Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1538204
MD5:	fcea453f064a55fc3ae011ed4c822299
SHA1:	bf0240e1df04f0f6d8f346aff5f13709b6f18eb9
SHA256:	a732580d9bcc87ecf489b550648116143cfea9b36d165de1237ddb5968ae6c94
Tags:	exeuser-Bitsight
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

AI detected suspicious sample

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Hides threads from debuggers

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to detect virtual machines (SIDT)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Enables debug privileges

Entry point lies outside standard sections

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6568 cmdline: "C:\Users\user\Desktop\file.exe" MD5: FCEA453F064A55FC3AE011ED4C822299)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F4DA58 CryptVerifySignatureA,

0_2_00F4DA58

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: file.exe, 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1712071516.0000000005520000.00000004.00001000.00020000.00000000.sdmp

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EDD061	0_2_00EDD061
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ECB018	0_2_00ECB018
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EE71FC	0_2_00EE71FC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EE22FB	0_2_00EE22FB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E2D3D4	0_2_00E2D3D4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EE932A	0_2_00EE932A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DB531D	0_2_00DB531D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EDF486	0_2_00EDF486
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EAF642	0_2_00EAF642
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EDB644	0_2_00EDB644
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EEA8A2	0_2_00EEA8A2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EBE825	0_2_00EBE825
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E0894E	0_2_00E0894E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00DC3BF3	0_2_00DC3BF3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F16C5F	0_2_00F16C5F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EE3D64	0_2_00EE3D64
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EEDD54	0_2_00EEDD54
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00ED7D14	0_2_00ED7D14
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E75E07	0_2_00E75E07

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00F48A4D appears 35 times

Source: file.exe, 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: file.exe

Static PE information: Section: dqhhwlkv ZLIB complexity 0.9948120839497041

Source: classification engine

Classification label: mal100.evad.winEXE@1/1@0/0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_056215D0 ChangeServiceConfigA,

0_2_056215D0

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application
Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior

Source: file.exe

Static file information: File size 1755648 > 1048576

Source: file.exe

Static PE information: Raw size of dqhhwlkv is bigger than: 0x100000 < 0x1a6800

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.d60000.0.unpack :EW;.rsrc:W;.idata :W; :EW;dqhhwlkv:EW;ygqkenky:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1b7dc6 should be: 0x1bbc8c

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: dqhhwlkv
Source: file.exe	Static PE information: section name: ygqkenky
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F0243E push ebp; mov dword ptr [esp], edx	0_2_00F02445
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F0243E push esi; mov dword ptr [esp], ebx	0_2_00F05F43
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F02A3C push edx; mov dword ptr [esp], 3F68AFE7h	0_2_00F044BA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F02A3C push 550A2400h; mov dword ptr [esp], ebp	0_2_00F062C6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F02A3C push eax; mov dword ptr [esp], esp	0_2_00F062CA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FD90F0 push eax; mov dword ptr [esp], ebp	0_2_00FD9469
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F990F6 push ebx; mov dword ptr [esp], esp	0_2_00F99143
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D780F3 push ebx; mov dword ptr [esp], 5EFD85CDh	0_2_00D78246
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D780F3 push eax; mov dword ptr [esp], ebx	0_2_00D78252
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D780F3 push ebx; mov dword ptr [esp], eax	0_2_00D78269
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D780F3 push 3358E218h; mov dword ptr [esp], ebp	0_2_00D78271
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D780F3 push esi; mov dword ptr [esp], ebx	0_2_00D782C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F020DB push edx; mov dword ptr [esp], 5ACFAA7Eh	0_2_00F029C6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F020DB push edx; mov dword ptr [esp], 766CBB81h	0_2_00F029D1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F090CA push edx; mov dword ptr [esp], ecx	0_2_00F090D3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FA109B push ecx; mov dword ptr [esp], 3A6D7146h	0_2_00FA10D9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F05096 push 62CE4B32h; mov dword ptr [esp], eax	0_2_00F050A5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F19097 push 350E434Dh; mov dword ptr [esp], ecx	0_2_00F1914C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EDD061 push ebx; mov dword ptr [esp], eax	0_2_00EDD068
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EDD061 push eax; mov dword ptr [esp], edx	0_2_00EDD113
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EDD061 push 7B176125h; mov dword ptr [esp], ebp	0_2_00EDD16B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EDD061 push 68ED7844h; mov dword ptr [esp], esi	0_2_00EDD1D4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EDD061 push 264B22A0h; mov dword ptr [esp], eax	0_2_00EDD211
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EDD061 push edi; mov dword ptr [esp], edx	0_2_00EDD26D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EDD061 push 4622CA0Bh; mov dword ptr [esp], esi	0_2_00EDD2A1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EDD061 push esi; mov dword ptr [esp], edx	0_2_00EDD38F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EDD061 push 54FDDD3Bh; mov dword ptr [esp], edx	0_2_00EDD44A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EDD061 push 3743AC06h; mov dword ptr [esp], eax	0_2_00EDD45A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EDD061 push ecx; mov dword ptr [esp], 4C63062Eh	0_2_00EDD4EF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EDD061 push 372631BFh; mov dword ptr [esp], edi	0_2_00EDD530
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EDD061 push ecx; mov dword ptr [esp], eax	0_2_00EDD5A9

Source: file.exe	Static PE information: section name: entropy: 7.803903347541593
Source: file.exe	Static PE information: section name: dqhhwlkv entropy: 7.952845025246385

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF5515 second address: EF5519 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF57E4 second address: EF57F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F38E8C7DE5Ch 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF7D5F second address: EF7D63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF7EDF second address: EF7EEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F38E8C7DE5Bh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF7F95 second address: EF7FA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F38E8DD200Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF7FA3 second address: EF8004 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 48162B11h 0x0000000f jmp 00007F38E8C7DE67h 0x00000014 lea ebx, dword ptr [ebp+1245DC48h] 0x0000001a push 00000000h 0x0000001c push ecx 0x0000001d call 00007F38E8C7DE58h 0x00000022 pop ecx 0x00000023 mov dword ptr [esp+04h], ecx 0x00000027 add dword ptr [esp+04h], 0000001Ah 0x0000002f inc ecx 0x00000030 push ecx 0x00000031 ret 0x00000032 pop ecx 0x00000033 ret 0x00000034 jnl 00007F38E8C7DE58h 0x0000003a xchg eax, ebx 0x0000003b jc 00007F38E8C7DE7Ah 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF8004 second address: EF8008 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF80C6 second address: EF80D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF80D2 second address: EF810A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 nop 0x00000007 pushad 0x00000008 movzx edi, cx 0x0000000b jmp 00007F38E8DD200Bh 0x00000010 popad 0x00000011 xor dword ptr [ebp+122D1A71h], edi 0x00000017 push 00000000h 0x00000019 mov dword ptr [ebp+122D1FFAh], esi 0x0000001f add dx, ADE1h 0x00000024 call 00007F38E8DD2009h 0x00000029 pushad 0x0000002a push eax 0x0000002b push edx 0x0000002c push ecx 0x0000002d pop ecx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF810A second address: EF8114 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF8114 second address: EF8118 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF8118 second address: EF8128 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F38E8C7DE56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF8128 second address: EF8142 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F38E8DD2013h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF8142 second address: EF815F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jmp 00007F38E8C7DE5Bh 0x00000010 mov eax, dword ptr [eax] 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF815F second address: EF8163 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF8163 second address: EF8171 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F38E8C7DE56h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF8171 second address: EF8175 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF8175 second address: EF8184 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push edi 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF8184 second address: EF81DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edi 0x00000006 pop eax 0x00000007 push 00000000h 0x00000009 push ebx 0x0000000a call 00007F38E8DD2008h 0x0000000f pop ebx 0x00000010 mov dword ptr [esp+04h], ebx 0x00000014 add dword ptr [esp+04h], 0000001Bh 0x0000001c inc ebx 0x0000001d push ebx 0x0000001e ret 0x0000001f pop ebx 0x00000020 ret 0x00000021 and dx, A2B9h 0x00000026 push 00000003h 0x00000028 mov dword ptr [ebp+122D1BCCh], esi 0x0000002e push 00000000h 0x00000030 xor dword ptr [ebp+122D34CBh], ecx 0x00000036 push 00000003h 0x00000038 pushad 0x00000039 mov bx, 733Fh 0x0000003d mov cx, si 0x00000040 popad 0x00000041 push 9E2D067Eh 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a jl 00007F38E8DD2006h 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF81DD second address: EF81E7 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F38E8C7DE56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0B37B second address: F0B381 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F18DF1 second address: F18E00 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 jne 00007F38E8C7DE56h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDCB6D second address: EDCB71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F16DA3 second address: F16DB8 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F38E8C7DE56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b js 00007F38E8C7DE56h 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F16DB8 second address: F16DDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F38E8DD2019h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F16F34 second address: F16F7C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E8C7DE5Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F38E8C7DE5Ah 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F38E8C7DE61h 0x00000016 jmp 00007F38E8C7DE67h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F16F7C second address: F16F99 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E8DD2017h 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F16F99 second address: F16F9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F17640 second address: F17660 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E8DD200Fh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jp 00007F38E8DD2008h 0x00000011 push esi 0x00000012 pop esi 0x00000013 push ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F17660 second address: F17688 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F38E8C7DE64h 0x00000009 pop ecx 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007F38E8C7DE5Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F17688 second address: F1768E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1768E second address: F17694 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F17694 second address: F1769D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F17B23 second address: F17B27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0CACB second address: F0CAD8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEA43D second address: EEA442 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1802C second address: F1805B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F38E8DD200Ch 0x0000000c jnc 00007F38E8DD2006h 0x00000012 popad 0x00000013 jne 00007F38E8DD2023h 0x00000019 jmp 00007F38E8DD2011h 0x0000001e pushad 0x0000001f push edx 0x00000020 pop edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F185C6 second address: F185DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F38E8C7DE63h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1871A second address: F18720 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1F5EF second address: F1F603 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F38E8C7DE5Fh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1F603 second address: F1F621 instructions: 0x00000000 rdtsc 0x00000002 je 00007F38E8DD2013h 0x00000008 jmp 00007F38E8DD200Dh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pushad 0x00000014 popad 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1FCB0 second address: F1FCC9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E8C7DE5Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1FCC9 second address: F1FD0F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F38E8DD2019h 0x0000000b popad 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push esi 0x00000011 jmp 00007F38E8DD2015h 0x00000016 pop esi 0x00000017 mov eax, dword ptr [eax] 0x00000019 je 00007F38E8DD200Eh 0x0000001f push ecx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F23374 second address: F2337A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2337A second address: F23382 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F238D1 second address: F238EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E8C7DE64h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F238EB second address: F23903 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F38E8DD2013h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F23903 second address: F23909 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F23909 second address: F2392A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F38E8DD2018h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F277C0 second address: F277C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F277C7 second address: F277E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F38E8DD2015h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F278A5 second address: F278B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pushad 0x00000009 popad 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F278B0 second address: F278B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F27FDC second address: F27FE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F27FE0 second address: F27FE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F27FE6 second address: F27FEB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F28F86 second address: F28F8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F28F8A second address: F28F90 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2A1EA second address: F2A210 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E8DD2013h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnl 00007F38E8DD200Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2A210 second address: F2A215 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2AD5B second address: F2ADED instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 ja 00007F38E8DD2018h 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push edx 0x00000013 call 00007F38E8DD2008h 0x00000018 pop edx 0x00000019 mov dword ptr [esp+04h], edx 0x0000001d add dword ptr [esp+04h], 00000014h 0x00000025 inc edx 0x00000026 push edx 0x00000027 ret 0x00000028 pop edx 0x00000029 ret 0x0000002a push 00000000h 0x0000002c jmp 00007F38E8DD2017h 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push edi 0x00000036 call 00007F38E8DD2008h 0x0000003b pop edi 0x0000003c mov dword ptr [esp+04h], edi 0x00000040 add dword ptr [esp+04h], 00000018h 0x00000048 inc edi 0x00000049 push edi 0x0000004a ret 0x0000004b pop edi 0x0000004c ret 0x0000004d xchg eax, ebx 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 jmp 00007F38E8DD200Eh 0x00000056 jbe 00007F38E8DD2006h 0x0000005c popad 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2ADED second address: F2ADF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2ADF3 second address: F2ADF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2ADF7 second address: F2AE18 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E8C7DE60h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 ja 00007F38E8C7DE56h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2AE18 second address: F2AE22 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F38E8DD2006h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2B785 second address: F2B78B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2B78B second address: F2B79D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F38E8DD200Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2B79D second address: F2B7A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2C21B second address: F2C27E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F38E8DD2006h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jbe 00007F38E8DD2008h 0x00000010 popad 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push edx 0x00000017 call 00007F38E8DD2008h 0x0000001c pop edx 0x0000001d mov dword ptr [esp+04h], edx 0x00000021 add dword ptr [esp+04h], 00000019h 0x00000029 inc edx 0x0000002a push edx 0x0000002b ret 0x0000002c pop edx 0x0000002d ret 0x0000002e movsx edi, cx 0x00000031 push 00000000h 0x00000033 push 00000000h 0x00000035 push ebx 0x00000036 call 00007F38E8DD2008h 0x0000003b pop ebx 0x0000003c mov dword ptr [esp+04h], ebx 0x00000040 add dword ptr [esp+04h], 00000014h 0x00000048 inc ebx 0x00000049 push ebx 0x0000004a ret 0x0000004b pop ebx 0x0000004c ret 0x0000004d mov esi, dword ptr [ebp+122D36D5h] 0x00000053 push eax 0x00000054 pushad 0x00000055 pushad 0x00000056 push eax 0x00000057 push edx 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2C27E second address: F2C284 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2CE4F second address: F2CE55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F31F01 second address: F31F07 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F32E19 second address: F32E1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F33CCA second address: F33CCF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F35DD1 second address: F35DDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F35DDE second address: F35DE4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F35077 second address: F3507E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F36D4F second address: F36D55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F36D55 second address: F36D5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F38E8DD2006h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F36D5F second address: F36D63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F36D63 second address: F36D7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c jmp 00007F38E8DD200Ch 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F36F6F second address: F36F73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38E47 second address: F38E4D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3AF98 second address: F3AF9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38F74 second address: F38F7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3A013 second address: F3A019 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F37F6D second address: F37F71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3B0B6 second address: F3B0D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E8C7DE5Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007F38E8C7DE56h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38F7A second address: F38F91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F38E8DD200Eh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3BE39 second address: F3BE3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3B186 second address: F3B18C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3CE44 second address: F3CE48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3C013 second address: F3C018 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3D0B2 second address: F3D0E2 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F38E8C7DE5Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jl 00007F38E8C7DE74h 0x00000011 pushad 0x00000012 jmp 00007F38E8C7DE66h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3EFCF second address: F3EFD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F45FD3 second address: F45FD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F45FD7 second address: F45FEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F38E8DD200Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F45FEB second address: F45FF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F46279 second address: F4627D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4627D second address: F46283 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F46283 second address: F462A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F38E8DD200Fh 0x00000009 jmp 00007F38E8DD200Dh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F462A3 second address: F462C1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F38E8C7DE60h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F462C1 second address: F462DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E8DD200Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jns 00007F38E8DD2008h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F55C3A second address: F55C3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F55D5A second address: F55D88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edi 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edi 0x0000000b popad 0x0000000c push eax 0x0000000d jmp 00007F38E8DD2013h 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 jbe 00007F38E8DD2018h 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F55D88 second address: F55D8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F55EBC second address: F55EC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F55EC0 second address: F55EC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F55EC6 second address: F55ECC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F55ECC second address: F55ED0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE022B second address: EE0240 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jnc 00007F38E8DD2006h 0x0000000b popad 0x0000000c push esi 0x0000000d jl 00007F38E8DD2006h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5A87C second address: F5A894 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push esi 0x00000007 pushad 0x00000008 jmp 00007F38E8C7DE5Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5A894 second address: F5A89D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5A89D second address: F5A8A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5B0DD second address: F5B0F3 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F38E8DD200Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5B0F3 second address: F5B0F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5B0F7 second address: F5B10E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F38E8DD2006h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F38E8DD200Bh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5B10E second address: F5B113 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5B113 second address: F5B119 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5B555 second address: F5B561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F38E8C7DE56h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5B845 second address: F5B857 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F38E8DD200Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5B9AF second address: F5B9DA instructions: 0x00000000 rdtsc 0x00000002 jns 00007F38E8C7DE56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d jmp 00007F38E8C7DE61h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 js 00007F38E8C7DE56h 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5B9DA second address: F5B9DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5B9DE second address: F5BA0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F38E8C7DE66h 0x0000000d popad 0x0000000e jnp 00007F38E8C7DE76h 0x00000014 ja 00007F38E8C7DE70h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5BB63 second address: F5BB9B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F38E8DD2019h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F38E8DD2012h 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5BB9B second address: F5BBBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F38E8C7DE68h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5FDCD second address: F5FDD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5FF2A second address: F5FF2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6008E second address: F60098 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F60098 second address: F6009C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6009C second address: F600B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E8DD2015h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F600B5 second address: F600D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F38E8C7DE66h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F600D3 second address: F600D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F603CB second address: F603CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F603CF second address: F603F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F38E8DD2015h 0x0000000d popad 0x0000000e jl 00007F38E8DD2025h 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F603F6 second address: F603FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6057D second address: F60581 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6096A second address: F60970 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F60970 second address: F60984 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 jmp 00007F38E8DD200Dh 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F60DBE second address: F60DC4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F60DC4 second address: F60DCA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDE695 second address: EDE6A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F38E8C7DE56h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDE6A1 second address: EDE6CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push esi 0x00000007 push ebx 0x00000008 jmp 00007F38E8DD200Dh 0x0000000d pop ebx 0x0000000e pushad 0x0000000f jmp 00007F38E8DD200Eh 0x00000014 jg 00007F38E8DD2006h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F68274 second address: F6827E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push esi 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6827E second address: F68289 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDB15C second address: EDB162 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDB162 second address: EDB171 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jl 00007F38E8DD2006h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6D002 second address: F6D009 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6D183 second address: F6D187 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6D187 second address: F6D193 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F38E8C7DE56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6D32D second address: F6D333 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6D333 second address: F6D352 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E8C7DE61h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jl 00007F38E8C7DE56h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6D352 second address: F6D356 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6D356 second address: F6D37E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E8C7DE64h 0x00000007 jmp 00007F38E8C7DE60h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6D37E second address: F6D396 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F38E8DD200Dh 0x00000008 pushad 0x00000009 popad 0x0000000a pop ebx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6D396 second address: F6D39C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6D4E1 second address: F6D50C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E8DD200Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a jmp 00007F38E8DD2014h 0x0000000f pushad 0x00000010 popad 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6D50C second address: F6D555 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007F38E8C7DE61h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 ja 00007F38E8C7DE6Fh 0x00000016 push eax 0x00000017 push edx 0x00000018 jnc 00007F38E8C7DE56h 0x0000001e ja 00007F38E8C7DE56h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6D6F8 second address: F6D6FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6D864 second address: F6D86B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6DA0F second address: F6DA15 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F73BAB second address: F73BB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F72A71 second address: F72A75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F72A75 second address: F72A8C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E8C7DE63h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F25D7F second address: F25D84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F25FA2 second address: F26017 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 add dword ptr [esp], 285EE6EEh 0x0000000c push 00000000h 0x0000000e push edi 0x0000000f call 00007F38E8C7DE58h 0x00000014 pop edi 0x00000015 mov dword ptr [esp+04h], edi 0x00000019 add dword ptr [esp+04h], 00000016h 0x00000021 inc edi 0x00000022 push edi 0x00000023 ret 0x00000024 pop edi 0x00000025 ret 0x00000026 pushad 0x00000027 or dword ptr [ebp+122D1886h], ecx 0x0000002d stc 0x0000002e popad 0x0000002f call 00007F38E8C7DE59h 0x00000034 push edi 0x00000035 jg 00007F38E8C7DE58h 0x0000003b pop edi 0x0000003c push eax 0x0000003d jmp 00007F38E8C7DE5Eh 0x00000042 mov eax, dword ptr [esp+04h] 0x00000046 ja 00007F38E8C7DE5Eh 0x0000004c jnp 00007F38E8C7DE58h 0x00000052 pushad 0x00000053 popad 0x00000054 mov eax, dword ptr [eax] 0x00000056 push eax 0x00000057 push edx 0x00000058 pushad 0x00000059 jg 00007F38E8C7DE56h 0x0000005f push eax 0x00000060 pop eax 0x00000061 popad 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F26017 second address: F26034 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F38E8DD200Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e jo 00007F38E8DD200Eh 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F26117 second address: F2611B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2611B second address: F26132 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E8DD2013h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2629D second address: F26316 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jmp 00007F38E8C7DE5Fh 0x0000000f jmp 00007F38E8C7DE5Dh 0x00000014 popad 0x00000015 jnc 00007F38E8C7DE5Ch 0x0000001b popad 0x0000001c mov eax, dword ptr [esp+04h] 0x00000020 jnc 00007F38E8C7DE5Eh 0x00000026 mov eax, dword ptr [eax] 0x00000028 pushad 0x00000029 pushad 0x0000002a jmp 00007F38E8C7DE60h 0x0000002f jmp 00007F38E8C7DE69h 0x00000034 popad 0x00000035 pushad 0x00000036 pushad 0x00000037 popad 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F26316 second address: F2632F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F38E8DD200Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2641B second address: F2641F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F26B6A second address: F26B6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F26DCB second address: F26DD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F26DD1 second address: F26DD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F26DD5 second address: F26E0C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov edi, 56F78D99h 0x00000010 lea eax, dword ptr [ebp+1248B66Eh] 0x00000016 jl 00007F38E8C7DE69h 0x0000001c jmp 00007F38E8C7DE63h 0x00000021 push eax 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 push eax 0x00000026 pop eax 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F26E0C second address: F26E11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F73148 second address: F7315B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F38E8C7DE5Dh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7315B second address: F7317C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F38E8DD2006h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jo 00007F38E8DD2006h 0x00000016 pushad 0x00000017 popad 0x00000018 jnl 00007F38E8DD2006h 0x0000001e pushad 0x0000001f popad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7317C second address: F7319E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E8C7DE68h 0x00000007 jbe 00007F38E8C7DE62h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7319E second address: F731A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F75E9B second address: F75EA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F78A4F second address: F78A83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 popad 0x00000008 pushad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f je 00007F38E8DD2012h 0x00000015 jne 00007F38E8DD2006h 0x0000001b ja 00007F38E8DD2006h 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F38E8DD2011h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F26840 second address: F26844 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F26844 second address: F26848 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F26848 second address: F2684E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2684E second address: F2686F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 js 00007F38E8DD2006h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F38E8DD2011h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7E4EA second address: F7E506 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E8C7DE68h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7EF74 second address: F7EF79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7EF79 second address: F7EF90 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F38E8C7DE5Ah 0x00000008 pushad 0x00000009 popad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push ebx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ebx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7EF90 second address: F7EFA4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E8DD200Ah 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE38BE second address: EE38C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE38C3 second address: EE38D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007F38E8DD2006h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F81E57 second address: F81E5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F81E5F second address: F81E63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F81E63 second address: F81E9A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F38E8C7DE5Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F38E8C7DE69h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 jnc 00007F38E8C7DE56h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F81E9A second address: F81EB4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E8DD200Bh 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c ja 00007F38E8DD2006h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F81EB4 second address: F81EDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F38E8C7DE66h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jno 00007F38E8C7DE56h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F86CB4 second address: F86CD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F38E8DD2019h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F86104 second address: F86108 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F86815 second address: F8682B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F38E8DD2011h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8682B second address: F86838 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007F38E8C7DE62h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8DE65 second address: F8DE87 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E8DD2015h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jno 00007F38E8DD2006h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8DE87 second address: F8DE8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8DE8C second address: F8DEBE instructions: 0x00000000 rdtsc 0x00000002 jns 00007F38E8DD200Eh 0x00000008 pushad 0x00000009 popad 0x0000000a jne 00007F38E8DD2006h 0x00000010 push edi 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007F38E8DD2010h 0x00000018 pop edi 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c push edx 0x0000001d jc 00007F38E8DD200Eh 0x00000023 pushad 0x00000024 popad 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8DEBE second address: F8DEC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8DEC2 second address: F8DEC7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8DEC7 second address: F8DED3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8BEB2 second address: F8BED5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F38E8DD2018h 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8C187 second address: F8C19B instructions: 0x00000000 rdtsc 0x00000002 jo 00007F38E8C7DE56h 0x00000008 jc 00007F38E8C7DE56h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8C19B second address: F8C1C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E8DD200Ch 0x00000007 jmp 00007F38E8DD2017h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8C1C2 second address: F8C1E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F38E8C7DE5Dh 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jbe 00007F38E8C7DE56h 0x00000011 jnc 00007F38E8C7DE56h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8C1E1 second address: F8C1E7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8C7C7 second address: F8C7CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F26021 second address: F26034 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a jo 00007F38E8DD200Eh 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8CCF6 second address: F8CCFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8CFD9 second address: F8CFE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8D2CC second address: F8D30A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E8C7DE66h 0x00000007 jbe 00007F38E8C7DE56h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F38E8C7DE63h 0x00000017 jc 00007F38E8C7DE62h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8D30A second address: F8D310 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8D310 second address: F8D314 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8D5F8 second address: F8D61F instructions: 0x00000000 rdtsc 0x00000002 jns 00007F38E8DD201Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8D61F second address: F8D62F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F38E8C7DE56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8D62F second address: F8D650 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F38E8DD2019h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8D650 second address: F8D687 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jmp 00007F38E8C7DE68h 0x0000000b pop ecx 0x0000000c pushad 0x0000000d jmp 00007F38E8C7DE5Fh 0x00000012 jc 00007F38E8C7DE56h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8DBE9 second address: F8DBED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F91B38 second address: F91B6B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007F38E8C7DE64h 0x0000000a jmp 00007F38E8C7DE64h 0x0000000f popad 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F91B6B second address: F91B80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnp 00007F38E8DD2018h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F91B80 second address: F91B86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92176 second address: F9217A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9217A second address: F92180 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92180 second address: F9218A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9218A second address: F9219C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F38E8C7DE5Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F922E2 second address: F9233F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F38E8DD2012h 0x0000000b popad 0x0000000c je 00007F38E8DD2008h 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F38E8DD2013h 0x00000019 jnc 00007F38E8DD200Ch 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F38E8DD2012h 0x00000029 jns 00007F38E8DD2006h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9233F second address: F92347 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92574 second address: F92593 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F38E8DD2006h 0x0000000a jmp 00007F38E8DD2010h 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92593 second address: F925AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jbe 00007F38E8C7DE58h 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jo 00007F38E8C7DE56h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE1DAE second address: EE1DD0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a jmp 00007F38E8DD2018h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9F6B0 second address: F9F6C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F38E8C7DE56h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9F805 second address: F9F812 instructions: 0x00000000 rdtsc 0x00000002 js 00007F38E8DD2008h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9F812 second address: F9F82F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F38E8C7DE5Ch 0x00000009 jnc 00007F38E8C7DE56h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 push esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9F82F second address: F9F845 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jg 00007F38E8DD200Eh 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9FC91 second address: F9FC99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9FC99 second address: F9FC9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9FC9F second address: F9FCA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA0BB5 second address: FA0BBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9F238 second address: F9F23F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9F23F second address: F9F24E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jns 00007F38E8DD2006h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA5F41 second address: FA5F4B instructions: 0x00000000 rdtsc 0x00000002 jl 00007F38E8C7DE66h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA9748 second address: FA9754 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F38E8DD2006h 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA9754 second address: FA9774 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E8C7DE5Ch 0x00000007 jbe 00007F38E8C7DE56h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 pushad 0x00000015 popad 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 pop esi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA9774 second address: FA9780 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jg 00007F38E8DD2006h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA9A33 second address: FA9A3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB6FA0 second address: FB6FA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC0B6C second address: FC0B70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC340A second address: FC342F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jng 00007F38E8DD2006h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jbe 00007F38E8DD2006h 0x00000014 jmp 00007F38E8DD2011h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC342F second address: FC346B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F38E8C7DE56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F38E8C7DE67h 0x00000011 jmp 00007F38E8C7DE69h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC346B second address: FC346F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC49AB second address: FC49CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E8C7DE64h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jng 00007F38E8C7DE5Ch 0x0000000f jbe 00007F38E8C7DE56h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC49CF second address: FC49DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F38E8DD2006h 0x0000000a jne 00007F38E8DD2006h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD151A second address: FD1537 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jne 00007F38E8C7DE56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 jp 00007F38E8C7DE56h 0x00000016 jbe 00007F38E8C7DE56h 0x0000001c pop edi 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6AE4 second address: FD6AE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6AE8 second address: FD6B02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F38E8C7DE56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c ja 00007F38E8C7DE5Eh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6B02 second address: FD6B07 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD55EE second address: FD55F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD55F2 second address: FD55F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD55F8 second address: FD55FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5E13 second address: FD5E22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5E22 second address: FD5E41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E8C7DE69h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5E41 second address: FD5E47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDA23E second address: FDA246 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDA246 second address: FDA24C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDA24C second address: FDA258 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDA258 second address: FDA25E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDA25E second address: FDA264 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF1B8A second address: FF1B90 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF1B90 second address: FF1B96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF3397 second address: FF33B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E8DD2014h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF33B4 second address: FF33D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E8C7DE65h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF5B1C second address: FF5B29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jnc 00007F38E8DD2006h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFC9C3 second address: FFC9C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFC9C9 second address: FFC9D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFC9D2 second address: FFC9E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F38E8C7DE60h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFC9E6 second address: FFCA07 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F38E8DD200Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007F38E8DD2008h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFCA07 second address: FFCA0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFBD6B second address: FFBD70 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFFCCA second address: FFFCD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004C1A second address: 1004C24 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F38E8DD200Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1007C23 second address: 1007C27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1009AD8 second address: 1009ADE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1009ADE second address: 1009AE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1009AE2 second address: 1009AF5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F38E8DD200Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1009AF5 second address: 1009AFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFF880 second address: FFF888 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFF888 second address: FFF88E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFF88E second address: FFF8B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 je 00007F38E8DD2029h 0x0000000c jmp 00007F38E8DD2017h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFFA03 second address: FFFA07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F29B8A second address: F29BA2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F38E8DD200Fh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F29D64 second address: F29D6E instructions: 0x00000000 rdtsc 0x00000002 jo 00007F38E8C7DE56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D6DC03 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F418A3 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D6DC4A instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 5620000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 58F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 78F0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F4C0D0 rdtsc

0_2_00F4C0D0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F0A23A sidt fword ptr [esp-02h]

0_2_00F0A23A

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 6928

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F5118D GetSystemInfo,VirtualAlloc,

0_2_00F5118D

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F4C0D0 rdtsc

0_2_00F4C0D0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F0B412 LdrInitializeThunk,

0_2_00F0B412

Source: C:\Users\user\Desktop\file.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00F4CB9A GetSystemTime,GetFileTime,

0_2_00F4CB9A

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\Desktop\file.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\Desktop\file.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Windows Service	1 Windows Service	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Service Execution	1 DLL Side-Loading	1 Process Injection	41 Disable or Modify Tools	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	271 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Bypass User Account Control	1 Process Injection	NTDS	271 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	24 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Bypass User Account Control	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.XPACK.Gen
file.exe	100%	Joe Sandbox ML

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538204
Start date and time:	2024-10-20 20:12:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@1/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): SIHClient.exe
Report size getting too big, too many NtProtectVirtualMemory calls found.
VT rate limit hit for: file.exe

Process:	C:\Users\user\Desktop\file.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.933055625784213
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'755'648 bytes
MD5:	fcea453f064a55fc3ae011ed4c822299
SHA1:	bf0240e1df04f0f6d8f346aff5f13709b6f18eb9
SHA256:	a732580d9bcc87ecf489b550648116143cfea9b36d165de1237ddb5968ae6c94
SHA512:	06739576901b9a54f006ee891fd7ed1c5ae62a2c6e2635aa24d61671ba021b929cd08efafe79b17a10f53afaabc57a5dd9d05f8ebc66ddce3229ca3a37561c2d
SSDEEP:	49152:Nhl2z7bwo1t06A9AHW85VlscG3BIsw7i7:/8vEQ5284BIsw7i7
TLSH:	898533F97D5B3936E846083288FADA8EDB2A5636C9F21C0980451611A773FB5D37B3C1
File Content Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............E.. ...`....@.. ....................... F......}....`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x85e000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE
Time Stamp:	0x652C2850 [Sun Oct 15 17:58:40 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F38E84F83FAh
push gs
sbb al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F38E84FA3F5h
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8055	0x69	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6000	0x59c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x81f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x2000	0x4000	0x1200	8c0cb0840120ce3ce666375a92f69531	False	0.9331597222222222	data	7.803903347541593	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x6000	0x59c	0x600	aae15e30898a02f09cc86ed48aa06b09	False	0.4140625	data	4.036947054771808	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x8000	0x2000	0x200	ec9cb51e8cb4ea49a56ee3cf434fb69e	False	0.1484375	data	0.9342685949460681	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0xa000	0x2aa000	0x200	46e994beec382bf3382a79efca2030fe	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
dqhhwlkv	0x2b4000	0x1a8000	0x1a6800	9e7ad078677e221cb3b543f113a69f08	False	0.9948120839497041	data	7.952845025246385	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ygqkenky	0x45c000	0x2000	0x400	9bb8013def4ece2a2847bb6873603e19	False	0.7568359375	data	6.103301834660699	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x45e000	0x4000	0x2200	3b472a4d749104c550d582fccaef6a10	False	0.06732536764705882	DOS executable (COM)	0.7503536708234921	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x6090	0x30c	data			0.42948717948717946
RT_MANIFEST	0x63ac	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
kernel32.dll	lstrcpy

Target ID:	0
Start time:	14:13:02
Start date:	20/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xd60000
File size:	1'755'648 bytes
MD5 hash:	FCEA453F064A55FC3AE011ED4C822299
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.7%
Dynamic/Decrypted Code Coverage:	4.2%
Signature Coverage:	4.7%
Total number of Nodes:	360
Total number of Limit Nodes:	19

Executed Functions

Function 00F5118D Relevance: 3.1, APIs: 2, Instructions: 107
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNELBASE(?,-11565FEC), ref: 00F51199
VirtualAlloc.KERNELBASE(00000000,00004000,00001000,00000004), ref: 00F511FA

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID: AllocInfoSystemVirtual
String ID:
API String ID: 3440192736-0
Opcode ID: d2698cf2cf3b57ead85935e7dfb672ebf127e2e6a3a6bf604404519cc8cf6a83
Instruction ID: 7ea796395cb86b427b4372a6f0553101e4d11314df3340c2d23ab1072e7d30fd
Opcode Fuzzy Hash: d2698cf2cf3b57ead85935e7dfb672ebf127e2e6a3a6bf604404519cc8cf6a83
Instruction Fuzzy Hash: D74113B1D40206AFE725DF65CC45FA6B7ACFB49711F004066A703DAC82E770A5D8CBA4

Function 056215D0 Relevance: 1.8, APIs: 1, Instructions: 299
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ChangeServiceConfigA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?), ref: 056218C8

Memory Dump Source

Source File: 00000000.00000002.1848131833.0000000005620000.00000040.00000800.00020000.00000000.sdmp, Offset: 05620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5620000_file.jbxd

Similarity

API ID: ChangeConfigService
String ID:
API String ID: 3849694230-0
Opcode ID: 3d6c02396ccba909c9b4c88b1999330795117d664f71d10644cd68629a85826a
Instruction ID: 2bfe1820e5ef1d88d0c0e0b5f236fe1a9a1d016efe0ee9d83de16a46cf632b64
Opcode Fuzzy Hash: 3d6c02396ccba909c9b4c88b1999330795117d664f71d10644cd68629a85826a
Instruction Fuzzy Hash: 61C13A71D04A699FDB10CFA9C8857AEBBB2FB4A310F148129EC55A7780D7749891CF82

Function 00F4A120 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,?,?), ref: 00F4A231
LoadLibraryExA.KERNELBASE(00000000,?,?), ref: 00F4A245

Strings

1002, xrefs: 00F4A1FB
.exe, xrefs: 00F4A18C
.dll, xrefs: 00F4A168

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID: LibraryLoad
String ID: .dll$.exe$1002
API String ID: 1029625771-847511843
Opcode ID: 89d25229a59b6a557c59d093878236600df86cf4d49c5d7561cccd6fb8ad56d6
Instruction ID: 69693f069f4ea9871d27e21f8e84a183d9d82ee474e66746f898f48dcb2bd928
Opcode Fuzzy Hash: 89d25229a59b6a557c59d093878236600df86cf4d49c5d7561cccd6fb8ad56d6
Instruction Fuzzy Hash: 24319432944149FFDB21AF20CC00AAD3F35FF58360F008126FD0286161DBB59AA0FB92

Function 00F4A626 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,00F4A5B8,?,00000000,00000000), ref: 00F4A6E3
GetModuleHandleA.KERNEL32(00000000,?,?,?,00F4A5B8,?,00000000,00000000), ref: 00F4A6F1

Strings

.dll, xrefs: 00F4A659

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID: HandleModule
String ID: .dll
API String ID: 4139908857-2738580789
Opcode ID: f7db79c8db00c14cc5ea3efd3e69171e570d181834ae2c5d2aca2ae460491967
Instruction ID: 786da16d3bd6471c3591f4743d0e467b368410b9ccad3abf6b7093908ebb0f59
Opcode Fuzzy Hash: f7db79c8db00c14cc5ea3efd3e69171e570d181834ae2c5d2aca2ae460491967
Instruction Fuzzy Hash: 8E117C3168250AFBDB309F24C8087A97EB0BF40391F094125BC12454A1DBF999E4FE83

Function 00F4CF80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(01651214,-11565FEC), ref: 00F4CFF9
GetFileAttributesA.KERNEL32(00000000,-11565FEC), ref: 00F4D007

Strings

@, xrefs: 00F4CFAC

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID: AttributesFile
String ID: @
API String ID: 3188754299-2726393805
Opcode ID: 6d59d7abf2d5a367ecf51a55d2ba4a17280d4041a733a1eedcdbc3e1efb0f735
Instruction ID: 48b2af5edb792d6dd1ed7d5155200a00ddd5c0f1d39437d4d92c8a7300a9c8cc
Opcode Fuzzy Hash: 6d59d7abf2d5a367ecf51a55d2ba4a17280d4041a733a1eedcdbc3e1efb0f735
Instruction Fuzzy Hash: 12018131604205FADF229F18DC0DB9DBE71AF40364F204125FD0266495CBB94A96F7A0

Function 00F02A3C Relevance: 4.6, APIs: 3, Instructions: 93
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 00F0307F
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 00F030A6
GetNativeSystemInfo.KERNELBASE(?), ref: 00F030FD

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID:
API String ID: 1247124224-0
Opcode ID: 7149cbae7cf8e978065e67822d50e169af8e2da32ec136bfdef78f87dca4edc4
Instruction ID: fed02b62e41ba28fa9b786b7143a5531fda249e2960c28c66abd9d8c96f9538e
Opcode Fuzzy Hash: 7149cbae7cf8e978065e67822d50e169af8e2da32ec136bfdef78f87dca4edc4
Instruction Fuzzy Hash: 5A410AB280810E9FEB15DF64C948BEE7BE4EF04310F50052AED8182980E7765DA4EF4A

Function 00F49000 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathAddExtensionA.KERNELBASE(?,00000000), ref: 00F49062

Strings

\\?\, xrefs: 00F490BD

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID: ExtensionPath
String ID: \\?\
API String ID: 158807944-4282027825
Opcode ID: 91a900db5d88a4d70a96ac321733c96fdef2a97a9df0508b8d98bf09174007c8
Instruction ID: 6029ff526fc6bd04b402261ec3c49cd0a94bd04c3eb9a9da6d023cc01b14f6da
Opcode Fuzzy Hash: 91a900db5d88a4d70a96ac321733c96fdef2a97a9df0508b8d98bf09174007c8
Instruction Fuzzy Hash: 6B311A31A0060AFFEF219F94CC09F9FBBB5BF58364F000055FA02A6160D7B29961EB50

Function 00F4A70F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F48A4D: GetCurrentThreadId.KERNEL32 ref: 00F48A5C
Part of subcall function 00F48A4D: Sleep.KERNELBASE(00000005,00050000,00000000), ref: 00F48A9F

GetModuleHandleExA.KERNELBASE(?,?,?), ref: 00F4A773

Strings

.dll, xrefs: 00F4A730

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID: CurrentHandleModuleSleepThread
String ID: .dll
API String ID: 683542999-2738580789
Opcode ID: ae01a7b8abcf6708afb92f516a6bfdbf6f1315b6f7719fb61e43c7f84861d3da
Instruction ID: 4f1f6edbcd2ab357cf74418fa3b42b0e25c78c5526ee9c83b0c67b691473eb95
Opcode Fuzzy Hash: ae01a7b8abcf6708afb92f516a6bfdbf6f1315b6f7719fb61e43c7f84861d3da
Instruction Fuzzy Hash: A3F06D72684205BFDF20AF68C949B9D3FB5BF14360F508011FE154A152DBB4C591BA22

Function 00F4D19C Relevance: 3.1, APIs: 2, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(01651214,?,?,-11565FEC,?,?,?,-11565FEC,?), ref: 00F4D24E

Part of subcall function 00F4D14E: IsBadWritePtr.KERNEL32(?,00000004), ref: 00F4D15C

CreateFileA.KERNEL32(?,?,?,-11565FEC,?,?,?,-11565FEC,?), ref: 00F4D26E

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID: CreateFile$Write
String ID:
API String ID: 1125675974-0
Opcode ID: 3199c68b3906f3b93208de616a5d62b5dc7df02b86ce542076469f17619236b9
Instruction ID: a6b7fec138769521005532e939530edf36f42af193737aa6e29f480b03d18a56
Opcode Fuzzy Hash: 3199c68b3906f3b93208de616a5d62b5dc7df02b86ce542076469f17619236b9
Instruction Fuzzy Hash: 6511077250414AFBEF229F94CD09BAD3F22BF49394F104115FD15540A5CBB9CAA1FB51

Function 00F4CB08 Relevance: 3.0, APIs: 2, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F48A4D: GetCurrentThreadId.KERNEL32 ref: 00F48A5C
Part of subcall function 00F48A4D: Sleep.KERNELBASE(00000005,00050000,00000000), ref: 00F48A9F

GetCurrentProcess.KERNEL32(-11565FEC), ref: 00F4CB15
DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00F4CB7B

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID: Current$DuplicateHandleProcessSleepThread
String ID:
API String ID: 2846201637-0
Opcode ID: 0a2d90d9ab446f9b9f584c4e73114574a35cbb3daafbdf3e4fa8217732bca6af
Instruction ID: 43954511550a788f1ff3765a3c5d691843eede9d0447314bfdb5295f9f55323f
Opcode Fuzzy Hash: 0a2d90d9ab446f9b9f584c4e73114574a35cbb3daafbdf3e4fa8217732bca6af
Instruction Fuzzy Hash: E2014B3260054AFBCF12AFA5DC05C9E3F75FF987A07004111FE5191010CB79D0A2BB66

Function 00F48A4D Relevance: 3.0, APIs: 2, Instructions: 33
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00F48A5C
Sleep.KERNELBASE(00000005,00050000,00000000), ref: 00F48A9F

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID: CurrentSleepThread
String ID:
API String ID: 1164918020-0
Opcode ID: df238f6c204e3715903d6afd4d4992a2777932cb65822e65c3c3110cf8fc6d21
Instruction ID: 168d32555ab95205c91ffdfaafcb6b64c1cb4aa847ec566cea86de153945bc89
Opcode Fuzzy Hash: df238f6c204e3715903d6afd4d4992a2777932cb65822e65c3c3110cf8fc6d21
Instruction Fuzzy Hash: B1F0BE71600146FFDB218F60C94876FBBB4FF41369F20003AEA0286650CBF8198BEA81

Function 056215C4 Relevance: 1.8, APIs: 1, Instructions: 302
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ChangeServiceConfigA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?), ref: 056218C8

Memory Dump Source

Source File: 00000000.00000002.1848131833.0000000005620000.00000040.00000800.00020000.00000000.sdmp, Offset: 05620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5620000_file.jbxd

Similarity

API ID: ChangeConfigService
String ID:
API String ID: 3849694230-0
Opcode ID: f872f68190217312d9c7a164003f01a926320638cdcac2178c803d6b15a07a42
Instruction ID: 073e3da7c40d93f475eab33cd2a785921297a76b45802451a2f68eebbd03af44
Opcode Fuzzy Hash: f872f68190217312d9c7a164003f01a926320638cdcac2178c803d6b15a07a42
Instruction Fuzzy Hash: 8CC12A71D04A699FDB10CFA8C8857AEBBB1FB4A310F148129EC55E7780D7749991CF82

Function 00F51BB9 Relevance: 1.6, APIs: 1, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56f193652036f428cba57cb6fb8a8978a78214ba309d17be6e1faef41f3b1fe3
Instruction ID: e43f1bd8f3debcb3f2c8d150c5e7c09298de9c72f63631d6a57472c767e35e6f
Opcode Fuzzy Hash: 56f193652036f428cba57cb6fb8a8978a78214ba309d17be6e1faef41f3b1fe3
Instruction Fuzzy Hash: C841B272D00209EFDB25CF55D948BAAB7B5FF44322F108055EE12AA541D3B1BCE8EB51

Function 00F4B187 Relevance: 1.6, APIs: 1, Instructions: 103
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000,00000010), ref: 00F4B23C

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: bb1c8ce5ffdad90db2260c48dc6c5b8084bcd31bd8a4482f72408af37eb10aef
Instruction ID: 4051be62f934b90fdfc211759e322e626315ddbc759d9eaf0dd26a0dcab417aa
Opcode Fuzzy Hash: bb1c8ce5ffdad90db2260c48dc6c5b8084bcd31bd8a4482f72408af37eb10aef
Instruction Fuzzy Hash: B131B271900205FFDB219F64CC45F9EBFB8FF44324F208169F915AA192CBB59A52EB10

Function 00F4A9A3 Relevance: 1.6, APIs: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000), ref: 00F4AA25

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: cd33108ea941284499ee8d7ef11c2cbd6d3e257251e89df5cc9dc7d3e1784095
Instruction ID: 77e368998e382217a9ff8d4e7000c13aacf87a036952e207155d00a2e5ef6929
Opcode Fuzzy Hash: cd33108ea941284499ee8d7ef11c2cbd6d3e257251e89df5cc9dc7d3e1784095
Instruction Fuzzy Hash: 96318171A40204FFEB209F64DC45F99BBB8FB04724F208269FA11AA1D1DBB5A542DB51

Function 00F51906 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNELBASE(?,?,0000028A,?,?), ref: 00F519B3

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: 18a863d4f1c50c9526a0447a1cf2112c99b1caa480a00224845f00f07a055f77
Instruction ID: 487f09afcb2aa083b01e0c0b7c41a1bf531c3e9dcd8237e077bf95f77ed35449
Opcode Fuzzy Hash: 18a863d4f1c50c9526a0447a1cf2112c99b1caa480a00224845f00f07a055f77
Instruction Fuzzy Hash: 5711B972E01229AFEB304654CCA9BEBF77CFF54722F2041A5EE4592041D774AD88DAA1

Function 05620D42 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 05620DCD

Memory Dump Source

Source File: 00000000.00000002.1848131833.0000000005620000.00000040.00000800.00020000.00000000.sdmp, Offset: 05620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5620000_file.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 818f9f307e80bc3f90c62a1dadfa0f964ff8e3504c7e1626bf89f194ebec06c9
Instruction ID: 8bcf0602dfcacd906514df02b6eb63cef7e0673f9339241e23202c98a447585b
Opcode Fuzzy Hash: 818f9f307e80bc3f90c62a1dadfa0f964ff8e3504c7e1626bf89f194ebec06c9
Instruction Fuzzy Hash: B32104B68016199FCB50CF99D885BDEFBF4FB88320F14852AE909AB345D774A540CFA4

Function 05620D48 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 05620DCD

Memory Dump Source

Source File: 00000000.00000002.1848131833.0000000005620000.00000040.00000800.00020000.00000000.sdmp, Offset: 05620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5620000_file.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 173b8a5e04462bb5131cfef4fa2b23ea773df45596079ef73b1b15addee26543
Instruction ID: 3a478538f4ca939e9d825bc81dfbfad6f8ce0e88f1a283afe55a096a1cd5ebce
Opcode Fuzzy Hash: 173b8a5e04462bb5131cfef4fa2b23ea773df45596079ef73b1b15addee26543
Instruction Fuzzy Hash: E72104B68016189FCB50CF99D884BDEFBB4FB88320F14851AD909AB245D734A540CFA4

Function 05621509 Relevance: 1.6, APIs: 1, Instructions: 54serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32(?,?,?), ref: 05621580

Memory Dump Source

Source File: 00000000.00000002.1848131833.0000000005620000.00000040.00000800.00020000.00000000.sdmp, Offset: 05620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5620000_file.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 9d72cfd81fe25d0167eadcbcb67924f70ac24ebbb6846dc3f0474fc3424ded8e
Instruction ID: 6574fca02094baeb3f455148660b448a20aa9b1b0e898bd833579c0ac7d50166
Opcode Fuzzy Hash: 9d72cfd81fe25d0167eadcbcb67924f70ac24ebbb6846dc3f0474fc3424ded8e
Instruction Fuzzy Hash: BA2114B6D00249CFCB10CF9AC584BDEFBF4AB48320F14842AE559B7250D378A684CFA5

Function 05621510 Relevance: 1.6, APIs: 1, Instructions: 54serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32(?,?,?), ref: 05621580

Memory Dump Source

Source File: 00000000.00000002.1848131833.0000000005620000.00000040.00000800.00020000.00000000.sdmp, Offset: 05620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5620000_file.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 70e1217a265d3b6b1665f82efae3dd6ac7b823b8464acf1ab48a458ca4ae1ae2
Instruction ID: ad0453a5008b24715df57949e3a83f4ebf75a2d93e82bf1cb9cf802221d0e821
Opcode Fuzzy Hash: 70e1217a265d3b6b1665f82efae3dd6ac7b823b8464acf1ab48a458ca4ae1ae2
Instruction Fuzzy Hash: 2E1114B1900249CFCB10CF9AC484BDEFBF4EB48320F108029E559A3250D378AA44CFA5

Function 00F4DCD4 Relevance: 1.6, APIs: 1, Instructions: 51fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F48A4D: GetCurrentThreadId.KERNEL32 ref: 00F48A5C
Part of subcall function 00F48A4D: Sleep.KERNELBASE(00000005,00050000,00000000), ref: 00F48A9F

MapViewOfFileEx.KERNELBASE(?,?,?,?,?,?,-11565FEC), ref: 00F4DD5B

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID: CurrentFileSleepThreadView
String ID:
API String ID: 2270672837-0
Opcode ID: 8d68edc1ce40ca80d79eb915888848ae8dcd88b55772408d1b9a5d0072d62bf7
Instruction ID: 3050714f15c46f47345164d8d8d350b88dc20e8bf101b3e16d0024151779a76e
Opcode Fuzzy Hash: 8d68edc1ce40ca80d79eb915888848ae8dcd88b55772408d1b9a5d0072d62bf7
Instruction Fuzzy Hash: 1011A27290054AFBCF12AFA4CC09E9E3E76BF59351B004451FE1156025DB7AC5B2FB61

Function 00F4DABC Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID: CurrentSleepThread
String ID:
API String ID: 1164918020-0
Opcode ID: 997cd666b9bfceef6bdb54ea5545bb4d440785b508c1eb62c9a995bbbdc3ef28
Instruction ID: 4b4bef2df2755cbe0bd1dd7183cfc77cfcbb0b4e2549ff109e7dfae6aca9e5e6
Opcode Fuzzy Hash: 997cd666b9bfceef6bdb54ea5545bb4d440785b508c1eb62c9a995bbbdc3ef28
Instruction Fuzzy Hash: 3F11093290010AFBCF12AFA4CC09E9E7FA6EF84394F114055FD1156162DBB9C562FB61

Function 05621301 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 05621367

Memory Dump Source

Source File: 00000000.00000002.1848131833.0000000005620000.00000040.00000800.00020000.00000000.sdmp, Offset: 05620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5620000_file.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 9bf818e4e2817c64eb563e87ad1eedeaeb8a9ab6031c860b7843a670e1789482
Instruction ID: 3760504141dcc4dd6f8570c88fd376ab9b2f8ab669ac93c601593e967c96b3ab
Opcode Fuzzy Hash: 9bf818e4e2817c64eb563e87ad1eedeaeb8a9ab6031c860b7843a670e1789482
Instruction Fuzzy Hash: 731155B1800349CFCB10CFAAC484BDEFBF4EB48320F24846AD558A7650C738A540CFA5

Function 05621308 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 05621367

Memory Dump Source

Source File: 00000000.00000002.1848131833.0000000005620000.00000040.00000800.00020000.00000000.sdmp, Offset: 05620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5620000_file.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 474fcbb0117491bca4df5547d14908f30396ca1eb5d1fd73fd0ecbaa89ce8422
Instruction ID: 327f3293701c26b45c56df0695a3fc6efe17719464e2e6198832da28f0128298
Opcode Fuzzy Hash: 474fcbb0117491bca4df5547d14908f30396ca1eb5d1fd73fd0ecbaa89ce8422
Instruction Fuzzy Hash: F51145B1800259CFDB10CFAAC445BDEFBF8EB48324F24842AD558A3650C778A984CFA5

Function 00F0243E Relevance: 1.5, APIs: 1, Instructions: 39libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 00F05F3C

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 60f40bbef136e96c8cf2c2dc0684bda0e85a5decb7bba83c31e560c8529dfe44
Instruction ID: 75d39336c25925d22b660b43bc7ae16531582e8ceb7cb344c99e7fecca3bc1ba
Opcode Fuzzy Hash: 60f40bbef136e96c8cf2c2dc0684bda0e85a5decb7bba83c31e560c8529dfe44
Instruction Fuzzy Hash: DD0182B691E310EFE3056F11CA4163EBBE4EF84B20F11882EEAC683640C6304C50BB87

Function 00F4D3A0 Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F48A4D: GetCurrentThreadId.KERNEL32 ref: 00F48A5C
Part of subcall function 00F48A4D: Sleep.KERNELBASE(00000005,00050000,00000000), ref: 00F48A9F

ReadFile.KERNELBASE(?,00000000,?,00000400,?,-11565FEC,?,?,00F4B0CF,?,?,00000400,?,00000000,?,00000000), ref: 00F4D40C

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID: CurrentFileReadSleepThread
String ID:
API String ID: 1253362762-0
Opcode ID: efdaba581ea70a5622276acbef5e39b87653d380e3bda8da496cb33c4cc85352
Instruction ID: f0410abf978094bff53ef467d27676d27e4beeaeccfff44479d578d920d7a2c6
Opcode Fuzzy Hash: efdaba581ea70a5622276acbef5e39b87653d380e3bda8da496cb33c4cc85352
Instruction Fuzzy Hash: 35F0C97250414AFBCF12AF98DC09D9E3F66EF94390F404021FE1149061DB7AD4A2FB61

Function 00F4A383 Relevance: 1.5, APIs: 1, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00F49B39,00F49B39), ref: 00F4A3CE

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 8ff3cbd964b39a221fbd3820d03f5495aa6cf504e9261328939355525376486a
Instruction ID: 36a968075e455f851b7fc714da45124328a2b84787ebdd30a11efbab884008b1
Opcode Fuzzy Hash: 8ff3cbd964b39a221fbd3820d03f5495aa6cf504e9261328939355525376486a
Instruction Fuzzy Hash: 64E01233684105FA9F527FB4CD0996E3E256E80390B409122BD1555061FFFAC952F763

Function 00F48C1E Relevance: 1.3, APIs: 1, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,?), ref: 00F48C82

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 3f750db4bbae5872a373e4cb13c00751262e0c02e658710547cbf428c9d7ad7f
Instruction ID: 373256855707a1c273832c5f0d38faccc7d34334a6896ca26378603e48de164f
Opcode Fuzzy Hash: 3f750db4bbae5872a373e4cb13c00751262e0c02e658710547cbf428c9d7ad7f
Instruction Fuzzy Hash: 7F01E836A00549FFDF119FA4CC08D9EBF76EF45380F0041A1EA05A4461EB328A62EB64

Function 00F51530 Relevance: 1.3, APIs: 1, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00001000,00001000,00000004,?,?,00F5152C,?,?,00F51232,?,?,00F51232,?,?,00F51232), ref: 00F51550

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b984c55a6e374b08ad8bd977bfac1b3e53eb10a0293ce4717282e9e0c158f595
Instruction ID: 3218131e21a7e78e4975fbbaad872ef29c63d790118c39837d1a6821effd1392
Opcode Fuzzy Hash: b984c55a6e374b08ad8bd977bfac1b3e53eb10a0293ce4717282e9e0c158f595
Instruction Fuzzy Hash: 74F081B1D44305EFDB248F04C904B59BFA4FF89763F158069F94A9B551E3B1A8C1DB90

Function 00F4B7A1 Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 00F48A4D: GetCurrentThreadId.KERNEL32 ref: 00F48A5C
Part of subcall function 00F48A4D: Sleep.KERNELBASE(00000005,00050000,00000000), ref: 00F48A9F

CloseHandle.KERNELBASE(00F4B164,-11565FEC,?,?,00F4B164,?), ref: 00F4B7DF

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID: CloseCurrentHandleSleepThread
String ID:
API String ID: 4003616898-0
Opcode ID: b0156b8542e98d8fc2ff293d300f62de4962a580d74221736f574946f514462b
Instruction ID: 587654d39b1f5c7e25f8054d291b6ad70bd5b7f22a18ae1860786842f2301ffe
Opcode Fuzzy Hash: b0156b8542e98d8fc2ff293d300f62de4962a580d74221736f574946f514462b
Instruction Fuzzy Hash: 68E04F62600045B6CE20BFB9CC49D8E3E69AFD03C0B404122FD1285452EFBCC093B271

Function 00F4A866 Relevance: 1.3, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,00F488EC,?,?), ref: 00F4A86C

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: c206690769b9fe1b77ffbec89ca956e80dc9def922c43642b3f5841b5ca9f2ba
Instruction ID: 4407b8f60e507e74e6f83cacce72cf565be2753f46f300e937f65ecaf9fcb794
Opcode Fuzzy Hash: c206690769b9fe1b77ffbec89ca956e80dc9def922c43642b3f5841b5ca9f2ba
Instruction Fuzzy Hash: BDB09231200508BBCB51BF61DC0684DBFB9BF21398B40C120F956440219BBAEAA2AB91

Non-executed Functions

Function 00EE71FC Relevance: 11.7, Strings: 8, Instructions: 1678COMMON

Download Yara Rule

Strings

&Jww, xrefs: 00EE7B76
WD/p, xrefs: 00EE7A52
]@T, xrefs: 00EE7C91
O*, xrefs: 00EE8511
?<(+, xrefs: 00EE7A7C
\F., xrefs: 00EE7FFF
T>7z, xrefs: 00EE7FF3
q)6S, xrefs: 00EE7EBA

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID:
String ID: &Jww$?<(+$O*$T>7z$WD/p$\F.$]@T$q)6S
API String ID: 0-3743717838
Opcode ID: 5401b315be32130cb86161b3bd0c53c0ca97fdd0823b7a279b3866d171a76947
Instruction ID: 7afef3938497d4174c78db99b41656bb3f455fdc88995ce599dc45207a572e85
Opcode Fuzzy Hash: 5401b315be32130cb86161b3bd0c53c0ca97fdd0823b7a279b3866d171a76947
Instruction Fuzzy Hash: 79B218F3A0C2109FE3046E2DEC8567ABBE9EF94720F1A493DEAC4C7744E63558058696

Function 00EDF486 Relevance: 10.9, Strings: 8, Instructions: 941COMMON

Download Yara Rule

Strings

})~?, xrefs: 00EDFFA4
%o~, xrefs: 00EDF856
;2o;, xrefs: 00EDFC59
wv, xrefs: 00EDFC83
!}, xrefs: 00EDFC64
6ABr, xrefs: 00EDFB7F
@;W, xrefs: 00EDFB05
m5-, xrefs: 00EDFFC8

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID:
String ID: @;W$!}$%o~$6ABr$;2o;$})~?$m5-$wv
API String ID: 0-4173041152
Opcode ID: 9b0ba44fbd539d75618af52505998c2e86ba77873d9bbe961c01cafa4d298d5c
Instruction ID: f0adf995988cc81c14761326be571f6f0ac757e1d555261ce33da241f90bf3d1
Opcode Fuzzy Hash: 9b0ba44fbd539d75618af52505998c2e86ba77873d9bbe961c01cafa4d298d5c
Instruction Fuzzy Hash: 1D52E5F36086009FE304AE2DDC8567AF7EAEFD4720F1A853DE6C4C7744EA3558058696

Function 00EE22FB Relevance: 10.4, Strings: 7, Instructions: 1642COMMON

Download Yara Rule

Strings

Z~m{, xrefs: 00EE292A
Au;7, xrefs: 00EE31B4
3w{, xrefs: 00EE2626
1x{, xrefs: 00EE2317
WB}w, xrefs: 00EE2CF5
A:{, xrefs: 00EE323F
fm~, xrefs: 00EE317C

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID:
String ID: 1x{$3w{$A:{$Au;7$WB}w$Z~m{$fm~
API String ID: 0-163905370
Opcode ID: 095d14d840c39a3bbe1ac5c685f4a17011d7fd2e2750273bac8c1b849c9d76de
Instruction ID: ccec41c60c628221a20dc2e6f9b8644cf8ebeebdd1d75cc5a15a2074c40496ba
Opcode Fuzzy Hash: 095d14d840c39a3bbe1ac5c685f4a17011d7fd2e2750273bac8c1b849c9d76de
Instruction Fuzzy Hash: D8B208F36082049FE704AE2DEC8567AF7E9EFD4720F1A893DEAC4C7744E63558058692

Function 00EEDD54 Relevance: 10.4, Strings: 7, Instructions: 1612COMMON

Download Yara Rule

Strings

oJ~, xrefs: 00EEEF26
qco, xrefs: 00EEE9FC
CA{?, xrefs: 00EEE34F
n~?6, xrefs: 00EEE7D4
cVn, xrefs: 00EEE3C1
&@ke, xrefs: 00EEDEBB
WKu, xrefs: 00EEDD70

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID:
String ID: &@ke$CA{?$WKu$cVn$n~?6$oJ~$qco
API String ID: 0-2874111487
Opcode ID: 87e180090779d73335f7681fbe60fe024a84f2b6dc3be0785b4d77a2b119c313
Instruction ID: 72fa02fb84149f416c776b46ab549c846cb2ee63f391adb0fd7046209f179353
Opcode Fuzzy Hash: 87e180090779d73335f7681fbe60fe024a84f2b6dc3be0785b4d77a2b119c313
Instruction Fuzzy Hash: 04B24CF360C2009FE308AE2DEC9567ABBE6EFD4320F16493DE6C5C7744EA3598418656

Function 00EDD061 Relevance: 9.1, Strings: 6, Instructions: 1637COMMON

Download Yara Rule

Strings

<L;, xrefs: 00EDD5FF
tG1w, xrefs: 00EDD235
|4y}, xrefs: 00EDD34D
\=[_, xrefs: 00EDE279
0[3{, xrefs: 00EDDD07
+>O, xrefs: 00EDD1FB

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID:
String ID: +>O$0[3{$<L;$\=[_$tG1w$|4y}
API String ID: 0-2179601017
Opcode ID: 55c1c339b553aae8913f0ef0665ed7c818f60d44219279513bc55bb0c768af28
Instruction ID: e877c4977efae94170a05af1748b8821fe1d39e72e0aec604259fb657817d98d
Opcode Fuzzy Hash: 55c1c339b553aae8913f0ef0665ed7c818f60d44219279513bc55bb0c768af28
Instruction Fuzzy Hash: D9B2F7F360C6009FE304AE2DEC8567AFBE9EF94720F1A893DE6C4C7744E63558058696

Function 00EDB644 Relevance: 9.1, Strings: 6, Instructions: 1562COMMON

Download Yara Rule

Strings

=k}, xrefs: 00EDB739
:M+G, xrefs: 00EDC5EE
1j_t, xrefs: 00EDC21C
MUS7, xrefs: 00EDB653
_EA_, xrefs: 00EDBF04
:M+G, xrefs: 00EDC653

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID:
String ID: 1j_t$:M+G$:M+G$=k}$MUS7$_EA_
API String ID: 0-2233019265
Opcode ID: e46bbe94fa9282a4ece90351559e8205c2a8f6fcc8fa02f5bc38d8edf1a9b865
Instruction ID: 1c0c8ee0d9540d7a36e986e702148ed3376feea29b405975648aafc6abf18abb
Opcode Fuzzy Hash: e46bbe94fa9282a4ece90351559e8205c2a8f6fcc8fa02f5bc38d8edf1a9b865
Instruction Fuzzy Hash: C8B2F5F350C200AFE304AE2DEC8567ABBE5EF94720F164A3DEAC4C7744EA3558458697

Function 00F4C0D0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00F48A4D: GetCurrentThreadId.KERNEL32 ref: 00F48A5C
Part of subcall function 00F48A4D: Sleep.KERNELBASE(00000005,00050000,00000000), ref: 00F48A9F

Part of subcall function 00F4D14E: IsBadWritePtr.KERNEL32(?,00000004), ref: 00F4D15C

wsprintfA.USER32 ref: 00F4C116
LoadImageA.USER32(?,?,?,?,?,?), ref: 00F4C1DA

Strings

%8x, xrefs: 00F4C1A4, 00F4C1D7
%8x, xrefs: 00F4C111, 00F4C114

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID: CurrentImageLoadSleepThreadWritewsprintf
String ID: %8x$%8x
API String ID: 2375920415-2046107164
Opcode ID: a6da89decfa005d7645c6f455af280ec94c132c85ddacc93dfb9efb685fda641
Instruction ID: 5c79e7ce13bf2cb7496f5963cbd90b2078238d28c272c6aabeb131a635957b25
Opcode Fuzzy Hash: a6da89decfa005d7645c6f455af280ec94c132c85ddacc93dfb9efb685fda641
Instruction Fuzzy Hash: B631E332A0010AFBCB11DF94DD49EEEBF79FF88710F108125FA11A6161D7759A61EBA0

Function 00EEA8A2 Relevance: 6.6, Strings: 4, Instructions: 1611COMMON

Download Yara Rule

Strings

,3[, xrefs: 00EEB489
R'}, xrefs: 00EEBACB
}0Xk, xrefs: 00EEAA5C
zy(, xrefs: 00EEAFB4

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID:
String ID: zy($,3[$R'}$}0Xk
API String ID: 0-439720767
Opcode ID: f2ecbc36d716a0bd54cc53ac832ec283ba8df5ce3f783d2bb3bffa85ac8e010c
Instruction ID: f4ace64fc89f3075d169c446ace11e6f912e5b904e90a60d848ba519667696c3
Opcode Fuzzy Hash: f2ecbc36d716a0bd54cc53ac832ec283ba8df5ce3f783d2bb3bffa85ac8e010c
Instruction Fuzzy Hash: CAB229F360C6009FE304AE2DDC8567ABBEAEFD4720F1A893DE6C4C7744E93558058696

Function 00EE932A Relevance: 6.2, Strings: 4, Instructions: 1160COMMON

Download Yara Rule

Strings

Txo, xrefs: 00EE9D67
V[, xrefs: 00EE976C
@sTk, xrefs: 00EE9903
?%ym, xrefs: 00EE998E

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID:
String ID: ?%ym$@sTk$Txo$V[
API String ID: 0-2557145317
Opcode ID: 989a0aa7cedc1a454b569d4900955fc23d68cd47f2cc43b3b0b9f90b39b1e0ec
Instruction ID: 575b6ea9c95a1cf2a3a986c45b5b903381c70b16f078a208c4533de1c535faaa
Opcode Fuzzy Hash: 989a0aa7cedc1a454b569d4900955fc23d68cd47f2cc43b3b0b9f90b39b1e0ec
Instruction Fuzzy Hash: ED82F6F36082009FE304AE2DEC8563AB7E6EFD4720F1A893DE5C5C7744EA3598458657

Function 00EE3D64 Relevance: 4.0, Strings: 2, Instructions: 1536COMMON

Download Yara Rule

Strings

Z=G, xrefs: 00EE4F84
obvo, xrefs: 00EE4269

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID:
String ID: Z=G$obvo
API String ID: 0-1828876327
Opcode ID: b52aa4f941d6eb548c67935117131777aa11baad5c51048abf7accd663d4a748
Instruction ID: c76534535a46d9785111a6945dfa4787dcb161a60075b4a6aa23e25398cdfcbd
Opcode Fuzzy Hash: b52aa4f941d6eb548c67935117131777aa11baad5c51048abf7accd663d4a748
Instruction Fuzzy Hash: FEA2E5F360C204AFE304AE29EC8166AFBE9EF94720F16893DE6C4C7744E63558458797

Function 00F4CB9A Relevance: 3.0, APIs: 2, Instructions: 43timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00F48A4D: GetCurrentThreadId.KERNEL32 ref: 00F48A5C
Part of subcall function 00F48A4D: Sleep.KERNELBASE(00000005,00050000,00000000), ref: 00F48A9F

GetSystemTime.KERNEL32(?,-11565FEC), ref: 00F4CBCF
GetFileTime.KERNEL32(?,?,?,?,-11565FEC), ref: 00F4CC12

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID: Time$CurrentFileSleepSystemThread
String ID:
API String ID: 3818558864-0
Opcode ID: 862dd3f5a3151331af7b0e0c62b593237e76198d68e396d63318d5322e8ec9eb
Instruction ID: 2ccad738c9bfe3cd92bd6820587e032020bc8097b25d54609bafa2af9ad8f76a
Opcode Fuzzy Hash: 862dd3f5a3151331af7b0e0c62b593237e76198d68e396d63318d5322e8ec9eb
Instruction Fuzzy Hash: BD01D632601086FBCF21AF6ADC0CD8E7F75EF85791B004126FA1589060CB7584A2FBA1

Function 00E2D3D4 Relevance: 2.7, Strings: 2, Instructions: 211COMMON

Download Yara Rule

Strings

h(&, xrefs: 00E2D42E
@f, xrefs: 00E2D575

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID:
String ID: @f$h(&
API String ID: 0-575990806
Opcode ID: 80fe66b6ba8efd4ca3027c9e41dc24af675587e04a5fc8a34a0a53857f0287a0
Instruction ID: 79f39f0d1c6ccd08b667efcc22d4824ad2529b8e664bb83f680391351e9001bf
Opcode Fuzzy Hash: 80fe66b6ba8efd4ca3027c9e41dc24af675587e04a5fc8a34a0a53857f0287a0
Instruction Fuzzy Hash: 1B514BF3E082109BE3406A6DECC47A7BAD9EB94330F2B4639DAD8D3780E9755C0582D5

Function 00F4DA58 Relevance: 1.5, APIs: 1, Instructions: 24encryptionCOMMON

Download Yara Rule

APIs

CryptVerifySignatureA.ADVAPI32(?,?,?,?,?,?), ref: 00F4DA9F

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID: CryptSignatureVerify
String ID:
API String ID: 1015439381-0
Opcode ID: e05cc52b13d0e9ccc2508fbf1f33667859fae5644068a9ed68acf495fef164d6
Instruction ID: 182263e816841804782a340476dd2a1c886a383b24de43c641114e67bb0d8fd6
Opcode Fuzzy Hash: e05cc52b13d0e9ccc2508fbf1f33667859fae5644068a9ed68acf495fef164d6
Instruction Fuzzy Hash: 28F0F232A0420AFFCF01CFA4C904A8C7FB2FF19305B10816AFD1596611C37A9AA1EF80

Function 00E0894E Relevance: 1.4, Strings: 1, Instructions: 166COMMON

Download Yara Rule

Strings

Vok, xrefs: 00E08AE7

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID:
String ID: Vok
API String ID: 0-1896081008
Opcode ID: e6f6cacd59fbea4b0257b5af5b82832eb5d9f030ed217770c3fde33008216bc3
Instruction ID: 096a1b1f5b1cdf62ff3f03bd2a7bc76abeae357793ae71b5a07f09148ef4fbe6
Opcode Fuzzy Hash: e6f6cacd59fbea4b0257b5af5b82832eb5d9f030ed217770c3fde33008216bc3
Instruction Fuzzy Hash: AF5143F3A082049FE7447E2DEC9977AB7E9EB90320F2A453DD7C4C3744EA3959048A46

Function 00DC3BF3 Relevance: 1.4, Strings: 1, Instructions: 151COMMON

Download Yara Rule

Strings

zbw, xrefs: 00DC3C7E

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID:
String ID: zbw
API String ID: 0-664631040
Opcode ID: 9806ff32de790edc8df6ad40e7ed4715376f979af1ee75020ebe78f43df93d0d
Instruction ID: 2d05ee919525224226eaab9b032d3f83ab7cecf31e991c6594b5e9a78651a966
Opcode Fuzzy Hash: 9806ff32de790edc8df6ad40e7ed4715376f979af1ee75020ebe78f43df93d0d
Instruction Fuzzy Hash: B84127F35086009FE7146E29EC8577AB7E5DFA4720F1B453DE6C1D7740E53998018687

Function 00ED7D14 Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

>oC, xrefs: 00ED7DFD

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID:
String ID: >oC
API String ID: 0-1765948138
Opcode ID: b1a8acb89ce1eba0583c7c926aa25729f796677c35075d56884ef52cff5f0dbd
Instruction ID: 6a65110b2100b5a805933e28813485edc42a812843c523aab2ab56bc1e56da37
Opcode Fuzzy Hash: b1a8acb89ce1eba0583c7c926aa25729f796677c35075d56884ef52cff5f0dbd
Instruction Fuzzy Hash: 0E4105F2A087189BE350AF29DC8433AF7D5EB94710F16863CDAC893784EA3959058686

Function 00ECB018 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23deeabc2a6e57dc16ca5173c381ed465d275f3cf0362d45f143068615f84773
Instruction ID: 01d43ec99415a1974391f4305f313586487db5e112c33bf602ec1b810d2d87cf
Opcode Fuzzy Hash: 23deeabc2a6e57dc16ca5173c381ed465d275f3cf0362d45f143068615f84773
Instruction Fuzzy Hash: 1C6108B7F146104FF3409D69DD8476AB696EBD4320F2B863DEEC8A7784D939980642C1

Function 00EBE825 Relevance: .2, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 293b0c0094f2a7b2c05e3f01373ffa3d469b5f741f8db598a7cf5f74afd5b8df
Instruction ID: 9540772f5542ce4b7c3ae419d3119bb4758cc89bb2433ee7f7a0415626191605
Opcode Fuzzy Hash: 293b0c0094f2a7b2c05e3f01373ffa3d469b5f741f8db598a7cf5f74afd5b8df
Instruction Fuzzy Hash: CF514AB3A082109BE3046A2DDC4576FF7E5EFD0730F16863DEAD493B88D93998058682

Function 00EAF642 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2723e3c265242709b0cf67cc7e8e8bca072afae78680211426642834412b26c9
Instruction ID: 9437cda8228b82b0014b467b9e924903c6d385f04c2e5a5100bc835c7210b68c
Opcode Fuzzy Hash: 2723e3c265242709b0cf67cc7e8e8bca072afae78680211426642834412b26c9
Instruction Fuzzy Hash: D04158F3E083085FE3046E79DC8577AB7D9EB64710F1A413DDB8583780F97A6905428A

Function 00E75E07 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd372a97c8576e10f28018bccce20f6163a03daf0276447871b226b17a98fb82
Instruction ID: 1e5568cf31694040dfea5538100d82f486b8f5b316b523f55c6ebaab4a50e6f5
Opcode Fuzzy Hash: fd372a97c8576e10f28018bccce20f6163a03daf0276447871b226b17a98fb82
Instruction Fuzzy Hash: 6F4106F7A085009FE3005E2EDD8177ABBD6EBE4720F2B853DD684C3744E93498468296

Function 00DB531D Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 733c158db382d50ae7eca5741244aa01cca904afcd76e26b4d12524933be4024
Instruction ID: e336d249e923f762850feca08c865c006c46e7d366af5d74c170ffa39f757129
Opcode Fuzzy Hash: 733c158db382d50ae7eca5741244aa01cca904afcd76e26b4d12524933be4024
Instruction Fuzzy Hash: 7841E4B3E142144BF348AD39CD0936AB792EB94320F2B863C8E99A37C4ED3D58164685

Function 00F16C5F Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e099a3efe441830a78cb5bf73b258c884a77316c15935db7fca298b442375d02
Instruction ID: ee7402debe161dad26bd59eb9bb3cbb94d490bba6067ea84bd97af8dabfe5da3
Opcode Fuzzy Hash: e099a3efe441830a78cb5bf73b258c884a77316c15935db7fca298b442375d02
Instruction Fuzzy Hash: 3B3170F251C3049FD309BE29DC46BBABBE5EB98310F16492DE3D583740E63594018A9B

Function 00F0B412 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 610bc74254fc981fb82f2efd6ab4a31910a8bb49ea6e1d272dd2326c5b52ad39
Instruction ID: a8645e01682dbd62dc657a96b4745352050a4a6fa0bb296981e25c0bb0a6a509
Opcode Fuzzy Hash: 610bc74254fc981fb82f2efd6ab4a31910a8bb49ea6e1d272dd2326c5b52ad39
Instruction Fuzzy Hash: 20E0C27F8CC990A7DA23DF901941778BB2C6F23B30F748465E546155C3A39A0B06B225

Function 00F0A23A Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d76f0988f3dd063dc42c6f4fa37e65a4810f662b57d8097b6fe6f055a8a61604
Instruction ID: 965a5e92fd5a897d2cf182f6f3805e4425e129495ee19709ec2b6ec914367490
Opcode Fuzzy Hash: d76f0988f3dd063dc42c6f4fa37e65a4810f662b57d8097b6fe6f055a8a61604
Instruction Fuzzy Hash: 5AE04F761082019EC700DF54C84599FFBF4FF19350F618445E484CB222C3354941DB2A

Function 00F4CCA1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNEL32(01651214,00004020,00000000,-11565FEC), ref: 00F4CD8E

Strings

@, xrefs: 00F4CCCD

Memory Dump Source

Source File: 00000000.00000002.1845827902.0000000000EFE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000000.00000002.1845729153.0000000000D60000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845766239.0000000000D62000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845800347.0000000000D66000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000000D6A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001004000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1845827902.0000000001014000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846142093.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846310814.00000000011BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1846442986.00000000011BE000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d60000_file.jbxd

Similarity

API ID: AttributesFile
String ID: @
API String ID: 3188754299-2726393805
Opcode ID: 74fb23b7a652a3bd719922525841038dba7446cd068cde18f8651e2b1f8f9fd2
Instruction ID: c75d059cd69da06a98ad864350e6cef239460926158ba90033556bec373e0460
Opcode Fuzzy Hash: 74fb23b7a652a3bd719922525841038dba7446cd068cde18f8651e2b1f8f9fd2
Instruction Fuzzy Hash: E231BD75A04305EFDB258F54CC44B9EBFB0FF04310F108529E96667650C3B9A6A0EB90

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: file.exePID: 6568, Parent PID: 2580

General

Chronological Activities

Disassembly

Analysis Process: file.exePID: 6568, Parent PID: 2580COMMON

Execution Graph

Graph

Windows Analysis Report
file.exe

Function 00F5118D Relevance: 3.1, APIs: 2, Instructions: 107
memoryCOMMON

Function 056215D0 Relevance: 1.8, APIs: 1, Instructions: 299
COMMON

Function 00F4A120 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83
libraryCOMMON

Function 00F4A626 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
COMMON

Function 00F4CF80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Function 00F02A3C Relevance: 4.6, APIs: 3, Instructions: 93
registryCOMMON

Function 00F49000 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90
COMMON

Function 00F4A70F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32
COMMON

Function 00F4D19C Relevance: 3.1, APIs: 2, Instructions: 57
fileCOMMON

Function 00F4CB08 Relevance: 3.0, APIs: 2, Instructions: 41
COMMON

Function 00F48A4D Relevance: 3.0, APIs: 2, Instructions: 33
sleepthreadCOMMON

Function 056215C4 Relevance: 1.8, APIs: 1, Instructions: 302
COMMON

Function 00F51BB9 Relevance: 1.6, APIs: 1, Instructions: 112
COMMON

Function 00F4B187 Relevance: 1.6, APIs: 1, Instructions: 103
fileCOMMON