0efdc03c20d15d4e0225d03b20581631e0d8d0d8ad6d1a119636bdf9c89
Instruction Fuzzy Hash: EFB225F3A0C2149FE3046E29EC8567AFBE9EF94720F164A3DEAC487744E63558058793

Function 00CF98B2 Relevance: 5.9, Strings: 4, Instructions: 901COMMON

Download Yara Rule

Strings

A;], xrefs: 00CF9FCB
![n, xrefs: 00CFA191
[O, xrefs: 00CFA242
U$?', xrefs: 00CF9E66

Memory Dump Source

Source File: 00000000.00000002.2199766235.0000000000B9A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2198776112.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198963075.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199733456.0000000000B96000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000D17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2200825127.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201144676.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201161413.0000000000FDF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: ![n$A;]$U$?'$[O
API String ID: 0-2531317425
Opcode ID: 29cd38c0649f8706658ee8295455d241f9313b34329f1013813955fd0496ff2c
Instruction ID: 38d0df6e18068d760fb5662b1147ee78961143147dbb0c1db2d2b1468b3fa878
Opcode Fuzzy Hash: 29cd38c0649f8706658ee8295455d241f9313b34329f1013813955fd0496ff2c
Instruction Fuzzy Hash: 7352F7F3A0C2009FE704AE19EC8577AB7E6EF94720F1A853DEAC487744E63558058797

Function 00D064F8 Relevance: 5.4, Strings: 3, Instructions: 1633COMMON

Download Yara Rule

Strings

hG;?, xrefs: 00D06B00
zT3A, xrefs: 00D06C5D
<f?a, xrefs: 00D07060

Memory Dump Source

Source File: 00000000.00000002.2199766235.0000000000B9A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2198776112.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198963075.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199733456.0000000000B96000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000D17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2200825127.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201144676.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201161413.0000000000FDF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: <f?a$hG;?$zT3A
API String ID: 0-2058493188
Opcode ID: 7a5f393d76a2ec3fa9b96d70f240498b0c8d28f4cc69dbbab9bbf86d1aca3196
Instruction ID: 8e0c8a30428fb0c725d3a26301ff1310cb4360db4e8d7eee93ff7a9d95512447
Opcode Fuzzy Hash: 7a5f393d76a2ec3fa9b96d70f240498b0c8d28f4cc69dbbab9bbf86d1aca3196
Instruction Fuzzy Hash: DAB2D7F3A0C204AFE304AE29EC8577AB7E9EF94720F1A453DE6C4C3744EA7558058697

Function 00CFC59E Relevance: 5.3, Strings: 3, Instructions: 1573COMMON

Download Yara Rule

Strings

kl, xrefs: 00CFCA20
xotS, xrefs: 00CFD59A
S>}, xrefs: 00CFD700

Memory Dump Source

Source File: 00000000.00000002.2199766235.0000000000B9A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2198776112.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198963075.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199733456.0000000000B96000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000D17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2200825127.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201144676.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201161413.0000000000FDF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: kl$xotS$S>}
API String ID: 0-2235579807
Opcode ID: df66787a40ba02097799537fabaeadb7e916dda1aa9dbd57b11727e0256dcb53
Instruction ID: 6fd95561d834eb38062ae6c641e40d127833c1d774c469b79784b7c9d74960f2
Opcode Fuzzy Hash: df66787a40ba02097799537fabaeadb7e916dda1aa9dbd57b11727e0256dcb53
Instruction Fuzzy Hash: 73B2E2F260C2049FE304AF29EC8567AFBE6EF94720F16893DE6C487744EA3558418B57

Function 00CFE00F Relevance: 4.1, Strings: 2, Instructions: 1552COMMON

Download Yara Rule

Strings

uD7>, xrefs: 00CFE826
}.f, xrefs: 00CFE44D

Memory Dump Source

Source File: 00000000.00000002.2199766235.0000000000B9A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2198776112.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198963075.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199733456.0000000000B96000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000D17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2200825127.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201144676.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201161413.0000000000FDF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: uD7>$}.f
API String ID: 0-4004473597
Opcode ID: 0447e4238955cd38a59e3db49edc6a10157bc6e935da5951c46b275f222440ee
Instruction ID: b7987681aa9b8ed39fa269e38b776e90a8efbb5d1d8aa17e46e70c77e762960d
Opcode Fuzzy Hash: 0447e4238955cd38a59e3db49edc6a10157bc6e935da5951c46b275f222440ee
Instruction Fuzzy Hash: BDB213F3A0C214AFD304AE29EC4567AFBE9EF94720F16892DE6C4C3744E63598458787

Function 00D0BB7A Relevance: 3.7, Strings: 2, Instructions: 1236COMMON

Download Yara Rule

Strings

}IzO, xrefs: 00D0C1F5
[1, xrefs: 00D0C16A

Memory Dump Source

Source File: 00000000.00000002.2199766235.0000000000B9A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2198776112.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198963075.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199733456.0000000000B96000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000D17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2200825127.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201144676.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201161413.0000000000FDF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: }IzO$[1
API String ID: 0-3602291861
Opcode ID: 5617991fe90971845e012c34c6da2d04f63fe7970b9765254b4d08f46ff621df
Instruction ID: 8156f66722544f6afa51b8fe26cb705a22ca48582f8a0380c9c06605ea75d9b7
Opcode Fuzzy Hash: 5617991fe90971845e012c34c6da2d04f63fe7970b9765254b4d08f46ff621df
Instruction Fuzzy Hash: 2A8229F360C204AFE3046E2DEC8577ABBE5EF94720F1A493DE6C5C3744EA3598058696

Function 00D6D689 Relevance: 3.0, APIs: 2, Instructions: 43timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00D6953C: GetCurrentThreadId.KERNEL32 ref: 00D6954B
Part of subcall function 00D6953C: Sleep.KERNELBASE(00000005,00050000,00000000), ref: 00D6958E

GetSystemTime.KERNEL32(?,-11735FEC), ref: 00D6D6BE
GetFileTime.KERNEL32(?,?,?,?,-11735FEC), ref: 00D6D701

Memory Dump Source

Source File: 00000000.00000002.2199766235.0000000000D17000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2198776112.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198963075.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199733456.0000000000B96000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2200825127.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201144676.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201161413.0000000000FDF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID: Time$CurrentFileSleepSystemThread
String ID:
API String ID: 3818558864-0
Opcode ID: f2cb7f257badc4202252540a03205105f034f502184f79ae27fdf01e85c2bc86
Instruction ID: cfc6f131bfca6ca3054cd3743ec309b6d0c25bb1d123ae2eb4f8cfbad9f95d86
Opcode Fuzzy Hash: f2cb7f257badc4202252540a03205105f034f502184f79ae27fdf01e85c2bc86
Instruction Fuzzy Hash: 8701E832600549FBCF226F69EC08E9EBF7AEF95311B044126F50645061D736D5A1DA71

Function 00D014FF Relevance: 2.8, Strings: 1, Instructions: 1563COMMON

Download Yara Rule

Strings

)j, xrefs: 00D01A4B

Memory Dump Source

Source File: 00000000.00000002.2199766235.0000000000B9A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2198776112.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198963075.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199733456.0000000000B96000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000D17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2200825127.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201144676.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201161413.0000000000FDF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID: )j
API String ID: 0-3375017247
Opcode ID: 4273cba76ca8980a36a1c8ce075b5a84612e56600da8ece2c47de0bf87b6c08c
Instruction ID: 9a6684a1eb2c07d1132dc7dc111e0f507e90c6715074a8fd1410ee45a9a9dee8
Opcode Fuzzy Hash: 4273cba76ca8980a36a1c8ce075b5a84612e56600da8ece2c47de0bf87b6c08c
Instruction Fuzzy Hash: C8B218F390C6009FE304AF29EC8567AFBE5EF94720F1A893DEAC487744E63558058697

Function 00D6E547 Relevance: 1.5, APIs: 1, Instructions: 24encryptionCOMMON

Download Yara Rule

APIs

CryptVerifySignatureA.ADVAPI32(?,?,?,?,?,?), ref: 00D6E58E

Memory Dump Source

Source File: 00000000.00000002.2199766235.0000000000D17000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2198776112.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198963075.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199733456.0000000000B96000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2200825127.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201144676.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201161413.0000000000FDF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID: CryptSignatureVerify
String ID:
API String ID: 1015439381-0
Opcode ID: 06169d79b973a9c31ce2d7a3deedda5fe35b15e530fca3a07346680ca5e9ded8
Instruction ID: 332b263d377d6edfeaf2d1093887d9c0a9f78466c53e644e352fc435be925079
Opcode Fuzzy Hash: 06169d79b973a9c31ce2d7a3deedda5fe35b15e530fca3a07346680ca5e9ded8
Instruction Fuzzy Hash: CAF0D43660420AEFCF11CFA4C90498C7BB1FF19348B108125A90696110D375D661EF80

Function 00C79D4C Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2199766235.0000000000B9A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2198776112.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198963075.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199733456.0000000000B96000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000D17000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2200825127.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201144676.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201161413.0000000000FDF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e22d8900c191182aed64f915b6e08b9f2cda8e0249f8f392bb121e9ac26ac2bb
Instruction ID: 6a73aa5b2a498a93e4a1dfd67ea67acaa2fb3e245cf50e1b1555096489926a5b
Opcode Fuzzy Hash: e22d8900c191182aed64f915b6e08b9f2cda8e0249f8f392bb121e9ac26ac2bb
Instruction Fuzzy Hash: 1C51F9F39083049FF310AD29EC8577BB7D9DB84720F16863DEAC4C7B84E53998059696

Function 00D2A01F Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2199766235.0000000000D17000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2198776112.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198963075.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199733456.0000000000B96000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2200825127.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201144676.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201161413.0000000000FDF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6417ebb28cede65e9907f2a43ea49d1fe2187190dba6e530d3e0489045a84619
Instruction ID: 3868425e32162e3d5d6990ecf59ef609ee3e624c7e7ac5a79fc962ebd183f1bd
Opcode Fuzzy Hash: 6417ebb28cede65e9907f2a43ea49d1fe2187190dba6e530d3e0489045a84619
Instruction Fuzzy Hash: 0041A3F250C310AFE3156E08EC81BBAF7E8FF94334F25492EE6C582240E77558448AA7

Function 00D26D25 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2199766235.0000000000D17000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2198776112.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198963075.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199733456.0000000000B96000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2200825127.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201144676.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201161413.0000000000FDF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d08bcc131d4574418bdf164dd2b4aad51f1dbcaa859c87d5c43255cfeac22c2
Instruction ID: 75c572f703e1213ec4e2ca56debe3317745af8a05e82777a1e7e6c00a51b3f8b
Opcode Fuzzy Hash: 2d08bcc131d4574418bdf164dd2b4aad51f1dbcaa859c87d5c43255cfeac22c2
Instruction Fuzzy Hash: 3E3145B250C200AFE715AF28D8816BEFBE6FF98310F16882DE2C582250D7356890DB57

Function 00D259B8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2199766235.0000000000D17000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2198776112.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198963075.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199733456.0000000000B96000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2200825127.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201144676.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201161413.0000000000FDF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f1eec6b456c0a996315df7a91686ff2e566f6363d83b073aab642367601bec9
Instruction ID: 8f481296340e663dcc5b6977a309f9aab26cbc54ee4d7346a61f09b87541151d
Opcode Fuzzy Hash: 9f1eec6b456c0a996315df7a91686ff2e566f6363d83b073aab642367601bec9
Instruction Fuzzy Hash: 7001467A50120ACACB04CF04D104A9EF774FF48364F1692A9E8491BB14E3746DD0CF89

Function 00D6CBBF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00D6953C: GetCurrentThreadId.KERNEL32 ref: 00D6954B
Part of subcall function 00D6953C: Sleep.KERNELBASE(00000005,00050000,00000000), ref: 00D6958E

Part of subcall function 00D6DC3D: IsBadWritePtr.KERNEL32(?,00000004), ref: 00D6DC4B

wsprintfA.USER32 ref: 00D6CC05
LoadImageA.USER32(?,?,?,?,?,?), ref: 00D6CCC9

Strings

%8x, xrefs: 00D6CC00, 00D6CC03
%8x, xrefs: 00D6CC93, 00D6CCC6

Memory Dump Source

Source File: 00000000.00000002.2199766235.0000000000D17000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2198776112.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198963075.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199733456.0000000000B96000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2200825127.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201144676.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201161413.0000000000FDF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID: CurrentImageLoadSleepThreadWritewsprintf
String ID: %8x$%8x
API String ID: 2375920415-2046107164
Opcode ID: 729b3df3f9e1b4d055f0143feb0630c922e46f5ba1fa45a1aed29b675edddc80
Instruction ID: d02124ec310a219641e8d11fce54987961abcaa770594cde4fa7d25b8c7aae64
Opcode Fuzzy Hash: 729b3df3f9e1b4d055f0143feb0630c922e46f5ba1fa45a1aed29b675edddc80
Instruction Fuzzy Hash: A631E671A0010AFFCF11DF94DC49EAEBB79FF88710F108126BA15A61A1D7719A61DBA0

Function 00D6D790 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNEL32(0158A294,00004020,00000000,-11735FEC), ref: 00D6D87D

Strings

@, xrefs: 00D6D7BC

Memory Dump Source

Source File: 00000000.00000002.2199766235.0000000000D17000.00000040.00000001.01000000.00000003.sdmp, Offset: 00B90000, based on PE: true

Associated: 00000000.00000002.2198776112.0000000000B90000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2198963075.0000000000B92000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199733456.0000000000B96000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000B9A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2199766235.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2200825127.0000000000E3B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201144676.0000000000FDC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2201161413.0000000000FDF000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b90000_file.jbxd

Similarity

API ID: AttributesFile
String ID: @
API String ID: 3188754299-2726393805
Opcode ID: 98a1bac6830882c7a07b1a265a1bd169da57aeb4ab5f2fc486bd551b92822de5
Instruction ID: 08906a6846e854f1680022651e7f9033cddc658f8c1dcf53b64954ce63631205
Opcode Fuzzy Hash: 98a1bac6830882c7a07b1a265a1bd169da57aeb4ab5f2fc486bd551b92822de5
Instruction Fuzzy Hash: 48316DB5A04705EFDF25CF44D848B9ABFB5FF08340F108569E99667250C371EAA4DBA0

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: file.exePID: 2452, Parent PID: 1028

General

Chronological Activities

Disassembly

Analysis Process: file.exePID: 2452, Parent PID: 1028COMMON

Execution Graph

Graph

Windows Analysis Report
file.exe

Function 00D759E5 Relevance: 3.1, APIs: 2, Instructions: 107
memoryCOMMON

Function 00D6AC0F Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83
libraryCOMMON

Function 00D6B115 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
COMMON

Function 00D6DA6F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Function 00D1C031 Relevance: 4.6, APIs: 3, Instructions: 67
registryCOMMON

Function 00D69AEF Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90
COMMON

Function 00D6B1FE Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32
COMMON

Function 00D6DC8B Relevance: 3.1, APIs: 2, Instructions: 57
fileCOMMON

Function 00D6D5F7 Relevance: 3.0, APIs: 2, Instructions: 41
COMMON

Function 00D6953C Relevance: 3.0, APIs: 2, Instructions: 33
sleepthreadCOMMON

Function 00D76411 Relevance: 1.6, APIs: 1, Instructions: 112
COMMON

Function 00D6BC76 Relevance: 1.6, APIs: 1, Instructions: 103
fileCOMMON

Function 00D6B492 Relevance: 1.6, APIs: 1, Instructions: 92
fileCOMMON