Edit tour

Windows Analysis Report
SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe
Analysis ID:	1541000
MD5:	87120a274008ae4e720012b8aebb6d99
SHA1:	07b42de1e4942c5619809b340829f3aaebd06fcc
SHA256:	2abd41097ebc205adc449bf3c6fcdff6d5ec789f45c8b1d3af7587b93bfc1a19
Tags:	exeHealer
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

AI detected suspicious sample

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Hides threads from debuggers

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Enables debug privileges

Entry point lies outside standard sections

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe (PID: 5960 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe" MD5: 87120A274008AE4E720012B8AEBB6D99)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe

Code function: 0_2_01000CFE CryptVerifySignatureA,

0_2_01000CFE

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe, 00000000.00000002.2300536415.0000000000E22000.00000040.00000001.01000000.00000003.sdmp, SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe, 00000000.00000003.2164139962.0000000005430000.00000004.00001000.00020000.00000000.sdmp

System Summary

PE file contains section with special chars

Source: SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Static PE information: section name:
Source: SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Code function: 0_2_00FC24E6	0_2_00FC24E6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Code function: 0_2_00E35AC2	0_2_00E35AC2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Code function: 0_2_00E2DF03	0_2_00E2DF03

Source: SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe, 00000000.00000002.2302819137.0000000000E26000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe
Source: SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe, 00000000.00000002.2308039171.000000000173E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe
Source: SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Binary or memory string: OriginalFilenamedefOff.exe. vs SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe

Source: classification engine

Classification label: mal100.evad.winEXE@1/1@0/0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application
Source: SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	String found in binary or memory: \|RtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNeh

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Section loaded: sspicli.dll	Jump to behavior

Source: SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe

Static file information: File size 2746880 > 1048576

Source: SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe

Static PE information: Raw size of syiibscs is bigger than: 0x100000 < 0x298a00

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe

Unpacked PE file: 0.2.SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe.e20000.0.unpack :EW;.rsrc:W;.idata :W;syiibscs:EW;zrfnqins:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe

Static PE information: real checksum: 0x2a3429 should be: 0x29ff72

Source: SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Static PE information: section name:
Source: SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Static PE information: section name: .idata
Source: SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Static PE information: section name: syiibscs
Source: SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Static PE information: section name: zrfnqins
Source: SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Code function: 0_2_00FA31A0 push ebx; mov dword ptr [esp], 67EE4F9Ah	0_2_00FA3202
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Code function: 0_2_00FA31A0 push edi; mov dword ptr [esp], 1DCFA054h	0_2_00FA3273
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Code function: 0_2_00FA3379 push ebx; mov dword ptr [esp], eax	0_2_00FA33B2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Code function: 0_2_00FA3379 push esi; mov dword ptr [esp], 6BEAC5B3h	0_2_00FA33D8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Code function: 0_2_00FA3379 push ecx; mov dword ptr [esp], ebp	0_2_00FA33F6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Code function: 0_2_00FA3379 push edi; mov dword ptr [esp], eax	0_2_00FA3423
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Code function: 0_2_00E33CC8 push edx; mov dword ptr [esp], 7FFB3B96h	0_2_00E33CE4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Code function: 0_2_00E2EC66 push ecx; mov dword ptr [esp], 0FFE7A0Eh	0_2_00E2F555
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Code function: 0_2_00E310F7 push edi; mov dword ptr [esp], ecx	0_2_00E33000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Code function: 0_2_0104211F push ecx; mov dword ptr [esp], 056E18CDh	0_2_01042147
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Code function: 0_2_0104211F push ebx; mov dword ptr [esp], eax	0_2_0104216A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Code function: 0_2_00E330A0 push edx; mov dword ptr [esp], 0F5F1CA9h	0_2_00E330D6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Code function: 0_2_00E330A0 push 29ACF2BDh; mov dword ptr [esp], esi	0_2_00E330E7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Code function: 0_2_0101D146 push edi; mov dword ptr [esp], ecx	0_2_0101D15A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Code function: 0_2_00E320AA push edi; mov dword ptr [esp], eax	0_2_00E334B6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Code function: 0_2_00FAC0A9 push ebp; mov dword ptr [esp], esi	0_2_00FAC7C2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Code function: 0_2_00E2F0B5 push eax; mov dword ptr [esp], 6A4F65B7h	0_2_00E2F0B6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Code function: 0_2_00FA3091 push edx; mov dword ptr [esp], eax	0_2_00FA30A6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Code function: 0_2_00FA3091 push eax; mov dword ptr [esp], edx	0_2_00FA30AA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Code function: 0_2_00FA3091 push esi; mov dword ptr [esp], 5D45CCEDh	0_2_00FA30BD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Code function: 0_2_00FA3091 push 7A5ECAE0h; mov dword ptr [esp], ebx	0_2_00FA30F3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Code function: 0_2_00FA3091 push cs; mov dword ptr [esp], ebx	0_2_00FA3113
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Code function: 0_2_00FA3091 push 4F391A4Dh; mov dword ptr [esp], ecx	0_2_00FA317F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Code function: 0_2_00FA307A push edx; mov dword ptr [esp], eax	0_2_00FA30A6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Code function: 0_2_00FA307A push eax; mov dword ptr [esp], edx	0_2_00FA30AA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Code function: 0_2_00FA307A push esi; mov dword ptr [esp], 5D45CCEDh	0_2_00FA30BD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Code function: 0_2_00FA307A push 7A5ECAE0h; mov dword ptr [esp], ebx	0_2_00FA30F3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Code function: 0_2_00FA307A push 0EC97E00h; mov dword ptr [esp], ebx	0_2_00FA3113
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Code function: 0_2_00FA307A push 4F391A4Dh; mov dword ptr [esp], ecx	0_2_00FA317F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Code function: 0_2_00FB0079 push ecx; mov dword ptr [esp], 7CCAFDA7h	0_2_00FB0080
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Code function: 0_2_00FB006B push 1C134FE3h; mov dword ptr [esp], eax	0_2_00FB24B2

Source: SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe

Static PE information: section name: entropy: 7.792371938288574

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FA3043 second address: FA3047 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FA3047 second address: FA304B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FA304B second address: FA306C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F53348525B6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FA306C second address: FA3071 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FA31D8 second address: FA31EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jo 00007F53348525ACh 0x0000000b je 00007F53348525A6h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FA31EC second address: FA31F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F5335089F46h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FA3688 second address: FA36AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F53348525B7h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007F53348525A6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FA36AC second address: FA36B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FA37EE second address: FA3820 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53348525B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b jmp 00007F53348525ACh 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 push esi 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FA3963 second address: FA3969 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FA6D74 second address: FA6D78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FA6D78 second address: FA6D8A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a js 00007F5335089F48h 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FA6F43 second address: FA6F49 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FA6F49 second address: FA6F5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5335089F50h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: F9D3BE second address: F9D3C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: F9D3C2 second address: F9D3D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jo 00007F5335089F46h 0x0000000d jbe 00007F5335089F46h 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: F9D3D6 second address: F9D3E6 instructions: 0x00000000 rdtsc 0x00000002 je 00007F53348525A8h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FC457D second address: FC4581 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FC4703 second address: FC471B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jno 00007F53348525A6h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 jbe 00007F53348525A6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FC471B second address: FC4721 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FC4721 second address: FC4731 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F53348525A6h 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FC4731 second address: FC473D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jl 00007F5335089F46h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FC473D second address: FC4746 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FC4891 second address: FC48A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5335089F4Fh 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FC48A7 second address: FC48BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d jmp 00007F53348525ABh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FC48BF second address: FC48C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FC500F second address: FC5029 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F53348525A6h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007F53348525A8h 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FC5029 second address: FC502D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FC502D second address: FC5035 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FC5035 second address: FC503B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FC5550 second address: FC5591 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F53348525B1h 0x00000009 popad 0x0000000a jmp 00007F53348525B4h 0x0000000f popad 0x00000010 push esi 0x00000011 pushad 0x00000012 jmp 00007F53348525B0h 0x00000017 push edx 0x00000018 pop edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FC56C1 second address: FC56C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FC56C7 second address: FC56D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F53348525A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FC612A second address: FC6137 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F5335089F46h 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FC8445 second address: FC8450 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F53348525A6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FCC1CC second address: FCC1D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FCC24E second address: FCC259 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FCC259 second address: FCC25D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FCC25D second address: FCC2A5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push ebx 0x00000010 pushad 0x00000011 popad 0x00000012 pop ebx 0x00000013 popad 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 jp 00007F53348525BCh 0x0000001e jmp 00007F53348525B6h 0x00000023 mov eax, dword ptr [eax] 0x00000025 pushad 0x00000026 push esi 0x00000027 push eax 0x00000028 pop eax 0x00000029 pop esi 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F53348525ABh 0x00000031 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FCC2A5 second address: FCC2A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FCC2A9 second address: FCC2C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007F53348525ABh 0x00000013 push edx 0x00000014 pop edx 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD184F second address: FD1855 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD19C2 second address: FD19D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F53348525A6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD19D1 second address: FD19D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD1B3B second address: FD1B3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD20F5 second address: FD2100 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push edi 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD2100 second address: FD2130 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F53348525AFh 0x0000000d jmp 00007F53348525B9h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD2130 second address: FD213C instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5335089F4Eh 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD4388 second address: FD43CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53348525B1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a mov eax, dword ptr [eax] 0x0000000c push ecx 0x0000000d pushad 0x0000000e jmp 00007F53348525B8h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 pop ecx 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b push eax 0x0000001c push edx 0x0000001d jno 00007F53348525A8h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD46A6 second address: FD46AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD496B second address: FD496F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD496F second address: FD4989 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007F5335089F4Ch 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD50C6 second address: FD50DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F53348525B0h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD50DF second address: FD50E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD50E3 second address: FD50E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD50E7 second address: FD5134 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], ebx 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007F5335089F48h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 00000017h 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 mov esi, dword ptr [ebp+122D2C39h] 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d jmp 00007F5335089F59h 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD56AC second address: FD56C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53348525ADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD5C8A second address: FD5C8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD5C8F second address: FD5C95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD5C95 second address: FD5C99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD668E second address: FD6692 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD7792 second address: FD7796 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD6F3A second address: FD6F45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F53348525A6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD92E9 second address: FD92ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD92ED second address: FD92F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD92F3 second address: FD9313 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F5335089F46h 0x0000000e jmp 00007F5335089F52h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD9313 second address: FD935B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007F53348525AEh 0x0000000e ja 00007F53348525A6h 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F53348525B1h 0x0000001e je 00007F53348525BEh 0x00000024 ja 00007F53348525A6h 0x0000002a jmp 00007F53348525B2h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FDA2F3 second address: FDA2F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FDADDA second address: FDADDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FDADDE second address: FDADE3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FDADE3 second address: FDAE03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F53348525B2h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FDBB87 second address: FDBB8D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FDAE03 second address: FDAE07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FDBB8D second address: FDBBC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5335089F56h 0x00000008 jmp 00007F5335089F4Ch 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 jnl 00007F5335089F67h 0x00000017 push eax 0x00000018 push edx 0x00000019 push esi 0x0000001a pop esi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FDAE07 second address: FDAE11 instructions: 0x00000000 rdtsc 0x00000002 je 00007F53348525A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FDEF61 second address: FDEF65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FE04FD second address: FE051C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53348525B5h 0x00000007 jng 00007F53348525B9h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FE0AB5 second address: FE0AD7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov bx, 7040h 0x00000011 push 00000000h 0x00000013 mov bx, 1BB0h 0x00000017 push 00000000h 0x00000019 movsx edi, cx 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FE0AD7 second address: FE0ADC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FE3B03 second address: FE3B07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FE2C13 second address: FE2C17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FE3CBC second address: FE3CCA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007F5335089F46h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FE2C17 second address: FE2C34 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F53348525A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F53348525B1h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FE4C97 second address: FE4CA1 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F5335089F46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FE3CCA second address: FE3CCE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FE5B8A second address: FE5B9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5335089F50h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FE4CA1 second address: FE4CA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FE3D93 second address: FE3DAB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5335089F54h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FE3DAB second address: FE3DD6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53348525B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c push esi 0x0000000d pop esi 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 jp 00007F53348525A6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FE6B4D second address: FE6BCC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5335089F51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007F5335089F48h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 00000018h 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push ebp 0x0000002b call 00007F5335089F48h 0x00000030 pop ebp 0x00000031 mov dword ptr [esp+04h], ebp 0x00000035 add dword ptr [esp+04h], 00000015h 0x0000003d inc ebp 0x0000003e push ebp 0x0000003f ret 0x00000040 pop ebp 0x00000041 ret 0x00000042 mov dword ptr [ebp+122D2672h], ebx 0x00000048 jmp 00007F5335089F4Bh 0x0000004d push 00000000h 0x0000004f mov dword ptr [ebp+1245E6C3h], ebx 0x00000055 xchg eax, esi 0x00000056 js 00007F5335089F66h 0x0000005c push eax 0x0000005d push edx 0x0000005e jno 00007F5335089F46h 0x00000064 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FE8B35 second address: FE8B39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FE8B39 second address: FE8B5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5335089F57h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FE8B5A second address: FE8B5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FEA0CD second address: FEA0DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5335089F4Dh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FE93F4 second address: FE93FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FEB037 second address: FEB03B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FEB03B second address: FEB09B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jc 00007F53348525A6h 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push ecx 0x00000013 push edx 0x00000014 jl 00007F53348525A6h 0x0000001a pop edx 0x0000001b pop ecx 0x0000001c nop 0x0000001d mov edi, 58AD5508h 0x00000022 push 00000000h 0x00000024 add dword ptr [ebp+122D3348h], edi 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push edi 0x0000002f call 00007F53348525A8h 0x00000034 pop edi 0x00000035 mov dword ptr [esp+04h], edi 0x00000039 add dword ptr [esp+04h], 0000001Dh 0x00000041 inc edi 0x00000042 push edi 0x00000043 ret 0x00000044 pop edi 0x00000045 ret 0x00000046 mov di, 0E7Eh 0x0000004a xchg eax, esi 0x0000004b jng 00007F53348525B4h 0x00000051 push eax 0x00000052 push edx 0x00000053 push eax 0x00000054 push edx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FEB09B second address: FEB09F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FEB09F second address: FEB0AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FEB0AB second address: FEB0B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FEB0B0 second address: FEB0B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FEC15F second address: FEC163 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FED4E6 second address: FED502 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53348525B1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FED502 second address: FED506 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FED506 second address: FED50C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FED50C second address: FED516 instructions: 0x00000000 rdtsc 0x00000002 js 00007F5335089F4Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FEE414 second address: FEE41F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F53348525A6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FF0130 second address: FF014F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5335089F50h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnc 00007F5335089F48h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FF014F second address: FF0155 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FF0362 second address: FF0391 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5335089F55h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F5335089F4Fh 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FFA17E second address: FFA184 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FFA310 second address: FFA32E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jbe 00007F5335089F46h 0x0000000f je 00007F5335089F46h 0x00000015 popad 0x00000016 jns 00007F5335089F48h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FFA32E second address: FFA33A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F53348525A6h 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FFA33A second address: FFA364 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5335089F46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnl 00007F5335089F46h 0x00000012 jmp 00007F5335089F58h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1003FDF second address: 1003FE4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1003FE4 second address: 1004004 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jmp 00007F5335089F4Ah 0x0000000d jmp 00007F5335089F4Bh 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: F9B9F8 second address: F9BA25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F53348525ADh 0x00000009 jmp 00007F53348525AEh 0x0000000e popad 0x0000000f jmp 00007F53348525ADh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 100930A second address: 1009341 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jmp 00007F5335089F4Fh 0x0000000f mov eax, dword ptr [eax] 0x00000011 jnp 00007F5335089F52h 0x00000017 jmp 00007F5335089F4Ch 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 push esi 0x00000025 pop esi 0x00000026 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1009341 second address: 1009347 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1009347 second address: 100934C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1009477 second address: 1009481 instructions: 0x00000000 rdtsc 0x00000002 js 00007F53348525ACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1009481 second address: 10094A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edi 0x00000008 jno 00007F5335089F4Ch 0x0000000e pop edi 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10094A0 second address: 10094A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10094A4 second address: 10094A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10094A8 second address: 10094AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10094AE second address: 10094BD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10095A3 second address: 10095A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1011891 second address: 10118AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F5335089F54h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1011F0A second address: 1011F14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F53348525A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1011F14 second address: 1011F24 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5335089F46h 0x00000008 jne 00007F5335089F46h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1012464 second address: 1012468 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1012468 second address: 1012491 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pushad 0x0000000a popad 0x0000000b push edi 0x0000000c pop edi 0x0000000d popad 0x0000000e push esi 0x0000000f jmp 00007F5335089F4Fh 0x00000014 push esi 0x00000015 pop esi 0x00000016 pop esi 0x00000017 push eax 0x00000018 push edx 0x00000019 je 00007F5335089F46h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10125CF second address: 10125D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10125D3 second address: 10125EF instructions: 0x00000000 rdtsc 0x00000002 je 00007F5335089F46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F5335089F52h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10125EF second address: 10125FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F53348525A6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10125FB second address: 10125FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1017433 second address: 101743A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 101743A second address: 101743F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10175EB second address: 10175F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FBCFFE second address: FBD005 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1017B54 second address: 1017B6D instructions: 0x00000000 rdtsc 0x00000002 jng 00007F53348525A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jne 00007F53348525A8h 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pushad 0x00000013 push edi 0x00000014 pop edi 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1017B6D second address: 1017BC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007F5335089F5Fh 0x0000000e jmp 00007F5335089F53h 0x00000013 je 00007F5335089F46h 0x00000019 ja 00007F5335089F6Ch 0x0000001f jmp 00007F5335089F54h 0x00000024 jmp 00007F5335089F52h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 101BF8A second address: 101BF9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F53348525ACh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 101C275 second address: 101C27F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push esi 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 101CEFF second address: 101CF14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F53348525ABh 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 101CF14 second address: 101CF18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD2B4E second address: FD2BA0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b call 00007F53348525B5h 0x00000010 jne 00007F53348525BBh 0x00000016 pop ecx 0x00000017 lea eax, dword ptr [ebp+124788A3h] 0x0000001d movzx ecx, bx 0x00000020 nop 0x00000021 pushad 0x00000022 jnp 00007F53348525A8h 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD2BA0 second address: FD2BA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD2BA6 second address: FD2BB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD2BB1 second address: FBC4C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F5335089F50h 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007F5335089F48h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 mov cx, 9064h 0x0000002a call dword ptr [ebp+12455E61h] 0x00000030 jnp 00007F5335089F62h 0x00000036 pushad 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD3278 second address: FD327C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD327C second address: FD32DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 xor dword ptr [esp], 2F8038CFh 0x0000000d add cx, 050Ch 0x00000012 mov di, ax 0x00000015 call 00007F5335089F49h 0x0000001a jno 00007F5335089F54h 0x00000020 push eax 0x00000021 push ebx 0x00000022 jnp 00007F5335089F48h 0x00000028 pushad 0x00000029 popad 0x0000002a pop ebx 0x0000002b mov eax, dword ptr [esp+04h] 0x0000002f jmp 00007F5335089F4Fh 0x00000034 mov eax, dword ptr [eax] 0x00000036 pushad 0x00000037 jne 00007F5335089F48h 0x0000003d push eax 0x0000003e push edx 0x0000003f jo 00007F5335089F46h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD32DF second address: FD32FF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F53348525B3h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD32FF second address: FD3315 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5335089F52h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD33C8 second address: FD33CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD33CC second address: FD33D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD35B1 second address: FD35E3 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F53348525B4h 0x00000008 jmp 00007F53348525AEh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov eax, dword ptr [eax] 0x00000011 jmp 00007F53348525AFh 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD35E3 second address: FD35EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD3CB9 second address: FD3CCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 jp 00007F53348525B4h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD3CCB second address: FD3CD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD4009 second address: FD4014 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F53348525A6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD4014 second address: FD4020 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD4020 second address: FD4062 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ebx 0x0000000a call 00007F53348525A8h 0x0000000f pop ebx 0x00000010 mov dword ptr [esp+04h], ebx 0x00000014 add dword ptr [esp+04h], 00000015h 0x0000001c inc ebx 0x0000001d push ebx 0x0000001e ret 0x0000001f pop ebx 0x00000020 ret 0x00000021 mov dword ptr [ebp+1244DE51h], ecx 0x00000027 mov edx, dword ptr [ebp+122D2F49h] 0x0000002d lea eax, dword ptr [ebp+124788A3h] 0x00000033 mov dword ptr [ebp+1244DE51h], edi 0x00000039 push eax 0x0000003a push esi 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD4062 second address: FBCFFE instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5335089F46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007F5335089F48h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 0000001Dh 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 call dword ptr [ebp+122D348Fh] 0x0000002e push eax 0x0000002f push edx 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1024701 second address: 1024725 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 jmp 00007F53348525B9h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1024725 second address: 102472B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 102472B second address: 102472F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 102472F second address: 1024735 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10248C9 second address: 10248DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F53348525ACh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10248DA second address: 1024902 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F5335089F46h 0x00000009 jmp 00007F5335089F56h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1024902 second address: 102490A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 102490A second address: 1024920 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5335089F4Dh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1024A9D second address: 1024AA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1024AA1 second address: 1024AD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F5335089F58h 0x0000000c push esi 0x0000000d pop esi 0x0000000e jmp 00007F5335089F4Bh 0x00000013 popad 0x00000014 pushad 0x00000015 jng 00007F5335089F46h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1024C0A second address: 1024C67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F53348525B7h 0x00000009 pop eax 0x0000000a pop esi 0x0000000b pushad 0x0000000c pushad 0x0000000d jmp 00007F53348525B5h 0x00000012 jmp 00007F53348525ADh 0x00000017 jmp 00007F53348525B2h 0x0000001c popad 0x0000001d pushad 0x0000001e jng 00007F53348525A6h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10250D7 second address: 10250EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5335089F54h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10250EF second address: 1025105 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53348525AFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1028BB2 second address: 1028BB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1028BB6 second address: 1028BD3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53348525B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1028BD3 second address: 1028C02 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F5335089F52h 0x00000008 jns 00007F5335089F46h 0x0000000e pop edi 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 push edx 0x00000013 pop edx 0x00000014 pop edx 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push esi 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b pop eax 0x0000001c jo 00007F5335089F46h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 102AF63 second address: 102AF6D instructions: 0x00000000 rdtsc 0x00000002 jp 00007F53348525A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 102AF6D second address: 102AF7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007F5335089F46h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 102AF7D second address: 102AF81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 102AF81 second address: 102AF85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 102AF85 second address: 102AF8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 102AF8B second address: 102AF90 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 102AABB second address: 102AAC5 instructions: 0x00000000 rdtsc 0x00000002 je 00007F53348525B2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 102AAC5 second address: 102AACB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 102AC28 second address: 102AC44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F53348525B1h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 102AC44 second address: 102AC4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 102AC4A second address: 102AC7B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53348525ADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jg 00007F53348525A6h 0x00000010 jmp 00007F53348525AEh 0x00000015 popad 0x00000016 popad 0x00000017 push ecx 0x00000018 jnp 00007F53348525ACh 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 102ED31 second address: 102ED37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1032C8D second address: 1032C93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1032365 second address: 103236B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 103293B second address: 1032949 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jg 00007F53348525A6h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1038039 second address: 1038041 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1038041 second address: 103806A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F53348525A6h 0x0000000a popad 0x0000000b jmp 00007F53348525ABh 0x00000010 pop esi 0x00000011 push eax 0x00000012 jl 00007F53348525AEh 0x00000018 js 00007F53348525A6h 0x0000001e pushad 0x0000001f popad 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1036914 second address: 103691A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1036A97 second address: 1036A9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1036A9D second address: 1036ABC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F5335089F58h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1036ABC second address: 1036AED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jmp 00007F53348525AAh 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jnp 00007F53348525A6h 0x00000017 jmp 00007F53348525B5h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1036F34 second address: 1036F38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD3A81 second address: FD3A87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD3A87 second address: FD3A9D instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5335089F46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d js 00007F5335089F4Eh 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD3A9D second address: FD3AE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 nop 0x00000006 sbb cx, 509Eh 0x0000000b push 00000004h 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007F53348525A8h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 00000018h 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 push eax 0x00000028 pushad 0x00000029 jmp 00007F53348525B7h 0x0000002e pushad 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 103C7F3 second address: 103C80D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F5335089F46h 0x0000000a jmp 00007F5335089F50h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 103C80D second address: 103C812 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 103C812 second address: 103C818 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 103BB98 second address: 103BBB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F53348525B0h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 103BF6E second address: 103BF8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F5335089F55h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 103BF8E second address: 103BFA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F53348525B5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 103C134 second address: 103C142 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 js 00007F5335089F46h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 103C142 second address: 103C147 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1042CD6 second address: 1042CE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F5335089F46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1042CE0 second address: 1042CF2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53348525AEh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1042CF2 second address: 1042CFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1042CFB second address: 1042D02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1042D02 second address: 1042D07 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1042FE6 second address: 1042FED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1042FED second address: 1043001 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F5335089F48h 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e jp 00007F5335089F46h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1043320 second address: 1043326 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1043326 second address: 104332B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 104332B second address: 1043347 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F53348525B7h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1043347 second address: 1043356 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 je 00007F5335089F52h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1043356 second address: 104335C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 104361F second address: 1043629 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F5335089F4Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 104BE84 second address: 104BE95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F53348525A6h 0x0000000a pop eax 0x0000000b pop ecx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 104BE95 second address: 104BE9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 104BE9B second address: 104BE9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 104B03F second address: 104B053 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push edi 0x00000006 pop edi 0x00000007 push edi 0x00000008 pop edi 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007F5335089F46h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 104B053 second address: 104B057 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 104B1B7 second address: 104B1BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 104B779 second address: 104B77D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 104B77D second address: 104B798 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F5335089F46h 0x00000008 jnp 00007F5335089F46h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 jg 00007F5335089F48h 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 104B798 second address: 104B7A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jbe 00007F53348525A6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 104B7A4 second address: 104B7A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 104BA77 second address: 104BA83 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1053161 second address: 1053166 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1051910 second address: 1051925 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53348525B1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1051925 second address: 1051940 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5335089F57h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1051AA0 second address: 1051AA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1051D8E second address: 1051D94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1051D94 second address: 1051DB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F53348525ABh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 je 00007F53348525A6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1051DB4 second address: 1051DB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1051DB8 second address: 1051DC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1051DC2 second address: 1051DC8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1051DC8 second address: 1051DD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1051F2A second address: 1051F30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1051F30 second address: 1051F3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F53348525A6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1051F3B second address: 1051F66 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 js 00007F5335089F46h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 jc 00007F5335089F46h 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F5335089F50h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1051F66 second address: 1051F6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1051F6A second address: 1051F73 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1051F73 second address: 1051F83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jp 00007F53348525A6h 0x0000000c popad 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10520C0 second address: 10520C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10520C9 second address: 10520D4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push edx 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10526EC second address: 10526F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10526F2 second address: 1052713 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F53348525B2h 0x0000000e ja 00007F53348525A6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1052713 second address: 105271D instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5335089F46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 105271D second address: 1052729 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 je 00007F53348525A6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1052F80 second address: 1052F8A instructions: 0x00000000 rdtsc 0x00000002 jg 00007F5335089F46h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1050E99 second address: 1050EAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F53348525B0h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1050EAF second address: 1050EC8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5335089F4Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1059289 second address: 105928E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 105928E second address: 1059294 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1059294 second address: 10592A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F53348525ADh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 106E041 second address: 106E047 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 106E047 second address: 106E05C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53348525ABh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 106E05C second address: 106E062 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 106E062 second address: 106E070 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F53348525AAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: F9840C second address: F98438 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5335089F4Dh 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jns 00007F5335089F55h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 106DC51 second address: 106DC55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 106DC55 second address: 106DC59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 106DD87 second address: 106DDB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F53348525A6h 0x0000000a jmp 00007F53348525B6h 0x0000000f push edx 0x00000010 pop edx 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jns 00007F53348525A6h 0x0000001a ja 00007F53348525A6h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 106DDB8 second address: 106DDBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1072331 second address: 1072335 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1072335 second address: 107233E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 107A7AA second address: 107A7B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 107A7B0 second address: 107A7C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F5335089F4Bh 0x00000008 pop eax 0x00000009 jns 00007F5335089F4Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 107CD15 second address: 107CD1A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 107CD1A second address: 107CD22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1081890 second address: 1081894 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1081894 second address: 10818A2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jne 00007F5335089F46h 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10818A2 second address: 10818D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53348525B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pushad 0x0000000d popad 0x0000000e pop edi 0x0000000f jmp 00007F53348525ABh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10818D0 second address: 10818D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1081D35 second address: 1081D3B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1081D3B second address: 1081D4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5335089F4Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1081D4A second address: 1081D4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1081EA2 second address: 1081EBE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5335089F4Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d je 00007F5335089F46h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 108215C second address: 1082166 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1082166 second address: 108216A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 108216A second address: 108218A instructions: 0x00000000 rdtsc 0x00000002 jc 00007F53348525A6h 0x00000008 jmp 00007F53348525B6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1082B7B second address: 1082B7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1082B7F second address: 1082BA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F53348525B6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 1087451 second address: 108746E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5335089F59h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 108746E second address: 1087477 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 108E538 second address: 108E552 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5335089F46h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F5335089F4Bh 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10A2942 second address: 10A295B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F53348525B4h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10AA7DD second address: 10AA7E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10AA931 second address: 10AA94F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F53348525B9h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10AAC47 second address: 10AAC72 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5335089F57h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a ja 00007F5335089F46h 0x00000010 jc 00007F5335089F46h 0x00000016 push edx 0x00000017 pop edx 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10AAE22 second address: 10AAE28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10AAE28 second address: 10AAE34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F5335089F46h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10AAF66 second address: 10AAF83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F53348525B9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10AE06A second address: 10AE070 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10AE070 second address: 10AE074 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10AE074 second address: 10AE080 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push esi 0x0000000a pop esi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10AE080 second address: 10AE086 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10AE086 second address: 10AE08A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10AE08A second address: 10AE0B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F53348525AFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F53348525B3h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10AE0B2 second address: 10AE0C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ecx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e pop ecx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10AFF19 second address: 10AFF34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 jmp 00007F53348525B4h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10AFF34 second address: 10AFF3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10AFD7C second address: 10AFDA0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F53348525AAh 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F53348525B0h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10B6384 second address: 10B638A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10B7BC0 second address: 10B7BED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F53348525B8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 jnc 00007F53348525A6h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10B7BED second address: 10B7BF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F5335089F46h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10B997D second address: 10B9987 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F53348525A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10B9987 second address: 10B99A6 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5335089F46h 0x00000008 jmp 00007F5335089F55h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10B0E92 second address: 10B0EA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F53348525A6h 0x0000000a push eax 0x0000000b push edx 0x0000000c jnc 00007F53348525A6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10B0EA4 second address: 10B0EB1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10B0EB1 second address: 10B0ED2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F53348525B0h 0x00000009 popad 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007F53348525A6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10B0ED2 second address: 10B0ED6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: 10B0D1E second address: 10B0D22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	RDTSC instruction interceptor: First address: FD71E3 second address: FD71E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Special instruction interceptor: First address: FCC132 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Special instruction interceptor: First address: FF356D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Special instruction interceptor: First address: E2DDED instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Special instruction interceptor: First address: FD2D82 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Special instruction interceptor: First address: 1061869 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Special instruction interceptor: First address: E34B37 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Memory allocated: 5710000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Memory allocated: 5780000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Memory allocated: 7780000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe

Code function: 0_2_00FA31A0 rdtsc

0_2_00FA31A0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe TID: 64

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe

Code function: 0_2_010058E0 GetSystemInfo,VirtualAlloc,

0_2_010058E0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe, SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe, 00000000.00000002.2306068755.0000000000FAB000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe, 00000000.00000002.2306068755.0000000000FAB000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	File opened: NTICE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	File opened: SICE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe

Code function: 0_2_00FA31A0 rdtsc

0_2_00FA31A0

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe

Code function: 0_2_00E2B9D4 LdrInitializeThunk,LdrInitializeThunk,

0_2_00E2B9D4

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe, 00000000.00000002.2307101817.0000000000FF2000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: lProgram Manager

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	641 Security Software Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	41 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Bypass User Account Control	261 Virtualization/Sandbox Evasion	Security Account Manager	261 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	23 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Bypass User Account Control	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe	100%	Joe Sandbox ML

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541000
Start date and time:	2024-10-24 10:27:22 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	3
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@1/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, otelrules.azureedge.net
Report size getting too big, too many NtProtectVirtualMemory calls found.
VT rate limit hit for: SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.484552462361751
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe
File size:	2'746'880 bytes
MD5:	87120a274008ae4e720012b8aebb6d99
SHA1:	07b42de1e4942c5619809b340829f3aaebd06fcc
SHA256:	2abd41097ebc205adc449bf3c6fcdff6d5ec789f45c8b1d3af7587b93bfc1a19
SHA512:	40472418fc03359f96830c372f38822a7b798d9099ab9c5591043e83ea2b64921953bed16e9e7b5a68bc5ec6cbad103de6af775c7f6620f95635ab97fd9f7627
SSDEEP:	49152:mtBb2lvNFgDJJOk22Hhdvyw0vyfSbP4fcg8hs7uUkUDRoiqbLGq:mtglvNFgDJJOk22Hh5yw0v6RcgWs76jV
TLSH:	B0D55BA2780AB2CFC48E1B749527CDA2D95D83F5471448C3A92CB47ABE77CC519B7C28
File Content Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........`.. ...`....@.. .............................)4*...`................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x6a6000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE
Time Stamp:	0x652C2850 [Sun Oct 15 17:58:40 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F53346D44AAh
bswap eax
sub dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F53346D64A5h
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00h], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax*4], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8055	0x69	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6000	0x59c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x81f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x2000	0x4000	0x1200	02f6c0a4a8e6205cf51eab78a9268843	False	0.9325086805555556	data	7.792371938288574	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x6000	0x59c	0x600	aae15e30898a02f09cc86ed48aa06b09	False	0.4140625	data	4.036947054771808	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x8000	0x2000	0x200	ec9cb51e8cb4ea49a56ee3cf434fb69e	False	0.1484375	data	0.9342685949460681	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
syiibscs	0xa000	0x29a000	0x298a00	4ce6cc95747846438cb67806c9b6b6d4	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
zrfnqins	0x2a4000	0x2000	0x400	69adc0fdfa4b8e8f40c0cfc4927cb145	False	0.80078125	data	6.2702929471565945	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x2a6000	0x4000	0x2200	05452c33db36ee7b6364b8a4c44a5496	False	0.0642233455882353	DOS executable (COM)	0.7306647652897766	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x6090	0x30c	data			0.42948717948717946
RT_MANIFEST	0x63ac	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
kernel32.dll	lstrcpy

Target ID:	0
Start time:	04:28:18
Start date:	24/10/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe"
Imagebase:	0xe20000
File size:	2'746'880 bytes
MD5 hash:	87120A274008AE4E720012B8AEBB6D99
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.4%
Dynamic/Decrypted Code Coverage:	6.5%
Signature Coverage:	11.5%
Total number of Nodes:	139
Total number of Limit Nodes:	15

Executed Functions

Function 010058E0 Relevance: 3.1, APIs: 2, Instructions: 107
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNELBASE(?,-114A5FEC), ref: 010058EC
VirtualAlloc.KERNELBASE(00000000,00004000,00001000,00000004), ref: 0100594D

Memory Dump Source

Source File: 00000000.00000002.2307292964.0000000001005000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.2300389386.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300536415.0000000000E22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2302819137.0000000000E26000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2303415004.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2303605379.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2305996449.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306015494.0000000000F90000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306036265.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306051305.0000000000FA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306068755.0000000000FA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306068755.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306106414.0000000000FB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306162274.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306184915.0000000000FC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306233995.0000000000FC7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306261924.0000000000FD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306318419.0000000000FD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306547851.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307027190.0000000000FE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307081794.0000000000FE9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307101817.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307118930.0000000000FFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307163466.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307209214.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307353891.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307381368.0000000001018000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307396020.0000000001019000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307440783.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307488152.000000000102E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307544846.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307586792.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307629091.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307647964.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307665177.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307680872.0000000001049000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307696986.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307712487.000000000104D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307730986.0000000001055000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307750415.0000000001065000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307766512.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307800281.00000000010AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307816276.00000000010AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307866223.00000000010C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307882780.00000000010C6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_SecuriteInfo.jbxd

Similarity

API ID: AllocInfoSystemVirtual
String ID:
API String ID: 3440192736-0
Opcode ID: 90731494cf37e4f341f5ef554a2799b7f7f3807f740bc556336a96506646d84f
Instruction ID: 6aed69c6fd74bddd927b3834265a737fdedc468a5a6994c5b419f85ed3210352
Opcode Fuzzy Hash: 90731494cf37e4f341f5ef554a2799b7f7f3807f740bc556336a96506646d84f
Instruction Fuzzy Hash: 9C4156B2940206ADF366CFA0CC45F9A7BACFB59740F0009A6A243CE4C2F77095D48FA0

Function 00FA31A0 Relevance: 1.6, APIs: 1, Instructions: 150
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00FA31A0

Memory Dump Source

Source File: 00000000.00000002.2306051305.0000000000FA3000.00000080.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.2300389386.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300536415.0000000000E22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2302819137.0000000000E26000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2303415004.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2303605379.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2305996449.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306015494.0000000000F90000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306036265.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306068755.0000000000FA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306068755.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306106414.0000000000FB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306162274.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306184915.0000000000FC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306233995.0000000000FC7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306261924.0000000000FD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306318419.0000000000FD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306547851.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307027190.0000000000FE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307081794.0000000000FE9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307101817.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307118930.0000000000FFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307163466.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307209214.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307292964.0000000001005000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307353891.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307381368.0000000001018000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307396020.0000000001019000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307440783.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307488152.000000000102E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307544846.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307586792.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307629091.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307647964.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307665177.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307680872.0000000001049000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307696986.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307712487.000000000104D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307730986.0000000001055000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307750415.0000000001065000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307766512.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307800281.00000000010AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307816276.00000000010AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307866223.00000000010C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307882780.00000000010C6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_SecuriteInfo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: edcaaaa13cff229fad8976f53564a33edefcb4302f7d078b900bf4c8317f5523
Instruction ID: 43ba1b986ef3591fefacf6fcfd8ee6693517018b4d34837d157e18d7d5ac86c0
Opcode Fuzzy Hash: edcaaaa13cff229fad8976f53564a33edefcb4302f7d078b900bf4c8317f5523
Instruction Fuzzy Hash: 84414AF690C200AFE301AF19D9426BEFBF8FF95721F22482EE2C582610D77545449BA7

Function 01000226 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(017716AC,-114A5FEC), ref: 0100029F
GetFileAttributesA.KERNEL32(00000000,-114A5FEC), ref: 010002AD

Strings

@, xrefs: 01000252

Memory Dump Source

Source File: 00000000.00000002.2307118930.0000000000FFF000.00000080.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.2300389386.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300536415.0000000000E22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2302819137.0000000000E26000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2303415004.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2303605379.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2305996449.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306015494.0000000000F90000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306036265.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306051305.0000000000FA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306068755.0000000000FA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306068755.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306106414.0000000000FB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306162274.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306184915.0000000000FC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306233995.0000000000FC7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306261924.0000000000FD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306318419.0000000000FD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306547851.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307027190.0000000000FE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307081794.0000000000FE9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307101817.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307163466.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307209214.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307292964.0000000001005000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307353891.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307381368.0000000001018000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307396020.0000000001019000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307440783.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307488152.000000000102E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307544846.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307586792.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307629091.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307647964.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307665177.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307680872.0000000001049000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307696986.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307712487.000000000104D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307730986.0000000001055000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307750415.0000000001065000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307766512.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307800281.00000000010AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307816276.00000000010AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307866223.00000000010C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307882780.00000000010C6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_SecuriteInfo.jbxd

Similarity

API ID: AttributesFile
String ID: @
API String ID: 3188754299-2726393805
Opcode ID: 162db76669b4821dbb8071344d78bf2015fa3b8a332ba65b394ed61b27e871a8
Instruction ID: e0ab3ae956326723ee3929cfa0b170d16c6fac8f4bd987df564c136627e3ab4c
Opcode Fuzzy Hash: 162db76669b4821dbb8071344d78bf2015fa3b8a332ba65b394ed61b27e871a8
Instruction Fuzzy Hash: EC016D70504208FAFB529F58CD097AD7FB0AF01380F008160F642650E9C7B446D1E781

Function 00FB0464 Relevance: 4.6, APIs: 3, Instructions: 61
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 00FB0CB1
RegOpenKeyA.ADVAPI32(80000002,?,?), ref: 00FB0CD8
GetNativeSystemInfo.KERNELBASE(?), ref: 00FB0D2F

Memory Dump Source

Source File: 00000000.00000002.2306068755.0000000000FAB000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.2300389386.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300536415.0000000000E22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2302819137.0000000000E26000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2303415004.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2303605379.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2305996449.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306015494.0000000000F90000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306036265.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306051305.0000000000FA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306068755.0000000000FA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306106414.0000000000FB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306162274.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306184915.0000000000FC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306233995.0000000000FC7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306261924.0000000000FD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306318419.0000000000FD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306547851.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307027190.0000000000FE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307081794.0000000000FE9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307101817.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307118930.0000000000FFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307163466.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307209214.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307292964.0000000001005000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307353891.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307381368.0000000001018000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307396020.0000000001019000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307440783.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307488152.000000000102E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307544846.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307586792.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307629091.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307647964.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307665177.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307680872.0000000001049000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307696986.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307712487.000000000104D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307730986.0000000001055000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307750415.0000000001065000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307766512.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307800281.00000000010AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307816276.00000000010AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307866223.00000000010C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307882780.00000000010C6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_SecuriteInfo.jbxd

Similarity

API ID: Open$InfoNativeSystem
String ID:
API String ID: 1247124224-0
Opcode ID: 04e429815157cdaf5c61dfdc957155fe4045a0708ea8da7123cd926a58dc967d
Instruction ID: e0c065d9872327ddcea16887c2e6c751d9c42ee805ad5d75099f7bddba20054f
Opcode Fuzzy Hash: 04e429815157cdaf5c61dfdc957155fe4045a0708ea8da7123cd926a58dc967d
Instruction Fuzzy Hash: 7F21F87150410F9EEF21DF51C848BEF3AA5EF05314F010926AD42D6D91DB765CA8DF58

Function 01000442 Relevance: 3.1, APIs: 2, Instructions: 57
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(017716AC,?,-114A5FEC,?,?,?,?,-114A5FEC), ref: 010004F4

Part of subcall function 010003F4: IsBadWritePtr.KERNEL32(?,00000004), ref: 01000402

CreateFileA.KERNEL32(?,?,-114A5FEC,?,?,?,?,-114A5FEC), ref: 01000514

Memory Dump Source

Source File: 00000000.00000002.2307118930.0000000000FFF000.00000080.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.2300389386.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300536415.0000000000E22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2302819137.0000000000E26000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2303415004.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2303605379.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2305996449.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306015494.0000000000F90000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306036265.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306051305.0000000000FA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306068755.0000000000FA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306068755.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306106414.0000000000FB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306162274.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306184915.0000000000FC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306233995.0000000000FC7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306261924.0000000000FD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306318419.0000000000FD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306547851.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307027190.0000000000FE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307081794.0000000000FE9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307101817.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307163466.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307209214.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307292964.0000000001005000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307353891.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307381368.0000000001018000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307396020.0000000001019000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307440783.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307488152.000000000102E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307544846.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307586792.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307629091.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307647964.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307665177.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307680872.0000000001049000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307696986.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307712487.000000000104D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307730986.0000000001055000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307750415.0000000001065000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307766512.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307800281.00000000010AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307816276.00000000010AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307866223.00000000010C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307882780.00000000010C6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_SecuriteInfo.jbxd

Similarity

API ID: CreateFile$Write
String ID:
API String ID: 1125675974-0
Opcode ID: b1c209ee1aaf8b9419e6ade66eef138b7a7ed6e09cac94d4e5bef6ce245ff641
Instruction ID: ecec26ac86196156c25ecc0c3a6dcdcc84622fd7afc3ba9a3980355003b41ed6
Opcode Fuzzy Hash: b1c209ee1aaf8b9419e6ade66eef138b7a7ed6e09cac94d4e5bef6ce245ff641
Instruction Fuzzy Hash: C711F67150010AFBEF139F98CD05BAE3F62BF04384F058065BA86644B9CBB685A1EB55

Function 00FFFDAE Relevance: 3.0, APIs: 2, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(-114A5FEC), ref: 00FFFDBB
DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00FFFE21

Memory Dump Source

Source File: 00000000.00000002.2307118930.0000000000FFF000.00000080.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.2300389386.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300536415.0000000000E22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2302819137.0000000000E26000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2303415004.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2303605379.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2305996449.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306015494.0000000000F90000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306036265.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306051305.0000000000FA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306068755.0000000000FA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306068755.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306106414.0000000000FB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306162274.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306184915.0000000000FC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306233995.0000000000FC7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306261924.0000000000FD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306318419.0000000000FD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306547851.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307027190.0000000000FE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307081794.0000000000FE9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307101817.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307163466.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307209214.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307292964.0000000001005000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307353891.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307381368.0000000001018000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307396020.0000000001019000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307440783.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307488152.000000000102E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307544846.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307586792.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307629091.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307647964.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307665177.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307680872.0000000001049000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307696986.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307712487.000000000104D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307730986.0000000001055000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307750415.0000000001065000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307766512.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307800281.00000000010AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307816276.00000000010AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307866223.00000000010C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307882780.00000000010C6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_SecuriteInfo.jbxd

Similarity

API ID: CurrentDuplicateHandleProcess
String ID:
API String ID: 1009649615-0
Opcode ID: 796521ba1a96b48b5296d1b5d269d75ff40adc9a3c952c0887a7a43c29743c4d
Instruction ID: fe5265cf4de12cd5bd41cba88a91f81a8c3452015a448c1f92f816ccd9dd7b1f
Opcode Fuzzy Hash: 796521ba1a96b48b5296d1b5d269d75ff40adc9a3c952c0887a7a43c29743c4d
Instruction Fuzzy Hash: 1301FB3350014EFB8F22AF94DC49DAE3B65BF983507044125FB0695035D735C565FB61

Function 00FA3379 Relevance: 1.6, APIs: 1, Instructions: 115
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00FA3379

Memory Dump Source

Source File: 00000000.00000002.2306051305.0000000000FA3000.00000080.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.2300389386.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300536415.0000000000E22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2302819137.0000000000E26000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2303415004.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2303605379.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2305996449.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306015494.0000000000F90000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306036265.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306068755.0000000000FA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306068755.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306106414.0000000000FB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306162274.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306184915.0000000000FC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306233995.0000000000FC7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306261924.0000000000FD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306318419.0000000000FD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306547851.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307027190.0000000000FE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307081794.0000000000FE9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307101817.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307118930.0000000000FFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307163466.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307209214.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307292964.0000000001005000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307353891.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307381368.0000000001018000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307396020.0000000001019000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307440783.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307488152.000000000102E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307544846.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307586792.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307629091.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307647964.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307665177.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307680872.0000000001049000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307696986.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307712487.000000000104D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307730986.0000000001055000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307750415.0000000001065000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307766512.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307800281.00000000010AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307816276.00000000010AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307866223.00000000010C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307882780.00000000010C6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_SecuriteInfo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 130e124addcb50be10b98a8b5a6468adf5c8b7cfdb9e63ae26fb0e0f11acd3eb
Instruction ID: 78257d8033c663c8939e8876f5ca30c64da3783efc58abcb7dca663664a172fe
Opcode Fuzzy Hash: 130e124addcb50be10b98a8b5a6468adf5c8b7cfdb9e63ae26fb0e0f11acd3eb
Instruction Fuzzy Hash: 62315CF251D700AFE701AF19D881ABAFBE8FF58760F16492DE6C4C3610E63588409B93

Function 0100630C Relevance: 1.6, APIs: 1, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2307292964.0000000001005000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.2300389386.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300536415.0000000000E22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2302819137.0000000000E26000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2303415004.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2303605379.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2305996449.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306015494.0000000000F90000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306036265.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306051305.0000000000FA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306068755.0000000000FA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306068755.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306106414.0000000000FB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306162274.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306184915.0000000000FC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306233995.0000000000FC7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306261924.0000000000FD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306318419.0000000000FD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306547851.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307027190.0000000000FE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307081794.0000000000FE9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307101817.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307118930.0000000000FFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307163466.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307209214.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307353891.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307381368.0000000001018000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307396020.0000000001019000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307440783.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307488152.000000000102E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307544846.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307586792.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307629091.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307647964.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307665177.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307680872.0000000001049000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307696986.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307712487.000000000104D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307730986.0000000001055000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307750415.0000000001065000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307766512.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307800281.00000000010AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307816276.00000000010AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307866223.00000000010C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307882780.00000000010C6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b034d09a4283fcc270f7774b04cca88cb2ce104d68a9b22638af4cb85dd6c49
Instruction ID: cf418f303d8babcf03ec9fb6bac2ab55b8598203f6e6e6d60483a8141d8081a5
Opcode Fuzzy Hash: 3b034d09a4283fcc270f7774b04cca88cb2ce104d68a9b22638af4cb85dd6c49
Instruction Fuzzy Hash: 21414C71904206EFFB26CF18D944BAE7BF3FB00314F158495E582A61D2D772A8A0CBA5

Function 01006059 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNELBASE(?,?,0000028A,?,00000000), ref: 01006106

Memory Dump Source

Source File: 00000000.00000002.2307292964.0000000001005000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.2300389386.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300536415.0000000000E22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2302819137.0000000000E26000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2303415004.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2303605379.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2305996449.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306015494.0000000000F90000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306036265.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306051305.0000000000FA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306068755.0000000000FA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306068755.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306106414.0000000000FB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306162274.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306184915.0000000000FC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306233995.0000000000FC7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306261924.0000000000FD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306318419.0000000000FD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306547851.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307027190.0000000000FE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307081794.0000000000FE9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307101817.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307118930.0000000000FFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307163466.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307209214.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307353891.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307381368.0000000001018000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307396020.0000000001019000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307440783.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307488152.000000000102E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307544846.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307586792.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307629091.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307647964.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307665177.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307680872.0000000001049000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307696986.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307712487.000000000104D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307730986.0000000001055000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307750415.0000000001065000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307766512.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307800281.00000000010AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307816276.00000000010AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307866223.00000000010C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307882780.00000000010C6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_SecuriteInfo.jbxd

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: 95352f1bc5c8c70c481085ee099b5728d8a60f0b10d38a9bfa837bd71dc668ec
Instruction ID: 66a2a3d4739bfa7ffc2502d8ee0d869aca323d369561ec99e4a481b6724eae6c
Opcode Fuzzy Hash: 95352f1bc5c8c70c481085ee099b5728d8a60f0b10d38a9bfa837bd71dc668ec
Instruction Fuzzy Hash: 6311BC71A012359FFB735A088C48BEB77BEAF05710F1440D5E586A61C3DB769E908BA1

Function 05750D42 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 05750DCD

Memory Dump Source

Source File: 00000000.00000002.2309810286.0000000005750000.00000040.00000800.00020000.00000000.sdmp, Offset: 05750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5750000_SecuriteInfo.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 6331e722b30917edb50e64029e045872ddffe4dd83e0276c1bca83086c8bd2d2
Instruction ID: 0f24b1f1e9b95ba5cfd6f146cbe38f8ed798bd63de56dc7d0aa874ec39dc1c0c
Opcode Fuzzy Hash: 6331e722b30917edb50e64029e045872ddffe4dd83e0276c1bca83086c8bd2d2
Instruction Fuzzy Hash: 912123B68043189FCB50CF99D885BDEFBB4FB88720F15815AD809AB204C774A940CBA4

Function 05750D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 05750DCD

Memory Dump Source

Source File: 00000000.00000002.2309810286.0000000005750000.00000040.00000800.00020000.00000000.sdmp, Offset: 05750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5750000_SecuriteInfo.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 311b828ada8ece848ebee449ab801f3a70726f117654d8d37be7520fccaed0ed
Instruction ID: eab62c613c31fa5867f09201f2691bdf0b80eedd25b24c05a6d79e8c562ba1ff
Opcode Fuzzy Hash: 311b828ada8ece848ebee449ab801f3a70726f117654d8d37be7520fccaed0ed
Instruction Fuzzy Hash: B42102B6C01319DFCB50CF99D885ADEFBF4FB88720F14855AD909AB204D774A944CBA4

Function 05751510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 05751580

Memory Dump Source

Source File: 00000000.00000002.2309810286.0000000005750000.00000040.00000800.00020000.00000000.sdmp, Offset: 05750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5750000_SecuriteInfo.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 144044d038f0b931e1a3e82a7e67ade3c96e5f6324d6793165b282626b6f6026
Instruction ID: 278317dea7b2e140a5c406ac9564400dcd783578344c12c0993f3944d2dcd6ca
Opcode Fuzzy Hash: 144044d038f0b931e1a3e82a7e67ade3c96e5f6324d6793165b282626b6f6026
Instruction Fuzzy Hash: 9311D3B5900749DFDB10CF9AC584BDEFBF4EB48320F108029E959A7250D378AA44CFA5

Function 05751509 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 05751580

Memory Dump Source

Source File: 00000000.00000002.2309810286.0000000005750000.00000040.00000800.00020000.00000000.sdmp, Offset: 05750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5750000_SecuriteInfo.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 60965e43ad8606aa3665e6e0b0f194e881c2ad373d9ab636436c678c7d9b77e6
Instruction ID: 7a9bc1007177418ae14f1b29e0b8dfe70b73c336ead3461e3ae20177f6c5155c
Opcode Fuzzy Hash: 60965e43ad8606aa3665e6e0b0f194e881c2ad373d9ab636436c678c7d9b77e6
Instruction Fuzzy Hash: 732100B5D00349DFDB10CF9AC584BDEBBF4EB48320F10842AE959A7640D378AA45CFA5

Function 01000F7A Relevance: 1.6, APIs: 1, Instructions: 51
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MapViewOfFileEx.KERNELBASE(?,?,?,?,?,?), ref: 01001001

Memory Dump Source

Source File: 00000000.00000002.2307118930.0000000000FFF000.00000080.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.2300389386.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300536415.0000000000E22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2302819137.0000000000E26000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2303415004.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2303605379.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2305996449.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306015494.0000000000F90000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306036265.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306051305.0000000000FA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306068755.0000000000FA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306068755.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306106414.0000000000FB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306162274.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306184915.0000000000FC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306233995.0000000000FC7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306261924.0000000000FD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306318419.0000000000FD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306547851.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307027190.0000000000FE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307081794.0000000000FE9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307101817.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307163466.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307209214.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307292964.0000000001005000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307353891.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307381368.0000000001018000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307396020.0000000001019000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307440783.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307488152.000000000102E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307544846.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307586792.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307629091.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307647964.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307665177.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307680872.0000000001049000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307696986.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307712487.000000000104D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307730986.0000000001055000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307750415.0000000001065000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307766512.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307800281.00000000010AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307816276.00000000010AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307866223.00000000010C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307882780.00000000010C6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_SecuriteInfo.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: e4c57bc0bc7aa60e5684f9fafd76dcc8d4fa91d20a3169919b72c22037271134
Instruction ID: 5d27d754a6497da032f779f41b4a7944ef97817f546dca4e654cc120b2981d7b
Opcode Fuzzy Hash: e4c57bc0bc7aa60e5684f9fafd76dcc8d4fa91d20a3169919b72c22037271134
Instruction Fuzzy Hash: 9011E23220028EFADF22AFA4CD0AEAE3B66BF58380F004455FA4155075C77AC471EBA1

Function 05751301 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 05751367

Memory Dump Source

Source File: 00000000.00000002.2309810286.0000000005750000.00000040.00000800.00020000.00000000.sdmp, Offset: 05750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5750000_SecuriteInfo.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: bad5df847739411e6e49a22af64034c17146276bac1f1233710c8c9f8e15a448
Instruction ID: d72e472e67a1d5097e65fb4303639545643915b377682187942b621827e64c9e
Opcode Fuzzy Hash: bad5df847739411e6e49a22af64034c17146276bac1f1233710c8c9f8e15a448
Instruction Fuzzy Hash: 6D1143B5800349CFDB10CF9AC485BDEFBF4EB48320F14846AD518A7240C778A944CFA5

Function 01000D62 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2307118930.0000000000FFF000.00000080.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.2300389386.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300536415.0000000000E22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2302819137.0000000000E26000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2303415004.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2303605379.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2305996449.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306015494.0000000000F90000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306036265.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306051305.0000000000FA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306068755.0000000000FA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306068755.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306106414.0000000000FB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306162274.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306184915.0000000000FC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306233995.0000000000FC7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306261924.0000000000FD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306318419.0000000000FD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306547851.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307027190.0000000000FE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307081794.0000000000FE9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307101817.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307163466.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307209214.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307292964.0000000001005000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307353891.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307381368.0000000001018000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307396020.0000000001019000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307440783.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307488152.000000000102E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307544846.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307586792.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307629091.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307647964.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307665177.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307680872.0000000001049000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307696986.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307712487.000000000104D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307730986.0000000001055000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307750415.0000000001065000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307766512.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307800281.00000000010AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307816276.00000000010AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307866223.00000000010C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307882780.00000000010C6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d69e053cd0c14c1144c9f60ab4b00a0819430757ff05b3551ee12ca1bb28e93c
Instruction ID: 0840071e0ad249995a979f1187cb09475c49839af99a37ef9058d4512d1edfd2
Opcode Fuzzy Hash: d69e053cd0c14c1144c9f60ab4b00a0819430757ff05b3551ee12ca1bb28e93c
Instruction Fuzzy Hash: 75111E3210024EEBEF12AFA8CD09FAE3BA5BF44384F044055FA45960B5C779D975EB61

Function 05751308 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 05751367

Memory Dump Source

Source File: 00000000.00000002.2309810286.0000000005750000.00000040.00000800.00020000.00000000.sdmp, Offset: 05750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5750000_SecuriteInfo.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 58c64e1c3001bc16a7a42bcb6d4f884df533c638df68e70f6be78927efbcacf7
Instruction ID: 10009b55f96a174f093aee6c2f14d5f9ee38ada40c96a709c992871aeab3d28e
Opcode Fuzzy Hash: 58c64e1c3001bc16a7a42bcb6d4f884df533c638df68e70f6be78927efbcacf7
Instruction Fuzzy Hash: A81133B1800349CFDB10CF9AC945BDEFBF8EB48320F20846AD558A3640D778A944CFA5

Function 01000646 Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,?,?,?), ref: 010006B2

Memory Dump Source

Source File: 00000000.00000002.2307118930.0000000000FFF000.00000080.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.2300389386.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300536415.0000000000E22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2302819137.0000000000E26000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2303415004.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2303605379.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2305996449.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306015494.0000000000F90000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306036265.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306051305.0000000000FA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306068755.0000000000FA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306068755.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306106414.0000000000FB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306162274.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306184915.0000000000FC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306233995.0000000000FC7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306261924.0000000000FD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306318419.0000000000FD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306547851.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307027190.0000000000FE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307081794.0000000000FE9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307101817.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307163466.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307209214.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307292964.0000000001005000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307353891.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307381368.0000000001018000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307396020.0000000001019000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307440783.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307488152.000000000102E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307544846.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307586792.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307629091.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307647964.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307665177.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307680872.0000000001049000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307696986.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307712487.000000000104D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307730986.0000000001055000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307750415.0000000001065000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307766512.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307800281.00000000010AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307816276.00000000010AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307866223.00000000010C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307882780.00000000010C6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_SecuriteInfo.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: da2ce9fbd85130a71f47cff77af8b1a448694b40eb5d32dd21102d6b09e6d731
Instruction ID: 42c8f306fb2f0dd143b41abc13bec9df94934979675e219556efbe0297c6ec89
Opcode Fuzzy Hash: da2ce9fbd85130a71f47cff77af8b1a448694b40eb5d32dd21102d6b09e6d731
Instruction Fuzzy Hash: 90F0193210010AFBDF026F98CD09EAE3F66BF98380F008121FA0599075CB36C4A1EB61

Function 00FB2C9B Relevance: 1.5, APIs: 1, Instructions: 24libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 00FB2CB8

Memory Dump Source

Source File: 00000000.00000002.2306068755.0000000000FAB000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.2300389386.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300536415.0000000000E22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2302819137.0000000000E26000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2303415004.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2303605379.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2305996449.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306015494.0000000000F90000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306036265.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306051305.0000000000FA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306068755.0000000000FA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306106414.0000000000FB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306162274.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306184915.0000000000FC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306233995.0000000000FC7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306261924.0000000000FD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306318419.0000000000FD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306547851.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307027190.0000000000FE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307081794.0000000000FE9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307101817.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307118930.0000000000FFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307163466.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307209214.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307292964.0000000001005000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307353891.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307381368.0000000001018000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307396020.0000000001019000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307440783.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307488152.000000000102E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307544846.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307586792.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307629091.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307647964.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307665177.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307680872.0000000001049000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307696986.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307712487.000000000104D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307730986.0000000001055000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307750415.0000000001065000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307766512.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307800281.00000000010AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307816276.00000000010AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307866223.00000000010C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307882780.00000000010C6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_SecuriteInfo.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f9f4d62166b56c167cd70c8c1fca92fb90e6ffa8e8667e96efe48d1915d872a8
Instruction ID: 6f08e230e41b20f003b222cec9d573d16f06d58c8f0cca3f21bdc89f1744fcfb
Opcode Fuzzy Hash: f9f4d62166b56c167cd70c8c1fca92fb90e6ffa8e8667e96efe48d1915d872a8
Instruction Fuzzy Hash: 45F076B600C600DFDB05AF69844552DFBF4FF48310F120D1CE9D586220D23668A0AF47

Function 01005C83 Relevance: 1.3, APIs: 1, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00001000,00001000,00000004,?,?,01005C7F,?,?,01005985,?,?,01005985,?,?,01005985), ref: 01005CA3

Memory Dump Source

Source File: 00000000.00000002.2307292964.0000000001005000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.2300389386.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300536415.0000000000E22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2302819137.0000000000E26000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2303415004.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2303605379.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2305996449.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306015494.0000000000F90000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306036265.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306051305.0000000000FA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306068755.0000000000FA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306068755.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306106414.0000000000FB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306162274.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306184915.0000000000FC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306233995.0000000000FC7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306261924.0000000000FD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306318419.0000000000FD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306547851.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307027190.0000000000FE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307081794.0000000000FE9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307101817.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307118930.0000000000FFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307163466.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307209214.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307353891.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307381368.0000000001018000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307396020.0000000001019000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307440783.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307488152.000000000102E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307544846.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307586792.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307629091.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307647964.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307665177.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307680872.0000000001049000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307696986.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307712487.000000000104D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307730986.0000000001055000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307750415.0000000001065000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307766512.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307800281.00000000010AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307816276.00000000010AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307866223.00000000010C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307882780.00000000010C6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_SecuriteInfo.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 3ac7a23d882f506b72223c124ccec75361a87481ee0907b390fa94781e566c88
Instruction ID: 96c6cb37a85c069e02b8043c57756053f69f56380cee6b71d884ed44895a6ad7
Opcode Fuzzy Hash: 3ac7a23d882f506b72223c124ccec75361a87481ee0907b390fa94781e566c88
Instruction Fuzzy Hash: 2EF0D1B1A0020AEFE7268F14CE05F58BFE4FF45761F118465F98A9B191E3B188C0CB90

Function 00E2EC66 Relevance: 1.3, APIs: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 00E2F548

Memory Dump Source

Source File: 00000000.00000002.2303415004.0000000000E2A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.2300389386.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300536415.0000000000E22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2302819137.0000000000E26000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2303605379.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2305996449.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306015494.0000000000F90000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306036265.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306051305.0000000000FA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306068755.0000000000FA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306068755.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306106414.0000000000FB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306162274.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306184915.0000000000FC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306233995.0000000000FC7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306261924.0000000000FD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306318419.0000000000FD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306547851.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307027190.0000000000FE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307081794.0000000000FE9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307101817.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307118930.0000000000FFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307163466.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307209214.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307292964.0000000001005000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307353891.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307381368.0000000001018000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307396020.0000000001019000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307440783.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307488152.000000000102E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307544846.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307586792.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307629091.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307647964.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307665177.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307680872.0000000001049000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307696986.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307712487.000000000104D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307730986.0000000001055000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307750415.0000000001065000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307766512.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307800281.00000000010AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307816276.00000000010AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307866223.00000000010C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307882780.00000000010C6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_SecuriteInfo.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 193db595845b072dab2686bb7daaf1860c01a707f44e785bfe4602fdb2a02b89
Instruction ID: a7749019425f88398696fab5a6ca535b3a3248c7f77001af23097df0393179ed
Opcode Fuzzy Hash: 193db595845b072dab2686bb7daaf1860c01a707f44e785bfe4602fdb2a02b89
Instruction Fuzzy Hash: 34F03A7241C216DFD7046F20A8015BEB7F1EB50B11F25593CD8D666612E3315D60EB57

Non-executed Functions

Function 01000CFE Relevance: 1.5, APIs: 1, Instructions: 24encryptionCOMMON

Download Yara Rule

APIs

CryptVerifySignatureA.ADVAPI32(?,?,?,?,?,?), ref: 01000D45

Memory Dump Source

Source File: 00000000.00000002.2307118930.0000000000FFF000.00000080.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.2300389386.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300536415.0000000000E22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2302819137.0000000000E26000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2303415004.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2303605379.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2305996449.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306015494.0000000000F90000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306036265.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306051305.0000000000FA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306068755.0000000000FA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306068755.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306106414.0000000000FB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306162274.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306184915.0000000000FC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306233995.0000000000FC7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306261924.0000000000FD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306318419.0000000000FD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306547851.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307027190.0000000000FE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307081794.0000000000FE9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307101817.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307163466.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307209214.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307292964.0000000001005000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307353891.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307381368.0000000001018000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307396020.0000000001019000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307440783.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307488152.000000000102E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307544846.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307586792.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307629091.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307647964.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307665177.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307680872.0000000001049000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307696986.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307712487.000000000104D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307730986.0000000001055000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307750415.0000000001065000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307766512.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307800281.00000000010AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307816276.00000000010AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307866223.00000000010C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307882780.00000000010C6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_SecuriteInfo.jbxd

Similarity

API ID: CryptSignatureVerify
String ID:
API String ID: 1015439381-0
Opcode ID: 377d2a70d18fb923b8583b35d6500b0140c1abc120bc02585172442c55367490
Instruction ID: 7cf1dcf0686f1a7d08d4f8bfeeeb2b015ad63e3caaafb20f9170ff7fb36ccdcc
Opcode Fuzzy Hash: 377d2a70d18fb923b8583b35d6500b0140c1abc120bc02585172442c55367490
Instruction Fuzzy Hash: 4BF0F83260110AFFCF02DF94CA14A8D7BB2FF48344F008126FA5696250D375A6A1EF55

Function 00E2DF03 Relevance: 1.5, Strings: 1, Instructions: 215COMMON

Download Yara Rule

Strings

NTDL, xrefs: 00E2E15C

Memory Dump Source

Source File: 00000000.00000002.2303415004.0000000000E2A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.2300389386.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300536415.0000000000E22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2302819137.0000000000E26000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2303605379.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2305996449.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306015494.0000000000F90000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306036265.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306051305.0000000000FA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306068755.0000000000FA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306068755.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306106414.0000000000FB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306162274.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306184915.0000000000FC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306233995.0000000000FC7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306261924.0000000000FD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306318419.0000000000FD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306547851.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307027190.0000000000FE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307081794.0000000000FE9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307101817.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307118930.0000000000FFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307163466.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307209214.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307292964.0000000001005000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307353891.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307381368.0000000001018000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307396020.0000000001019000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307440783.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307488152.000000000102E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307544846.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307586792.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307629091.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307647964.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307665177.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307680872.0000000001049000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307696986.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307712487.000000000104D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307730986.0000000001055000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307750415.0000000001065000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307766512.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307800281.00000000010AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307816276.00000000010AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307866223.00000000010C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307882780.00000000010C6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_SecuriteInfo.jbxd

Similarity

API ID:
String ID: NTDL
API String ID: 0-3662016964
Opcode ID: fb4465b0b816dc921e8d4ab5a304f85135b2857b1403904c302ecab0234eafb8
Instruction ID: 3ecd1710afe43fe7b556165d656b58f8543acb7a609b1113a73819aeb361a524
Opcode Fuzzy Hash: fb4465b0b816dc921e8d4ab5a304f85135b2857b1403904c302ecab0234eafb8
Instruction Fuzzy Hash: 9161077250423ECFDB15CF20E9405DF77A1EF5A330F256629E84267702D7B25D129B89

Function 00E35AC2 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2303415004.0000000000E2A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.2300389386.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300536415.0000000000E22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2302819137.0000000000E26000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2303605379.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2305996449.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306015494.0000000000F90000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306036265.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306051305.0000000000FA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306068755.0000000000FA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306068755.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306106414.0000000000FB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306162274.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306184915.0000000000FC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306233995.0000000000FC7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306261924.0000000000FD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306318419.0000000000FD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306547851.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307027190.0000000000FE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307081794.0000000000FE9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307101817.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307118930.0000000000FFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307163466.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307209214.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307292964.0000000001005000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307353891.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307381368.0000000001018000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307396020.0000000001019000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307440783.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307488152.000000000102E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307544846.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307586792.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307629091.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307647964.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307665177.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307680872.0000000001049000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307696986.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307712487.000000000104D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307730986.0000000001055000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307750415.0000000001065000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307766512.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307800281.00000000010AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307816276.00000000010AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307866223.00000000010C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307882780.00000000010C6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d84a69f2f6ed8ac8c847f0b990268f1c09c3183bc08729162e0e23740017f0ce
Instruction ID: 51a9e7f9b52fec64302e79bd02bd237e7d9e7c75f31fc397230c041025252b57
Opcode Fuzzy Hash: d84a69f2f6ed8ac8c847f0b990268f1c09c3183bc08729162e0e23740017f0ce
Instruction Fuzzy Hash: A4B171B3F053504BF3454A78CCA43657B92DB96324F1F41BE8B89AB7D6D96E1C0A8384

Function 00FC24E6 Relevance: .2, Instructions: 229COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2306184915.0000000000FC0000.00000080.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.2300389386.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300536415.0000000000E22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2302819137.0000000000E26000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2303415004.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2303605379.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2305996449.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306015494.0000000000F90000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306036265.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306051305.0000000000FA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306068755.0000000000FA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306068755.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306106414.0000000000FB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306162274.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306233995.0000000000FC7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306261924.0000000000FD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306318419.0000000000FD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306547851.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307027190.0000000000FE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307081794.0000000000FE9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307101817.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307118930.0000000000FFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307163466.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307209214.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307292964.0000000001005000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307353891.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307381368.0000000001018000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307396020.0000000001019000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307440783.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307488152.000000000102E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307544846.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307586792.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307629091.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307647964.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307665177.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307680872.0000000001049000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307696986.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307712487.000000000104D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307730986.0000000001055000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307750415.0000000001065000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307766512.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307800281.00000000010AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307816276.00000000010AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307866223.00000000010C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307882780.00000000010C6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 227546ab4d02ccc42761aaffdda72d4138e6b47c31ee793961b1a1849501ce16
Instruction ID: 8d86287197c424e56a4393d08551459429d3267e720c67497d8e5b8d582f586c
Opcode Fuzzy Hash: 227546ab4d02ccc42761aaffdda72d4138e6b47c31ee793961b1a1849501ce16
Instruction Fuzzy Hash: FA81376140E3C25FC757CB788D76A95BFA1ED2322475D8ACEC0C08F8A3E21A554BE752

Function 00E2B9D4 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2303415004.0000000000E2A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.2300389386.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300536415.0000000000E22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2302819137.0000000000E26000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2303605379.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2305996449.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306015494.0000000000F90000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306036265.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306051305.0000000000FA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306068755.0000000000FA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306068755.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306106414.0000000000FB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306162274.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306184915.0000000000FC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306233995.0000000000FC7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306261924.0000000000FD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306318419.0000000000FD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306547851.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307027190.0000000000FE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307081794.0000000000FE9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307101817.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307118930.0000000000FFF000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307163466.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307209214.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307292964.0000000001005000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307353891.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307381368.0000000001018000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307396020.0000000001019000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307440783.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307488152.000000000102E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307544846.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307586792.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307629091.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307647964.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307665177.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307680872.0000000001049000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307696986.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307712487.000000000104D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307730986.0000000001055000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307750415.0000000001065000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307766512.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307800281.00000000010AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307816276.00000000010AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307866223.00000000010C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307882780.00000000010C6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_SecuriteInfo.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f55e8b63b946e1da1b0c4c3c307b85d0ffd1724f587110dc2886bbc99eb55b96
Instruction ID: 4d6a006c067f9b6d23f0a3b797ef1831febd69bc613204d523d296e05b099f30
Opcode Fuzzy Hash: f55e8b63b946e1da1b0c4c3c307b85d0ffd1724f587110dc2886bbc99eb55b96
Instruction Fuzzy Hash: CD515AB3D10A3A8FDB108F28EC413EA77E1EB44724F195025DC56BB799D3799C908788

Function 00FFF376 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 010003F4: IsBadWritePtr.KERNEL32(?,00000004), ref: 01000402

wsprintfA.USER32 ref: 00FFF3BC
LoadImageA.USER32(?,?,?,?,?,?), ref: 00FFF480

Strings

%8x, xrefs: 00FFF3B7, 00FFF3BA
%8x, xrefs: 00FFF44A, 00FFF47D

Memory Dump Source

Source File: 00000000.00000002.2307118930.0000000000FFF000.00000080.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.2300389386.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300536415.0000000000E22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2302819137.0000000000E26000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2303415004.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2303605379.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2305996449.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306015494.0000000000F90000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306036265.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306051305.0000000000FA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306068755.0000000000FA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306068755.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306106414.0000000000FB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306162274.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306184915.0000000000FC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306233995.0000000000FC7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306261924.0000000000FD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306318419.0000000000FD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306547851.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307027190.0000000000FE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307081794.0000000000FE9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307101817.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307163466.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307209214.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307292964.0000000001005000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307353891.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307381368.0000000001018000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307396020.0000000001019000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307440783.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307488152.000000000102E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307544846.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307586792.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307629091.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307647964.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307665177.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307680872.0000000001049000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307696986.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307712487.000000000104D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307730986.0000000001055000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307750415.0000000001065000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307766512.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307800281.00000000010AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307816276.00000000010AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307866223.00000000010C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307882780.00000000010C6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_SecuriteInfo.jbxd

Similarity

API ID: ImageLoadWritewsprintf
String ID: %8x$%8x
API String ID: 416453052-2046107164
Opcode ID: b6d92da8ecfde6ec57b5f884300a6708d59bc409fee1a2527d948b1b4624aa60
Instruction ID: 69e0db8b7fd14064eabb30bd47f330569a2110a12de7611d507c3bbb82c4fc74
Opcode Fuzzy Hash: b6d92da8ecfde6ec57b5f884300a6708d59bc409fee1a2527d948b1b4624aa60
Instruction Fuzzy Hash: 7231047290010AFBDF11DF94DD49EEEBB79FF88710F108125FA12A61A0C7719A65EB60

Function 00FFFF47 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNEL32(017716AC,00004020,00000000,-114A5FEC), ref: 01000034

Strings

@, xrefs: 00FFFF73

Memory Dump Source

Source File: 00000000.00000002.2307118930.0000000000FFF000.00000080.00000001.01000000.00000003.sdmp, Offset: 00E20000, based on PE: true

Associated: 00000000.00000002.2300389386.0000000000E20000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2300536415.0000000000E22000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2302819137.0000000000E26000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2303415004.0000000000E2A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2303605379.0000000000E36000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2305996449.0000000000F8E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306015494.0000000000F90000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306036265.0000000000FA0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306051305.0000000000FA3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306068755.0000000000FA4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306068755.0000000000FAB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306106414.0000000000FB3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306162274.0000000000FB8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306184915.0000000000FC0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306233995.0000000000FC7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306261924.0000000000FD8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306318419.0000000000FD9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2306547851.0000000000FE5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307027190.0000000000FE8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307081794.0000000000FE9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307101817.0000000000FF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307163466.0000000001002000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307209214.0000000001004000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307292964.0000000001005000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307353891.0000000001015000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307381368.0000000001018000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307396020.0000000001019000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307440783.0000000001020000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307488152.000000000102E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307544846.000000000102F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307586792.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307629091.0000000001039000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307647964.0000000001045000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307665177.0000000001048000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307680872.0000000001049000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307696986.000000000104C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307712487.000000000104D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307730986.0000000001055000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307750415.0000000001065000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307766512.0000000001066000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307800281.00000000010AB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307816276.00000000010AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010AD000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307831546.00000000010B6000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307866223.00000000010C4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2307882780.00000000010C6000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e20000_SecuriteInfo.jbxd

Similarity

API ID: AttributesFile
String ID: @
API String ID: 3188754299-2726393805
Opcode ID: f0c924a6e82a4cf4937a03637145e46d09758d2d93e63e4cfe55bb9c2abbf08d
Instruction ID: 2c454dfe4ce80d3dfa7d92d53c3e695e3c506b3f4bc094a5040a4024fca17618
Opcode Fuzzy Hash: f0c924a6e82a4cf4937a03637145e46d09758d2d93e63e4cfe55bb9c2abbf08d
Instruction Fuzzy Hash: EA314AB1504609EFEB25CF54C844BAEBBB0FF04354F008529FA96676A0C3B5A6A5DB90

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: SecuriteInfo.com.Win32.Evo-gen.18822.1315.exePID: 5960, Parent PID: 4004

General

Chronological Activities

Disassembly

Analysis Process: SecuriteInfo.com.Win32.Evo-gen.18822.1315.exePID: 5960, Parent PID: 4004COMMON

Execution Graph

Graph

Executed Functions

Windows Analysis Report
SecuriteInfo.com.Win32.Evo-gen.18822.1315.exe

Function 010058E0 Relevance: 3.1, APIs: 2, Instructions: 107
memoryCOMMON

Function 00FA31A0 Relevance: 1.6, APIs: 1, Instructions: 150
libraryCOMMON

Function 01000226 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Function 00FB0464 Relevance: 4.6, APIs: 3, Instructions: 61
registryCOMMON

Function 01000442 Relevance: 3.1, APIs: 2, Instructions: 57
fileCOMMON

Function 00FFFDAE Relevance: 3.0, APIs: 2, Instructions: 41
COMMON

Function 00FA3379 Relevance: 1.6, APIs: 1, Instructions: 115
libraryCOMMON

Function 0100630C Relevance: 1.6, APIs: 1, Instructions: 112
COMMON

Function 01006059 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 05750D42 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Function 05750D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Function 05751510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Function 05751509 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Function 01000F7A Relevance: 1.6, APIs: 1, Instructions: 51
fileCOMMON

Function 01000D62 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON