Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1561858
MD5:	28e07d9ab0a04c2f660e2506117e63b5
SHA1:	28c526b2130b829c389c0b7351ff4ad0e3d63d89
SHA256:	c4b5efac85934e3ec9a0c11d14b0136c0b116366408193a8b7c32bdd1dffc5ce
Tags:	exeuser-Bitsight
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

AI detected suspicious sample

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Hides threads from debuggers

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Detected potential crypto function

Enables debug privileges

Entry point lies outside standard sections

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 7056 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 28E07D9AB0A04C2F660E2506117E63B5)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source:

Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: file.exe, 00000000.00000002.1913067242.0000000000E32000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1780008217.00000000052A0000.00000004.00001000.00020000.00000000.sdmp

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E458E2		0_2_00E458E2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E45D46		0_2_00E45D46

Source: file.exe, 00000000.00000002.1913081499.0000000000E36000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe
Source: file.exe, 00000000.00000002.1914182645.000000000110E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamedefOff.exe. vs file.exe

Source: classification engine

Classification label: mal100.evad.winEXE@1/1@0/0

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application
Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: &RtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNe

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior

Source: file.exe

Static file information: File size 2789888 > 1048576

Source: file.exe

Static PE information: Raw size of ecosufqf is bigger than: 0x100000 < 0x2a3200

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.e30000.0.unpack :EW;.rsrc:W;.idata :W;ecosufqf:EW;pnlltuis:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x2ae447 should be: 0x2ab33b

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: ecosufqf
Source: file.exe	Static PE information: section name: pnlltuis
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FBA80D push ecx; mov dword ptr [esp], edi	0_2_00FBA826
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FBA80D push ebx; mov dword ptr [esp], 33FF8A17h	0_2_00FBA84F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FBA80D push edx; mov dword ptr [esp], esp	0_2_00FBA886
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FBA94B push esi; mov dword ptr [esp], ebx	0_2_00FBA971
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FBA94B push 58136DD5h; mov dword ptr [esp], edx	0_2_00FBA9A2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FBA94B push 3E8AFC7Fh; mov dword ptr [esp], ecx	0_2_00FBA9B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FBA94B push 4D7695CFh; mov dword ptr [esp], ebx	0_2_00FBAA3A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FBA94B push 63A87610h; mov dword ptr [esp], ecx	0_2_00FBAA66
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E3D0E2 push ecx; mov dword ptr [esp], 02717D15h	0_2_00E3D0EF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E3D0E2 push 38FE6C4Ch; mov dword ptr [esp], edi	0_2_00E3D896
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E3D0E2 push ecx; mov dword ptr [esp], ebx	0_2_00E3D89D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E420E2 push 03F7AFF0h; mov dword ptr [esp], ecx	0_2_00E42105
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0104F109 push ebp; mov dword ptr [esp], eax	0_2_0104F165
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB70D1 push edi; mov dword ptr [esp], 559D4D4Fh	0_2_00FB70D3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB70D1 push ebp; mov dword ptr [esp], 03FE1300h	0_2_00FB70E1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E410A1 push edx; mov dword ptr [esp], esi	0_2_00E410A2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC90B6 push esi; mov dword ptr [esp], ecx	0_2_00FC9B8F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC90A8 push 6CB614DDh; mov dword ptr [esp], eax	0_2_00FC90AD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E410B1 push ebx; mov dword ptr [esp], 2CAA47B4h	0_2_00E41457
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E410B1 push ebp; mov dword ptr [esp], eax	0_2_00E42041
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E410B1 push ebx; mov dword ptr [esp], 7DD76519h	0_2_00E4396C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E410B1 push ebx; mov dword ptr [esp], edi	0_2_00E43A5B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB70AD push edi; mov dword ptr [esp], 7FAFA865h	0_2_00FB70B3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FDD071 push 422E3086h; mov dword ptr [esp], edx	0_2_00FDD0C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0100D199 push 3B965D77h; mov dword ptr [esp], esp	0_2_0100D1C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E3F050 push ebx; mov dword ptr [esp], 79ED0B64h	0_2_00E3F10A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E3F050 push ebx; mov dword ptr [esp], 725FC573h	0_2_00E3F601
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E42050 push eax; mov dword ptr [esp], 420E4BB4h	0_2_00E4205B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E3F05E push ebx; mov dword ptr [esp], 79ED0B64h	0_2_00E3F10A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E3F05E push ebx; mov dword ptr [esp], 725FC573h	0_2_00E3F601
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E3D02F push 38FE6C4Ch; mov dword ptr [esp], edi	0_2_00E3D896

Source: file.exe

Static PE information: section name: entropy: 7.805079736087947

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3E4FC second address: E3E510 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jno 00007FA870BEAAD8h 0x0000000b popad 0x0000000c push eax 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3E510 second address: E3E514 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB5287 second address: FB5297 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA870BEAAD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBA69C second address: FBA6B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA87137DD68h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBA6B8 second address: FBA6C1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBABF1 second address: FBABF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBDA69 second address: FBDA6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBDB88 second address: FBDBB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 jne 00007FA87137DD58h 0x0000000d popad 0x0000000e push eax 0x0000000f jp 00007FA87137DD5Eh 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 push eax 0x0000001a push edx 0x0000001b js 00007FA87137DD58h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBDC79 second address: FBDC7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBDC7F second address: FBDC84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBDC84 second address: FBDD2A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA870BEAADEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jno 00007FA870BEAAE0h 0x00000010 nop 0x00000011 mov edi, 1EE8B0E8h 0x00000016 push 00000000h 0x00000018 movsx esi, ax 0x0000001b push 41298E7Dh 0x00000020 push eax 0x00000021 jo 00007FA870BEAAD8h 0x00000027 pushad 0x00000028 popad 0x00000029 pop eax 0x0000002a xor dword ptr [esp], 41298EFDh 0x00000031 mov dx, ax 0x00000034 push 00000003h 0x00000036 push 00000000h 0x00000038 push edx 0x00000039 call 00007FA870BEAAD8h 0x0000003e pop edx 0x0000003f mov dword ptr [esp+04h], edx 0x00000043 add dword ptr [esp+04h], 0000001Dh 0x0000004b inc edx 0x0000004c push edx 0x0000004d ret 0x0000004e pop edx 0x0000004f ret 0x00000050 mov edi, dword ptr [ebp+122D3CB3h] 0x00000056 push 00000000h 0x00000058 sub si, AA43h 0x0000005d movsx esi, bx 0x00000060 push 00000003h 0x00000062 jmp 00007FA870BEAAE7h 0x00000067 call 00007FA870BEAAD9h 0x0000006c push eax 0x0000006d push edx 0x0000006e push eax 0x0000006f push edx 0x00000070 push eax 0x00000071 push edx 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBDD2A second address: FBDD2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBDD2E second address: FBDD38 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA870BEAAD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBDD38 second address: FBDD7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jno 00007FA87137DD56h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 pop edx 0x00000012 jbe 00007FA87137DD58h 0x00000018 popad 0x00000019 mov eax, dword ptr [esp+04h] 0x0000001d jmp 00007FA87137DD69h 0x00000022 mov eax, dword ptr [eax] 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 jnl 00007FA87137DD56h 0x0000002d push ebx 0x0000002e pop ebx 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBDE64 second address: FBDE78 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FA870BEAADBh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBDE78 second address: FBDE92 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA87137DD65h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBDE92 second address: FBDEBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push ecx 0x0000000c jmp 00007FA870BEAADFh 0x00000011 pop ecx 0x00000012 mov eax, dword ptr [eax] 0x00000014 push eax 0x00000015 push edx 0x00000016 jnp 00007FA870BEAAD8h 0x0000001c push eax 0x0000001d pop eax 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBDEBA second address: FBDF63 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA87137DD69h 0x00000008 jmp 00007FA87137DD63h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 jmp 00007FA87137DD68h 0x00000018 pop eax 0x00000019 pushad 0x0000001a or ecx, 19C0068Eh 0x00000020 cld 0x00000021 popad 0x00000022 push 00000003h 0x00000024 push 00000000h 0x00000026 push ebx 0x00000027 call 00007FA87137DD58h 0x0000002c pop ebx 0x0000002d mov dword ptr [esp+04h], ebx 0x00000031 add dword ptr [esp+04h], 00000014h 0x00000039 inc ebx 0x0000003a push ebx 0x0000003b ret 0x0000003c pop ebx 0x0000003d ret 0x0000003e js 00007FA87137DD57h 0x00000044 cmc 0x00000045 push 00000000h 0x00000047 sub esi, 0DC7C503h 0x0000004d push 00000003h 0x0000004f jmp 00007FA87137DD64h 0x00000054 push D6E8240Eh 0x00000059 push esi 0x0000005a push edi 0x0000005b push eax 0x0000005c pop eax 0x0000005d pop edi 0x0000005e pop esi 0x0000005f xor dword ptr [esp], 16E8240Eh 0x00000066 cld 0x00000067 lea ebx, dword ptr [ebp+124539BEh] 0x0000006d mov si, bx 0x00000070 xchg eax, ebx 0x00000071 push ecx 0x00000072 pushad 0x00000073 pushad 0x00000074 popad 0x00000075 push eax 0x00000076 push edx 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB3711 second address: FB3717 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB3717 second address: FB371B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB371B second address: FB371F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB371F second address: FB3725 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB3725 second address: FB3743 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FA870BEAAD6h 0x0000000a jmp 00007FA870BEAAE4h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB3743 second address: FB3774 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA87137DD61h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e jmp 00007FA87137DD5Ah 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 popad 0x00000018 push esi 0x00000019 pop esi 0x0000001a popad 0x0000001b pushad 0x0000001c push edi 0x0000001d pop edi 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDD0FC second address: FDD108 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FA870BEAAD6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDD506 second address: FDD516 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA87137DD62h 0x00000008 jo 00007FA87137DD56h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDD516 second address: FDD51D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDD660 second address: FDD666 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDD666 second address: FDD66C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDD66C second address: FDD672 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDD910 second address: FDD947 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007FA870BEAAEDh 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA870BEAAE0h 0x00000013 push edi 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDD947 second address: FDD94D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDDA91 second address: FDDAC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA870BEAAE6h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FA870BEAAE4h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDDAC5 second address: FDDACB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDDACB second address: FDDAED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA870BEAAE6h 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007FA870BEAAD6h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDDC4E second address: FDDC61 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA87137DD5Dh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDDF21 second address: FDDF49 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA870BEAAE1h 0x00000007 jc 00007FA870BEAAE9h 0x0000000d jmp 00007FA870BEAADDh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDE0A2 second address: FDE0B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA87137DD5Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDE0B4 second address: FDE0C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDE0C0 second address: FDE0C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDE241 second address: FDE245 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDE245 second address: FDE253 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007FA87137DD58h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDE253 second address: FDE265 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA870BEAADDh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDE265 second address: FDE271 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FDE271 second address: FDE29F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jp 00007FA870BEAAE5h 0x00000010 pushad 0x00000011 jnc 00007FA870BEAAD6h 0x00000017 jg 00007FA870BEAAD6h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAAFFA second address: FAB008 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA87137DD56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE5D44 second address: FE5D4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE5D4A second address: FE5D4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE4CAA second address: FE4CB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FA870BEAAD6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE9C12 second address: FE9C1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jnc 00007FA87137DD56h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE9C1F second address: FE9C24 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE9C24 second address: FE9C2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE9D6B second address: FE9D87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FA870BEAAD6h 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA870BEAADDh 0x00000012 push edi 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE9ECD second address: FE9ED1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE9ED1 second address: FE9ED7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE9ED7 second address: FE9EF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA87137DD69h 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEA098 second address: FEA0A2 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FA870BEAAD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEA37C second address: FEA3A3 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FA87137DD6Dh 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jmp 00007FA87137DD65h 0x0000000f jbe 00007FA87137DD5Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEA628 second address: FEA660 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA870BEAAE8h 0x00000009 pop edi 0x0000000a je 00007FA870BEAAE8h 0x00000010 jmp 00007FA870BEAAE0h 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEA660 second address: FEA67F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jmp 00007FA87137DD63h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEB07B second address: FEB07F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEB07F second address: FEB085 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEB229 second address: FEB241 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA870BEAADCh 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEB51E second address: FEB530 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA87137DD5Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEB6FF second address: FEB703 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEBC6F second address: FEBC73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEBF29 second address: FEBF2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEC089 second address: FEC08F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEC08F second address: FEC093 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEC093 second address: FEC0BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA87137DD66h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jng 00007FA87137DD58h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEC14F second address: FEC153 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FED07C second address: FED087 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FA87137DD56h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FED087 second address: FED08D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEDAA3 second address: FEDAAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FA87137DD56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FED08D second address: FED091 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEE2D2 second address: FEE2E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA87137DD5Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEDAAD second address: FEDAB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEE2E4 second address: FEE2F6 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA87137DD56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEE2F6 second address: FEE2FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEF430 second address: FEF450 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FA87137DD60h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f je 00007FA87137DD56h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF0296 second address: FF02F6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FA870BEAAE6h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e mov dword ptr [ebp+1245303Eh], esi 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push ebx 0x00000019 call 00007FA870BEAAD8h 0x0000001e pop ebx 0x0000001f mov dword ptr [esp+04h], ebx 0x00000023 add dword ptr [esp+04h], 0000001Ch 0x0000002b inc ebx 0x0000002c push ebx 0x0000002d ret 0x0000002e pop ebx 0x0000002f ret 0x00000030 movsx edi, dx 0x00000033 push 00000000h 0x00000035 or di, BC37h 0x0000003a push eax 0x0000003b push eax 0x0000003c push edx 0x0000003d push esi 0x0000003e jnc 00007FA870BEAAD6h 0x00000044 pop esi 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEF450 second address: FEF45E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007FA87137DD56h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF02F6 second address: FF0300 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA870BEAADCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF1907 second address: FF1911 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FA87137DD56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF1911 second address: FF1984 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA870BEAAD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jo 00007FA870BEAADAh 0x00000013 push ecx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 pop ecx 0x00000017 nop 0x00000018 mov esi, dword ptr [ebp+122D39FBh] 0x0000001e push 00000000h 0x00000020 add dword ptr [ebp+122D1C73h], ebx 0x00000026 jmp 00007FA870BEAADBh 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push ebp 0x00000030 call 00007FA870BEAAD8h 0x00000035 pop ebp 0x00000036 mov dword ptr [esp+04h], ebp 0x0000003a add dword ptr [esp+04h], 0000001Bh 0x00000042 inc ebp 0x00000043 push ebp 0x00000044 ret 0x00000045 pop ebp 0x00000046 ret 0x00000047 mov dword ptr [ebp+12453A68h], edi 0x0000004d jl 00007FA870BEAAD6h 0x00000053 xchg eax, ebx 0x00000054 jmp 00007FA870BEAADAh 0x00000059 push eax 0x0000005a pushad 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF1984 second address: FF1988 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF1988 second address: FF1991 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF1991 second address: FF1997 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF48DE second address: FF48EC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF48EC second address: FF48F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF48F2 second address: FF496C instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA870BEAAD8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007FA870BEAAD8h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 00000019h 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 stc 0x00000028 push 00000000h 0x0000002a movzx ebx, ax 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push ebp 0x00000032 call 00007FA870BEAAD8h 0x00000037 pop ebp 0x00000038 mov dword ptr [esp+04h], ebp 0x0000003c add dword ptr [esp+04h], 0000001Ch 0x00000044 inc ebp 0x00000045 push ebp 0x00000046 ret 0x00000047 pop ebp 0x00000048 ret 0x00000049 mov ebx, 7B146C1Ah 0x0000004e push eax 0x0000004f push eax 0x00000050 push edx 0x00000051 pushad 0x00000052 jmp 00007FA870BEAAE4h 0x00000057 push ecx 0x00000058 pop ecx 0x00000059 popad 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF7852 second address: FF787C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA87137DD68h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c pushad 0x0000000d popad 0x0000000e pop eax 0x0000000f jbe 00007FA87137DD5Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF4B2A second address: FF4B2F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF5A75 second address: FF5B62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA87137DD66h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jbe 00007FA87137DD6Dh 0x00000010 jnp 00007FA87137DD67h 0x00000016 jmp 00007FA87137DD61h 0x0000001b nop 0x0000001c push 00000000h 0x0000001e push edi 0x0000001f call 00007FA87137DD58h 0x00000024 pop edi 0x00000025 mov dword ptr [esp+04h], edi 0x00000029 add dword ptr [esp+04h], 00000016h 0x00000031 inc edi 0x00000032 push edi 0x00000033 ret 0x00000034 pop edi 0x00000035 ret 0x00000036 jmp 00007FA87137DD5Ah 0x0000003b push dword ptr fs:[00000000h] 0x00000042 call 00007FA87137DD5Ch 0x00000047 push esi 0x00000048 or dword ptr [ebp+122D1E65h], esi 0x0000004e pop edi 0x0000004f pop ebx 0x00000050 mov dword ptr fs:[00000000h], esp 0x00000057 jng 00007FA87137DD75h 0x0000005d jl 00007FA87137DD6Fh 0x00000063 jmp 00007FA87137DD69h 0x00000068 adc ebx, 71005B30h 0x0000006e mov eax, dword ptr [ebp+122D1731h] 0x00000074 pushad 0x00000075 jo 00007FA87137DD5Bh 0x0000007b xor ax, 05EBh 0x00000080 push ebx 0x00000081 jmp 00007FA87137DD66h 0x00000086 pop ebx 0x00000087 popad 0x00000088 push FFFFFFFFh 0x0000008a mov dword ptr [ebp+122D2B34h], ebx 0x00000090 push eax 0x00000091 je 00007FA87137DD79h 0x00000097 push eax 0x00000098 push edx 0x00000099 push eax 0x0000009a push edx 0x0000009b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF6C00 second address: FF6C06 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF5B62 second address: FF5B66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF6C06 second address: FF6C1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA870BEAADAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 pop eax 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF8C1F second address: FF8C25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF9C40 second address: FF9C46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFAC83 second address: FFAC9E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA87137DD67h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFBBE2 second address: FFBBE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFBBE7 second address: FFBBED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFBBED second address: FFBBFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFBBFB second address: FFBC05 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA87137DD56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFE897 second address: FFE89F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10019E2 second address: 10019E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFD9DC second address: FFDA65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007FA870BEAADCh 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007FA870BEAAD8h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 00000017h 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 push dword ptr fs:[00000000h] 0x0000002f mov dword ptr fs:[00000000h], esp 0x00000036 mov dword ptr [ebp+122D1D7Ch], ecx 0x0000003c mov eax, dword ptr [ebp+122D1585h] 0x00000042 push 00000000h 0x00000044 push ecx 0x00000045 call 00007FA870BEAAD8h 0x0000004a pop ecx 0x0000004b mov dword ptr [esp+04h], ecx 0x0000004f add dword ptr [esp+04h], 00000014h 0x00000057 inc ecx 0x00000058 push ecx 0x00000059 ret 0x0000005a pop ecx 0x0000005b ret 0x0000005c add dword ptr [ebp+1247F2EFh], edx 0x00000062 xor dword ptr [ebp+12451869h], ebx 0x00000068 push FFFFFFFFh 0x0000006a sub dword ptr [ebp+122D2127h], ecx 0x00000070 xor di, 3D61h 0x00000075 push eax 0x00000076 pushad 0x00000077 push eax 0x00000078 push edx 0x00000079 push ebx 0x0000007a pop ebx 0x0000007b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFEA13 second address: FFEAC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FA87137DD56h 0x0000000a popad 0x0000000b pop esi 0x0000000c push eax 0x0000000d jmp 00007FA87137DD60h 0x00000012 nop 0x00000013 mov bh, ch 0x00000015 push dword ptr fs:[00000000h] 0x0000001c push 00000000h 0x0000001e push ecx 0x0000001f call 00007FA87137DD58h 0x00000024 pop ecx 0x00000025 mov dword ptr [esp+04h], ecx 0x00000029 add dword ptr [esp+04h], 00000018h 0x00000031 inc ecx 0x00000032 push ecx 0x00000033 ret 0x00000034 pop ecx 0x00000035 ret 0x00000036 call 00007FA87137DD63h 0x0000003b jmp 00007FA87137DD61h 0x00000040 pop ebx 0x00000041 mov dword ptr fs:[00000000h], esp 0x00000048 push 00000000h 0x0000004a push ecx 0x0000004b call 00007FA87137DD58h 0x00000050 pop ecx 0x00000051 mov dword ptr [esp+04h], ecx 0x00000055 add dword ptr [esp+04h], 00000017h 0x0000005d inc ecx 0x0000005e push ecx 0x0000005f ret 0x00000060 pop ecx 0x00000061 ret 0x00000062 mov dword ptr [ebp+122D1D13h], eax 0x00000068 mov eax, dword ptr [ebp+122D0DF9h] 0x0000006e push FFFFFFFFh 0x00000070 mov edi, 320F8690h 0x00000075 mov di, 6F31h 0x00000079 nop 0x0000007a pushad 0x0000007b push eax 0x0000007c push eax 0x0000007d push edx 0x0000007e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFDA65 second address: FFDA7F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA870BEAAE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFFB43 second address: FFFB4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1001B44 second address: 1001BE3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jmp 00007FA870BEAADFh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 jmp 00007FA870BEAADFh 0x00000015 push dword ptr fs:[00000000h] 0x0000001c push 00000000h 0x0000001e push ebx 0x0000001f call 00007FA870BEAAD8h 0x00000024 pop ebx 0x00000025 mov dword ptr [esp+04h], ebx 0x00000029 add dword ptr [esp+04h], 00000015h 0x00000031 inc ebx 0x00000032 push ebx 0x00000033 ret 0x00000034 pop ebx 0x00000035 ret 0x00000036 mov dword ptr [ebp+122D2754h], edx 0x0000003c mov dword ptr fs:[00000000h], esp 0x00000043 push 00000000h 0x00000045 push eax 0x00000046 call 00007FA870BEAAD8h 0x0000004b pop eax 0x0000004c mov dword ptr [esp+04h], eax 0x00000050 add dword ptr [esp+04h], 0000001Dh 0x00000058 inc eax 0x00000059 push eax 0x0000005a ret 0x0000005b pop eax 0x0000005c ret 0x0000005d mov eax, dword ptr [ebp+122D049Dh] 0x00000063 push FFFFFFFFh 0x00000065 mov ebx, eax 0x00000067 nop 0x00000068 pushad 0x00000069 jmp 00007FA870BEAAE0h 0x0000006e push eax 0x0000006f push edx 0x00000070 push eax 0x00000071 push edx 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1001BE3 second address: 1001BE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100396F second address: 10039B3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA870BEAAE6h 0x0000000b popad 0x0000000c nop 0x0000000d push 00000000h 0x0000000f stc 0x00000010 push 00000000h 0x00000012 mov edi, 1308FD4Ah 0x00000017 push eax 0x00000018 pushad 0x00000019 jmp 00007FA870BEAAE2h 0x0000001e jnp 00007FA870BEAADCh 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1001BE7 second address: 1001BEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1001BEB second address: 1001BF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1001BF8 second address: 1001BFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1001BFC second address: 1001C0A instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA870BEAAD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1001C0A second address: 1001C0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1007B51 second address: 1007B78 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA870BEAADBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FA870BEAAE0h 0x0000000f pop eax 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100B986 second address: 100B98A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100B98A second address: 100B994 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA870BEAAD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100B994 second address: 100B9B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 js 00007FA87137DD56h 0x0000000d jmp 00007FA87137DD5Eh 0x00000012 jne 00007FA87137DD56h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100BB4D second address: 100BB53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100BB53 second address: 100BB70 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA87137DD67h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100BCED second address: 100BCF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100BCF3 second address: 100BD01 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100BD01 second address: 100BD1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA870BEAAE2h 0x00000007 jns 00007FA870BEAAD6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100BD1D second address: 100BD29 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FA87137DD5Eh 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100E5C5 second address: 100E5CF instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FA870BEAAD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100E5CF second address: 100E5EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FA87137DD56h 0x0000000a jmp 00007FA87137DD61h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100E5EA second address: 100E5EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 101D81B second address: 101D821 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102373B second address: 102375E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FA870BEAAE7h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102375E second address: 1023762 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1023762 second address: 1023766 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1023766 second address: 102376E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1022B0E second address: 1022B3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007FA870BEAADAh 0x0000000b jmp 00007FA870BEAAE7h 0x00000010 popad 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1022E28 second address: 1022E34 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1022E34 second address: 1022E38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1027E31 second address: 1027E37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10280F8 second address: 10280FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10283AB second address: 10283B1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10283B1 second address: 10283C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007FA870BEAADFh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10283C9 second address: 10283E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FA87137DD61h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102D8EC second address: 102D8F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102D8F0 second address: 102D8F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102C75C second address: 102C761 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF2AD5 second address: FD2CD0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 stc 0x0000000a lea eax, dword ptr [ebp+1248881Ah] 0x00000010 mov dword ptr [ebp+122D2E20h], edi 0x00000016 push eax 0x00000017 jmp 00007FA87137DD69h 0x0000001c mov dword ptr [esp], eax 0x0000001f jmp 00007FA87137DD5Ah 0x00000024 call dword ptr [ebp+122D1E25h] 0x0000002a pushad 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f jmp 00007FA87137DD69h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF2BFB second address: FF2C01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF2C01 second address: FF2C05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF2F9B second address: FF2F9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF3123 second address: FF312D instructions: 0x00000000 rdtsc 0x00000002 je 00007FA87137DD56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF32CD second address: FF32D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF32D1 second address: FF32D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF33B5 second address: FF33BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FA870BEAAD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102CFCA second address: 102CFD7 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA87137DD56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102CFD7 second address: 102CFF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 pushad 0x0000000a jg 00007FA870BEAAD6h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 jne 00007FA870BEAAD6h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102D430 second address: 102D434 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102D434 second address: 102D447 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA870BEAADDh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1031512 second address: 1031526 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA87137DD5Ah 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1031526 second address: 103152A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10372FB second address: 1037303 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10361AC second address: 10361B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10361B0 second address: 10361BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10361BB second address: 10361C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jnp 00007FA870BEAAE2h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10361C8 second address: 10361CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1036490 second address: 1036494 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1036494 second address: 1036498 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10365D7 second address: 10365EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA870BEAAE3h 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10365EF second address: 1036622 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FA87137DD5Ch 0x00000008 js 00007FA87137DD62h 0x0000000e jbe 00007FA87137DD56h 0x00000014 je 00007FA87137DD56h 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FA87137DD5Fh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103677C second address: 103679E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jc 00007FA870BEAAD6h 0x00000010 jmp 00007FA870BEAAE2h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103679E second address: 10367B0 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FA87137DD56h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10371A1 second address: 10371A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1035AF8 second address: 1035B05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jnl 00007FA87137DD56h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1035B05 second address: 1035B0B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1035B0B second address: 1035B11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9F50B second address: F9F528 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA870BEAAE9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9F528 second address: F9F52C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103DD52 second address: 103DD56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 103D90A second address: 103D915 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA44AA second address: FA44B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA44B0 second address: FA44CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA87137DD67h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104095C second address: 104096B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA870BEAAD6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10478C1 second address: 10478D3 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA87137DD56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007FA87137DD56h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10478D3 second address: 10478D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1046179 second address: 1046192 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA87137DD5Eh 0x00000009 jne 00007FA87137DD56h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10462F5 second address: 10462FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10462FE second address: 1046336 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FA87137DD56h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FA87137DD5Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 jl 00007FA87137DD56h 0x00000019 jmp 00007FA87137DD66h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104672D second address: 1046733 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10468AA second address: 10468BC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA87137DD5Bh 0x00000007 push ecx 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FF37A3 second address: FF37A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1047580 second address: 104758A instructions: 0x00000000 rdtsc 0x00000002 jne 00007FA87137DD56h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104C0BA second address: 104C0BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104F188 second address: 104F1A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FA87137DD56h 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007FA87137DD5Ch 0x00000011 pushad 0x00000012 popad 0x00000013 push edx 0x00000014 pop edx 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 104F1A7 second address: 104F1AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1050D5B second address: 1050D6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 jnc 00007FA87137DD56h 0x0000000c jne 00007FA87137DD56h 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1050D6E second address: 1050D7E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA870BEAADBh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1050D7E second address: 1050D84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10587A3 second address: 10587AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10587AB second address: 10587B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10587B0 second address: 10587B7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1056973 second address: 105698E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA87137DD64h 0x00000007 push ebx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1056AD6 second address: 1056AE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FA870BEAAD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1056AE0 second address: 1056B08 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA87137DD5Bh 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FA87137DD5Ch 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 push edi 0x00000014 jng 00007FA87137DD56h 0x0000001a pop edi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1056B08 second address: 1056B34 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FA870BEAAE2h 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FA870BEAAE4h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1056F20 second address: 1056F24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1057988 second address: 10579BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FA870BEAAE3h 0x0000000d pop ecx 0x0000000e jo 00007FA870BEAADCh 0x00000014 je 00007FA870BEAAD6h 0x0000001a popad 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e js 00007FA870BEAAD6h 0x00000024 push ecx 0x00000025 pop ecx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10579BC second address: 10579C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10579C0 second address: 10579CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10579CB second address: 10579F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FA87137DD56h 0x0000000a pop edi 0x0000000b push ebx 0x0000000c jmp 00007FA87137DD61h 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 ja 00007FA87137DD56h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105DFEC second address: 105DFF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 105E2FC second address: 105E30E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FA87137DD5Ah 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1069CC4 second address: 1069CF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jc 00007FA870BEAAD6h 0x0000000c popad 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FA870BEAAE9h 0x00000015 push ecx 0x00000016 push eax 0x00000017 pop eax 0x00000018 pop ecx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1069CF1 second address: 1069CFB instructions: 0x00000000 rdtsc 0x00000002 jo 00007FA87137DD5Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1069FB9 second address: 1069FBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1069FBD second address: 1069FC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106A139 second address: 106A13D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106A2FC second address: 106A306 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FA87137DD56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10696F2 second address: 10696F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 106DEDB second address: 106DF07 instructions: 0x00000000 rdtsc 0x00000002 js 00007FA87137DD5Ch 0x00000008 jbe 00007FA87137DD56h 0x0000000e jne 00007FA87137DD5Eh 0x00000014 pop edx 0x00000015 pop eax 0x00000016 jl 00007FA87137DD64h 0x0000001c jnp 00007FA87137DD5Eh 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1074284 second address: 1074288 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1074288 second address: 1074292 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FA87137DD56h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1074292 second address: 10742A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007FA870BEAADEh 0x0000000c jne 00007FA870BEAAD6h 0x00000012 push edx 0x00000013 pop edx 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10742A9 second address: 10742CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FA87137DD64h 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e jc 00007FA87137DD5Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10742CE second address: 10742D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1075CFD second address: 1075D23 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007FA87137DD56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop esi 0x0000000d pushad 0x0000000e jmp 00007FA87137DD5Ah 0x00000013 push eax 0x00000014 push edx 0x00000015 ja 00007FA87137DD56h 0x0000001b jc 00007FA87137DD56h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1075D23 second address: 1075D36 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA870BEAADBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1075D36 second address: 1075D3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9DB72 second address: F9DB76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9DB76 second address: F9DB8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA87137DD63h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FACAA4 second address: FACABC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FA870BEAAE2h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1086E3C second address: 1086E46 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA87137DD56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108E3A9 second address: 108E3BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA870BEAADCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108E3BA second address: 108E3C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 je 00007FA87137DD5Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108D0D1 second address: 108D0D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 108D0D5 second address: 108D10D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007FA87137DD62h 0x0000000e jmp 00007FA87137DD5Ch 0x00000013 jmp 00007FA87137DD5Ah 0x00000018 popad 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FA87137DD5Eh 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1097B49 second address: 1097B53 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FA870BEAAE2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1097B53 second address: 1097B59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A2E22 second address: 10A2E28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A2E28 second address: 10A2E67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FA87137DD68h 0x0000000a pushad 0x0000000b jo 00007FA87137DD56h 0x00000011 jmp 00007FA87137DD5Ah 0x00000016 jg 00007FA87137DD56h 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f jg 00007FA87137DD56h 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A2E67 second address: 10A2E95 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA870BEAAE5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a je 00007FA870BEAB1Fh 0x00000010 push eax 0x00000011 push edx 0x00000012 je 00007FA870BEAAD6h 0x00000018 jp 00007FA870BEAAD6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A1758 second address: 10A1770 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FA87137DD62h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A1770 second address: 10A1779 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A1B76 second address: 10A1B7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A1B7D second address: 10A1B93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FA870BEAAE1h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A1B93 second address: 10A1B99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A1D16 second address: 10A1D22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jns 00007FA870BEAAD6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A6954 second address: 10A6958 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A6958 second address: 10A695E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A64E7 second address: 10A650E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jl 00007FA87137DD56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA87137DD69h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A668B second address: 10A66C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA870BEAAE6h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA870BEAAE9h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10A66C4 second address: 10A66C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B046C second address: 10B0476 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FA870BEAAD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C19E0 second address: 10C19F4 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FA87137DD56h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jno 00007FA87137DD58h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C19F4 second address: 10C1A38 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA870BEAAE6h 0x00000007 jg 00007FA870BEAADAh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 jmp 00007FA870BEAAE4h 0x00000017 pop ecx 0x00000018 jp 00007FA870BEAADEh 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C1A38 second address: 10C1A3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C5BF8 second address: 10C5BFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C5BFC second address: 10C5C16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA87137DD5Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnl 00007FA87137DD5Ah 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C5C16 second address: 10C5C4C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007FA870BEAAD6h 0x00000009 jp 00007FA870BEAAD6h 0x0000000f popad 0x00000010 jmp 00007FA870BEAADBh 0x00000015 pop edx 0x00000016 pop eax 0x00000017 pushad 0x00000018 push esi 0x00000019 je 00007FA870BEAAD6h 0x0000001f pushad 0x00000020 popad 0x00000021 pop esi 0x00000022 pushad 0x00000023 push ecx 0x00000024 pop ecx 0x00000025 push edx 0x00000026 pop edx 0x00000027 popad 0x00000028 ja 00007FA870BEAADCh 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C6207 second address: 10C621E instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA87137DD56h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c je 00007FA87137DD58h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C621E second address: 10C6224 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C9DB8 second address: 10C9DE8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA87137DD67h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FA87137DD5Fh 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C9DE8 second address: 10C9DEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C9DEC second address: 10C9DF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C9DF2 second address: 10C9E0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FA870BEAAE2h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D2508 second address: 10D2547 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FA87137DD56h 0x0000000a popad 0x0000000b pushad 0x0000000c jl 00007FA87137DD6Eh 0x00000012 jmp 00007FA87137DD68h 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b jmp 00007FA87137DD61h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C9AC7 second address: 10C9ACD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C9C53 second address: 10C9C61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jbe 00007FA87137DD5Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CAD1E second address: 10CAD26 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CAD26 second address: 10CAD2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CAD2E second address: 10CAD3C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CAD3C second address: 10CAD40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CAD40 second address: 10CAD46 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CAD46 second address: 10CAD4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CAD4C second address: 10CAD75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA870BEAAE7h 0x00000009 jmp 00007FA870BEAADEh 0x0000000e rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E3DD9D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E3DE84 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1007BC5 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FF2C7A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 107BC35 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E420FB instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E42224 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 5480000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 56A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 54C0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FBA94B rdtsc

0_2_00FBA94B

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 1704

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_01019D40 GetSystemInfo,VirtualAlloc,

0_2_01019D40

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.1913298210.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1913298210.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FBA94B rdtsc

0_2_00FBA94B

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00E3B998 LdrInitializeThunk,

0_2_00E3B998

Source: C:\Users\user\Desktop\file.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.1913425424.0000000001005000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: "Program Manager

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\Desktop\file.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\Desktop\file.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	641 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	41 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Bypass User Account Control	261 Virtualization/Sandbox Evasion	Security Account Manager	261 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	23 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Software Packing	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Bypass User Account Control	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Joe Sandbox ML

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561858
Start date and time:	2024-11-24 14:55:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@1/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtProtectVirtualMemory calls found.
VT rate limit hit for: file.exe

Process:	C:\Users\user\Desktop\file.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.529968454035193
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	2'789'888 bytes
MD5:	28e07d9ab0a04c2f660e2506117e63b5
SHA1:	28c526b2130b829c389c0b7351ff4ad0e3d63d89
SHA256:	c4b5efac85934e3ec9a0c11d14b0136c0b116366408193a8b7c32bdd1dffc5ce
SHA512:	e5ce9fb164ae86dea4b23ff8bb9f8ba6238bcc97e5f2f9102d98ec77357e99dff4b2e5ccadb488baf34116e3ad4be16248f450c5405bfb59aa7687282eaf34f9
SSDEEP:	24576:aeCV3Xaze1kxcABn/0UYSvcQe7lvboa7c4+37me9sEs1tfCmPpAfNFk0+cGk8Q0H:Iday1kz9/sJsaKVFky3WAsK/h2+7Qn
TLSH:	B9D52B92A90671CBEC8E177495A7CD4A9A7D03B5073148C3A868FDBA7D73CC132B6D24
File Content Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. .......................@+.....G.*...`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x6b0000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE
Time Stamp:	0x652C2850 [Sun Oct 15 17:58:40 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FA8707DE87Ah
pshufw mm5, qword ptr [edx], 00h
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FA8707E0875h
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax+00000000h], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop ds
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
inc eax
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8055	0x69	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6000	0x59c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x81f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x2000	0x4000	0x1200	1836c02fe1ad3139ba9ec571ffaf6534	False	0.9320746527777778	data	7.805079736087947	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x6000	0x59c	0x600	aae15e30898a02f09cc86ed48aa06b09	False	0.4140625	data	4.036947054771808	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x8000	0x2000	0x200	ec9cb51e8cb4ea49a56ee3cf434fb69e	False	0.1484375	data	0.9342685949460681	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ecosufqf	0xa000	0x2a4000	0x2a3200	e9649d1c287c78155e541c4a7b280672	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
pnlltuis	0x2ae000	0x2000	0x400	42749ef283022d47ec707c17e477559d	False	0.7451171875	data	5.954043207536442	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x2b0000	0x4000	0x2200	0c5e7affcff894ee7aea906b70407c87	False	0.06307444852941177	DOS executable (COM)	0.7540944201879068	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x6090	0x30c	data			0.42948717948717946
RT_MANIFEST	0x63ac	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
kernel32.dll	lstrcpy

Target ID:	0
Start time:	08:56:10
Start date:	24/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xe30000
File size:	2'789'888 bytes
MD5 hash:	28E07D9AB0A04C2F660E2506117E63B5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6.2%
Dynamic/Decrypted Code Coverage:	4.5%
Signature Coverage:	5.6%
Total number of Nodes:	287
Total number of Limit Nodes:	20

Executed Functions

Function 01019D40 Relevance: 3.1, APIs: 2, Instructions: 107
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNELBASE(?,-11495FEC), ref: 01019D4C
VirtualAlloc.KERNELBASE(00000000,00004000,00001000,00000004), ref: 01019DAD

Memory Dump Source

Source File: 00000000.00000002.1913477781.0000000001016000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1913050716.0000000000E30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913067242.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913081499.0000000000E36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913098176.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913119374.0000000000E46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913258578.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913273749.0000000000F9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913298210.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913298210.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913332700.0000000000FCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913348020.0000000000FCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913367612.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913382666.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913404334.0000000000FF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913425424.0000000001005000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913443304.0000000001013000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913502158.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913520002.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913586655.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913623507.000000000102E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913778844.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913798565.0000000001038000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913819449.000000000103F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913872882.0000000001041000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913895480.0000000001050000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913912216.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913936580.0000000001052000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913952902.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913968946.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913983998.000000000105B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914001486.0000000001063000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914016050.0000000001064000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914031610.0000000001065000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914047383.000000000106F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914090235.00000000010C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914104568.00000000010C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914121664.00000000010C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914121664.00000000010D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914151114.00000000010DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914166662.00000000010E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_file.jbxd

Similarity

API ID: AllocInfoSystemVirtual
String ID:
API String ID: 3440192736-0
Opcode ID: c2828d15dfb7930f0927f47d82dc874192314bf419de69498a2df7b817be6f3a
Instruction ID: 93c0bbe20e5656a6844e4d9daf65b50bdf50dbee899e6da2a7c2784f65e0eb71
Opcode Fuzzy Hash: c2828d15dfb7930f0927f47d82dc874192314bf419de69498a2df7b817be6f3a
Instruction Fuzzy Hash: 434103B2E40206AFE339DF64C945F96BBECBB08741F1104A6A243CA4D6E77691D48B94

Function 00FBA94B Relevance: 1.6, APIs: 1, Instructions: 115
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00FBA94B

Memory Dump Source

Source File: 00000000.00000002.1913298210.0000000000FB7000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1913050716.0000000000E30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913067242.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913081499.0000000000E36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913098176.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913119374.0000000000E46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913258578.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913273749.0000000000F9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913298210.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913332700.0000000000FCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913348020.0000000000FCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913367612.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913382666.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913404334.0000000000FF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913425424.0000000001005000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913443304.0000000001013000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913477781.0000000001016000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913502158.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913520002.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913586655.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913623507.000000000102E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913778844.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913798565.0000000001038000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913819449.000000000103F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913872882.0000000001041000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913895480.0000000001050000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913912216.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913936580.0000000001052000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913952902.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913968946.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913983998.000000000105B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914001486.0000000001063000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914016050.0000000001064000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914031610.0000000001065000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914047383.000000000106F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914090235.00000000010C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914104568.00000000010C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914121664.00000000010C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914121664.00000000010D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914151114.00000000010DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914166662.00000000010E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b0f24c2a79ad6c67572540daa4a2d37c6911d3f6e5eb8dd15c7072e169d40849
Instruction ID: 8fe395be66bfe5137a49999e76aab06adca5971bdc22ff633181ab8e751ca74b
Opcode Fuzzy Hash: b0f24c2a79ad6c67572540daa4a2d37c6911d3f6e5eb8dd15c7072e169d40849
Instruction Fuzzy Hash: 74314AB250C710AFE7056F19D8817BABBE5FF54720F16482DE6C586640E63548809B97

Function 00E3B998 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1913098176.0000000000E3A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1913050716.0000000000E30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913067242.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913081499.0000000000E36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913119374.0000000000E46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913258578.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913273749.0000000000F9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913298210.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913298210.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913332700.0000000000FCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913348020.0000000000FCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913367612.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913382666.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913404334.0000000000FF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913425424.0000000001005000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913443304.0000000001013000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913477781.0000000001016000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913502158.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913520002.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913586655.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913623507.000000000102E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913778844.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913798565.0000000001038000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913819449.000000000103F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913872882.0000000001041000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913895480.0000000001050000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913912216.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913936580.0000000001052000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913952902.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913968946.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913983998.000000000105B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914001486.0000000001063000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914016050.0000000001064000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914031610.0000000001065000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914047383.000000000106F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914090235.00000000010C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914104568.00000000010C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914121664.00000000010C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914121664.00000000010D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914151114.00000000010DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914166662.00000000010E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82b6b6fa116ff9dc96d66aef7ae1078dfb7120ad1b85eeb0e90ce6aaa3ad37f6
Instruction ID: 306b51d05e7367f3440893ef22c87935141903f16c8247cbcc1a1cd513e19535
Opcode Fuzzy Hash: 82b6b6fa116ff9dc96d66aef7ae1078dfb7120ad1b85eeb0e90ce6aaa3ad37f6
Instruction Fuzzy Hash: 00F027129085418ED3025A3884693A46E61ABC6304F19E8D58383EB296D3280881D390

Function 01011015 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,?,?), ref: 01011126
LoadLibraryExA.KERNELBASE(00000000,?,?), ref: 0101113A

Strings

.dll, xrefs: 0101105D
.exe, xrefs: 01011081
1002, xrefs: 010110F0

Memory Dump Source

Source File: 00000000.00000002.1913425424.0000000001005000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1913050716.0000000000E30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913067242.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913081499.0000000000E36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913098176.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913119374.0000000000E46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913258578.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913273749.0000000000F9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913298210.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913298210.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913332700.0000000000FCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913348020.0000000000FCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913367612.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913382666.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913404334.0000000000FF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913443304.0000000001013000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913477781.0000000001016000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913502158.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913520002.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913586655.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913623507.000000000102E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913778844.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913798565.0000000001038000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913819449.000000000103F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913872882.0000000001041000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913895480.0000000001050000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913912216.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913936580.0000000001052000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913952902.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913968946.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913983998.000000000105B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914001486.0000000001063000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914016050.0000000001064000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914031610.0000000001065000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914047383.000000000106F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914090235.00000000010C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914104568.00000000010C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914121664.00000000010C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914121664.00000000010D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914151114.00000000010DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914166662.00000000010E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_file.jbxd

Similarity

API ID: LibraryLoad
String ID: .dll$.exe$1002
API String ID: 1029625771-847511843
Opcode ID: bf244f51098f1461c5de724f34f5bf4bb42a38acf66c36b1da81cf993a7748d1
Instruction ID: e45fd2340bb036a988d46c309ef65e0c46ecea7c0954a40e0dd20181f4cc61b4
Opcode Fuzzy Hash: bf244f51098f1461c5de724f34f5bf4bb42a38acf66c36b1da81cf993a7748d1
Instruction Fuzzy Hash: 4931E03190424AFFEF2AAF64D900BEDBBB5FF14340F0041A5FA8256168C77999A0DB91

Function 0101151B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,010114AD,?,00000000,00000000), ref: 010115D8
GetModuleHandleA.KERNEL32(00000000,?,?,?,010114AD,?,00000000,00000000), ref: 010115E6

Strings

.dll, xrefs: 0101154E

Memory Dump Source

Source File: 00000000.00000002.1913425424.0000000001005000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1913050716.0000000000E30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913067242.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913081499.0000000000E36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913098176.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913119374.0000000000E46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913258578.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913273749.0000000000F9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913298210.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913298210.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913332700.0000000000FCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913348020.0000000000FCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913367612.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913382666.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913404334.0000000000FF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913443304.0000000001013000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913477781.0000000001016000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913502158.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913520002.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913586655.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913623507.000000000102E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913778844.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913798565.0000000001038000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913819449.000000000103F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913872882.0000000001041000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913895480.0000000001050000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913912216.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913936580.0000000001052000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913952902.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913968946.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913983998.000000000105B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914001486.0000000001063000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914016050.0000000001064000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914031610.0000000001065000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914047383.000000000106F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914090235.00000000010C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914104568.00000000010C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914121664.00000000010C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914121664.00000000010D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914151114.00000000010DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914166662.00000000010E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_file.jbxd

Similarity

API ID: HandleModule
String ID: .dll
API String ID: 4139908857-2738580789
Opcode ID: 7e722692ed380357eeb75ac1e39e7011a6aea411325e4410094c3f675c606294
Instruction ID: 051d72cc5e2d3e421065f6fe0a29d95466fba2fbdfa1b2d8b424eab7e44eb363
Opcode Fuzzy Hash: 7e722692ed380357eeb75ac1e39e7011a6aea411325e4410094c3f675c606294
Instruction Fuzzy Hash: B9114871105606EBEB79AF38C809BAD7EE4BF10344F084211A787484E9C779A6E4CAE1

Function 0100FEF5 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathAddExtensionA.KERNELBASE(?,00000000), ref: 0100FF57

Strings

\\?\, xrefs: 0100FFB2

Memory Dump Source

Source File: 00000000.00000002.1913425424.0000000001005000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1913050716.0000000000E30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913067242.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913081499.0000000000E36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913098176.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913119374.0000000000E46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913258578.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913273749.0000000000F9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913298210.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913298210.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913332700.0000000000FCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913348020.0000000000FCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913367612.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913382666.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913404334.0000000000FF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913443304.0000000001013000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913477781.0000000001016000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913502158.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913520002.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913586655.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913623507.000000000102E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913778844.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913798565.0000000001038000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913819449.000000000103F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913872882.0000000001041000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913895480.0000000001050000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913912216.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913936580.0000000001052000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913952902.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913968946.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913983998.000000000105B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914001486.0000000001063000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914016050.0000000001064000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914031610.0000000001065000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914047383.000000000106F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914090235.00000000010C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914104568.00000000010C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914121664.00000000010C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914121664.00000000010D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914151114.00000000010DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914166662.00000000010E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_file.jbxd

Similarity

API ID: ExtensionPath
String ID: \\?\
API String ID: 158807944-4282027825
Opcode ID: a7a852deb2b951af27be682dae2b1cf715b9aa5353b63dd3afef8c402e5b9d3f
Instruction ID: 49ce6d3f65aa33a3f4cce60a5dfc691b0d2c3eb7c2db173026baeccdbf59a6fc
Opcode Fuzzy Hash: a7a852deb2b951af27be682dae2b1cf715b9aa5353b63dd3afef8c402e5b9d3f
Instruction Fuzzy Hash: 4031FB31A0060ABFEF62DF98CD08B9EBBB6FF44704F000095FA81A5494D77695A5EF90

Function 01011604 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0100F942: GetCurrentThreadId.KERNEL32 ref: 0100F951

GetModuleHandleExA.KERNELBASE(?,?,?), ref: 01011668

Strings

.dll, xrefs: 01011625

Memory Dump Source

Source File: 00000000.00000002.1913425424.0000000001005000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1913050716.0000000000E30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913067242.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913081499.0000000000E36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913098176.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913119374.0000000000E46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913258578.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913273749.0000000000F9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913298210.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913298210.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913332700.0000000000FCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913348020.0000000000FCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913367612.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913382666.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913404334.0000000000FF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913443304.0000000001013000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913477781.0000000001016000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913502158.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913520002.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913586655.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913623507.000000000102E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913778844.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913798565.0000000001038000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913819449.000000000103F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913872882.0000000001041000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913895480.0000000001050000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913912216.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913936580.0000000001052000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913952902.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913968946.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913983998.000000000105B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914001486.0000000001063000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914016050.0000000001064000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914031610.0000000001065000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914047383.000000000106F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914090235.00000000010C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914104568.00000000010C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914121664.00000000010C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914121664.00000000010D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914151114.00000000010DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914166662.00000000010E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_file.jbxd

Similarity

API ID: CurrentHandleModuleThread
String ID: .dll
API String ID: 2752942033-2738580789
Opcode ID: 273b5e84c778e2c59420d5488b858c9e99884bc1cea08f4edea5632e073109e7
Instruction ID: a1f170600e6008c87d4bd836a3657d8cda6f6a49e103a530ad4a3baf65ba93d1
Opcode Fuzzy Hash: 273b5e84c778e2c59420d5488b858c9e99884bc1cea08f4edea5632e073109e7
Instruction Fuzzy Hash: D3F09071200206AFEB25DF68C845FED3BA5FF28344F048411FF8645099C736C890DA10

Function 0101A76C Relevance: 1.6, APIs: 1, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1913477781.0000000001016000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1913050716.0000000000E30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913067242.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913081499.0000000000E36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913098176.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913119374.0000000000E46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913258578.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913273749.0000000000F9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913298210.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913298210.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913332700.0000000000FCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913348020.0000000000FCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913367612.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913382666.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913404334.0000000000FF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913425424.0000000001005000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913443304.0000000001013000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913502158.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913520002.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913586655.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913623507.000000000102E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913778844.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913798565.0000000001038000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913819449.000000000103F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913872882.0000000001041000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913895480.0000000001050000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913912216.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913936580.0000000001052000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913952902.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913968946.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913983998.000000000105B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914001486.0000000001063000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914016050.0000000001064000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914031610.0000000001065000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914047383.000000000106F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914090235.00000000010C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914104568.00000000010C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914121664.00000000010C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914121664.00000000010D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914151114.00000000010DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914166662.00000000010E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0525fbed8fcb23a8ab0bd002f3290291bc72708804671403a6078ea1e772c658
Instruction ID: cc6c8c8f530249b8e0677789febac4ebc90a3c01177246cfd86a9ea46e2a0c73
Opcode Fuzzy Hash: 0525fbed8fcb23a8ab0bd002f3290291bc72708804671403a6078ea1e772c658
Instruction Fuzzy Hash: 7941AF71F02286EFEB25CF18C944BAE7BF1FF04314F108095E982AB596C339A991CB51

Function 0101207C Relevance: 1.6, APIs: 1, Instructions: 103
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000,00000010), ref: 01012131

Memory Dump Source

Source File: 00000000.00000002.1913425424.0000000001005000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1913050716.0000000000E30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913067242.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913081499.0000000000E36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913098176.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913119374.0000000000E46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913258578.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913273749.0000000000F9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913298210.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913298210.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913332700.0000000000FCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913348020.0000000000FCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913367612.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913382666.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913404334.0000000000FF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913443304.0000000001013000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913477781.0000000001016000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913502158.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913520002.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913586655.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913623507.000000000102E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913778844.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913798565.0000000001038000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913819449.000000000103F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913872882.0000000001041000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913895480.0000000001050000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913912216.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913936580.0000000001052000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913952902.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913968946.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913983998.000000000105B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914001486.0000000001063000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914016050.0000000001064000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914031610.0000000001065000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914047383.000000000106F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914090235.00000000010C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914104568.00000000010C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914121664.00000000010C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914121664.00000000010D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914151114.00000000010DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914166662.00000000010E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 0945ee26eb772913618aa45af462d2a14c61c48acb31b96c7bd46a370de54adc
Instruction ID: 45bfab0ccb4cd1e16d444ce4c610e596ca68880046d727bf998d3983c6e89ccf
Opcode Fuzzy Hash: 0945ee26eb772913618aa45af462d2a14c61c48acb31b96c7bd46a370de54adc
Instruction Fuzzy Hash: 1631CB75A00206FFEB61DF68DC44F9DBBB8FB44314F208269FA05AA195C7799A41CB10

Function 00FBA80D Relevance: 1.6, APIs: 1, Instructions: 92
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00FBA80D

Memory Dump Source

Source File: 00000000.00000002.1913298210.0000000000FB7000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1913050716.0000000000E30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913067242.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913081499.0000000000E36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913098176.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913119374.0000000000E46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913258578.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913273749.0000000000F9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913298210.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913332700.0000000000FCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913348020.0000000000FCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913367612.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913382666.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913404334.0000000000FF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913425424.0000000001005000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913443304.0000000001013000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913477781.0000000001016000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913502158.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913520002.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913586655.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913623507.000000000102E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913778844.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913798565.0000000001038000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913819449.000000000103F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913872882.0000000001041000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913895480.0000000001050000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913912216.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913936580.0000000001052000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913952902.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913968946.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913983998.000000000105B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914001486.0000000001063000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914016050.0000000001064000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914031610.0000000001065000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914047383.000000000106F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914090235.00000000010C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914104568.00000000010C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914121664.00000000010C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914121664.00000000010D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914151114.00000000010DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914166662.00000000010E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6e266c6299cab1bd26cc3272c96776ab52e208d9d64181788a9828b295dfdea4
Instruction ID: 550b7f8dd2dfab4c067b1da6f9b37ca390503963178114d76af3d30c618e5b40
Opcode Fuzzy Hash: 6e266c6299cab1bd26cc3272c96776ab52e208d9d64181788a9828b295dfdea4
Instruction Fuzzy Hash: BA31C2B251C700AFE712BF19D8816BAFBE5FF54311F06482DE6C482610EB3588908B9B

Function 01011898 Relevance: 1.6, APIs: 1, Instructions: 92
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,?,00000000), ref: 0101191A

Memory Dump Source

Source File: 00000000.00000002.1913425424.0000000001005000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1913050716.0000000000E30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913067242.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913081499.0000000000E36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913098176.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913119374.0000000000E46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913258578.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913273749.0000000000F9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913298210.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913298210.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913332700.0000000000FCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913348020.0000000000FCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913367612.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913382666.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913404334.0000000000FF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913443304.0000000001013000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913477781.0000000001016000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913502158.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913520002.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913586655.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913623507.000000000102E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913778844.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913798565.0000000001038000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913819449.000000000103F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913872882.0000000001041000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913895480.0000000001050000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913912216.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913936580.0000000001052000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913952902.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913968946.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913983998.000000000105B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914001486.0000000001063000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914016050.0000000001064000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914031610.0000000001065000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914047383.000000000106F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914090235.00000000010C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914104568.00000000010C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914121664.00000000010C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914121664.00000000010D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914151114.00000000010DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914166662.00000000010E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c32da5a2c947160be41bd7d47a5daf5f82457caf39eac26d9b937c68e20bf53b
Instruction ID: 38cefbde4f8a2eb54dac9e80f442ad4af51ccd12709a07e5ec7bceac66295214
Opcode Fuzzy Hash: c32da5a2c947160be41bd7d47a5daf5f82457caf39eac26d9b937c68e20bf53b
Instruction Fuzzy Hash: 5531D575600205BBEB759F68DC45F9DB7B9EF40724F208269F721EA0D1C3B9A141CB14

Function 0101A4B9 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNELBASE(?,?,0000028A,?,?), ref: 0101A566

Memory Dump Source

Source File: 00000000.00000002.1913477781.0000000001016000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1913050716.0000000000E30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913067242.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913081499.0000000000E36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913098176.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913119374.0000000000E46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913258578.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913273749.0000000000F9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913298210.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913298210.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913332700.0000000000FCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913348020.0000000000FCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913367612.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913382666.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913404334.0000000000FF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913425424.0000000001005000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913443304.0000000001013000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913502158.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913520002.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913586655.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913623507.000000000102E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913778844.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913798565.0000000001038000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913819449.000000000103F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913872882.0000000001041000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913895480.0000000001050000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913912216.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913936580.0000000001052000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913952902.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913968946.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913983998.000000000105B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914001486.0000000001063000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914016050.0000000001064000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914031610.0000000001065000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914047383.000000000106F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914090235.00000000010C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914104568.00000000010C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914121664.00000000010C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914121664.00000000010D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914151114.00000000010DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914166662.00000000010E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_file.jbxd

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: 2c5e33305cde1d356c552d4e4c639eb8d76bc2ed7c3b68ac93d88986d42b2280
Instruction ID: cfc7a7e0ced4d4646d9e9c365dca988c1382e319dc9f439181d83fc8729edd14
Opcode Fuzzy Hash: 2c5e33305cde1d356c552d4e4c639eb8d76bc2ed7c3b68ac93d88986d42b2280
Instruction Fuzzy Hash: DB11E971B07265DFEB724A188C48BEF77BCAF48718F1040D1E9859B049DB78D9C48BA1

Function 05480D43 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 05480DCD

Memory Dump Source

Source File: 00000000.00000002.1915982424.0000000005480000.00000040.00000800.00020000.00000000.sdmp, Offset: 05480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5480000_file.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 50db7747f8f4c23c269dc5fac2bdea3ce473a363e9a43888cb618851aa733c63
Instruction ID: 81029bbb50f1e0aea08832c2a92e49e9dbc27779636e630a3f65d192df63f93b
Opcode Fuzzy Hash: 50db7747f8f4c23c269dc5fac2bdea3ce473a363e9a43888cb618851aa733c63
Instruction Fuzzy Hash: 872134B6C102189FCB10DF99D889BDEFBF4FB88320F14825AD809AB344C734A544CBA4

Function 05480D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 05480DCD

Memory Dump Source

Source File: 00000000.00000002.1915982424.0000000005480000.00000040.00000800.00020000.00000000.sdmp, Offset: 05480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5480000_file.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 34653fa8bed6c45f8c5912d0f84d501335d0f43c7231f77b6a7f3c6673b62d07
Instruction ID: e92840c8796a1753717de793cf4746ec6c3cda336e62c4f3740ff07dc1cb970d
Opcode Fuzzy Hash: 34653fa8bed6c45f8c5912d0f84d501335d0f43c7231f77b6a7f3c6673b62d07
Instruction Fuzzy Hash: 7B2144B6C102189FCB10DF99D888BDEFBF4FB88320F14825AD809AB344C734A544CBA4

Function 05481510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 05481580

Memory Dump Source

Source File: 00000000.00000002.1915982424.0000000005480000.00000040.00000800.00020000.00000000.sdmp, Offset: 05480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5480000_file.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 784d2673dfb62e1f37536f3189f5d1c083a8499c3f731c57316572bb756496b3
Instruction ID: a80cc11248d19e5e457ee2b4b283bb7dc8edb862bc7aea287fa9a80aee1fa85b
Opcode Fuzzy Hash: 784d2673dfb62e1f37536f3189f5d1c083a8499c3f731c57316572bb756496b3
Instruction Fuzzy Hash: 051114B19003498FCB20DF9AD484BDEFBF4EB48320F10802AE919A3340D378A644CFA5

Function 05481509 Relevance: 1.6, APIs: 1, Instructions: 53
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 05481580

Memory Dump Source

Source File: 00000000.00000002.1915982424.0000000005480000.00000040.00000800.00020000.00000000.sdmp, Offset: 05480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5480000_file.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: f17b820a8b66fb950b8ad2facb7170e4cbb0780debead7fe5631a23bc172a8e2
Instruction ID: e61ca88243de68419cbdea35079159e134060c5e22068053354097e7ab92d25c
Opcode Fuzzy Hash: f17b820a8b66fb950b8ad2facb7170e4cbb0780debead7fe5631a23bc172a8e2
Instruction Fuzzy Hash: 502106B59003498FDB10CFAAD545BEEBBF4FB48311F10842AE519A7240D338A644CFA5

Function 05481301 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 05481367

Memory Dump Source

Source File: 00000000.00000002.1915982424.0000000005480000.00000040.00000800.00020000.00000000.sdmp, Offset: 05480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5480000_file.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 488e7425252fbd80701a72f09a74f933877547f43b812d714c818170dacbb528
Instruction ID: f3b0abb815db6622946301a2dd3555a949ebf1626024af20110288db0ede70f8
Opcode Fuzzy Hash: 488e7425252fbd80701a72f09a74f933877547f43b812d714c818170dacbb528
Instruction Fuzzy Hash: 541113B18003498FDB20DF9AD845BEEBBF4EF49324F24846AD518A3350D778A544CFA5

Function 05481308 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 05481367

Memory Dump Source

Source File: 00000000.00000002.1915982424.0000000005480000.00000040.00000800.00020000.00000000.sdmp, Offset: 05480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5480000_file.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 41aea0ed5f307a0b6ee138eee813790676472fb4215c4ce9d40f26991549cac9
Instruction ID: c35bb973866e755eba6968a8fe8c6a2113fc840424fdf04aa3a619707cc69d5e
Opcode Fuzzy Hash: 41aea0ed5f307a0b6ee138eee813790676472fb4215c4ce9d40f26991549cac9
Instruction Fuzzy Hash: 401125B18003498FDB20DF9AD445BEEBBF4EB48320F20846AD518A3240C778A544CBA5

Function 00FC64B0 Relevance: 1.5, APIs: 1, Instructions: 19libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 00FC9069

Memory Dump Source

Source File: 00000000.00000002.1913298210.0000000000FC1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1913050716.0000000000E30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913067242.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913081499.0000000000E36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913098176.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913119374.0000000000E46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913258578.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913273749.0000000000F9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913298210.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913332700.0000000000FCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913348020.0000000000FCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913367612.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913382666.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913404334.0000000000FF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913425424.0000000001005000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913443304.0000000001013000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913477781.0000000001016000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913502158.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913520002.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913586655.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913623507.000000000102E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913778844.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913798565.0000000001038000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913819449.000000000103F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913872882.0000000001041000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913895480.0000000001050000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913912216.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913936580.0000000001052000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913952902.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913968946.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913983998.000000000105B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914001486.0000000001063000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914016050.0000000001064000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914031610.0000000001065000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914047383.000000000106F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914090235.00000000010C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914104568.00000000010C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914121664.00000000010C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914121664.00000000010D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914151114.00000000010DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914166662.00000000010E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_file.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 7e6a776510267b1f410b3a0589b92e5ffeb182e73d042b5156febab196640e82
Instruction ID: 8c3ea327fe8cce4c6a5a22a0873d15f48447525ae7c23b775c65f3cacdbb8169
Opcode Fuzzy Hash: 7e6a776510267b1f410b3a0589b92e5ffeb182e73d042b5156febab196640e82
Instruction Fuzzy Hash: 42E07EB244CA00DFE702BF29D8867ADB7E0EF98310F02082EDAC583910D6342491DE87

Function 0100FB13 Relevance: 1.3, APIs: 1, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrcmpiA.KERNEL32(?,?), ref: 0100FB77

Memory Dump Source

Source File: 00000000.00000002.1913425424.0000000001005000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1913050716.0000000000E30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913067242.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913081499.0000000000E36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913098176.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913119374.0000000000E46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913258578.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913273749.0000000000F9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913298210.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913298210.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913332700.0000000000FCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913348020.0000000000FCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913367612.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913382666.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913404334.0000000000FF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913443304.0000000001013000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913477781.0000000001016000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913502158.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913520002.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913586655.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913623507.000000000102E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913778844.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913798565.0000000001038000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913819449.000000000103F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913872882.0000000001041000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913895480.0000000001050000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913912216.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913936580.0000000001052000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913952902.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913968946.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913983998.000000000105B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914001486.0000000001063000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914016050.0000000001064000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914031610.0000000001065000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914047383.000000000106F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914090235.00000000010C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914104568.00000000010C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914121664.00000000010C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914121664.00000000010D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914151114.00000000010DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914166662.00000000010E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_file.jbxd

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: d7547f16ec792b612e0beca86559e9864c08247c018ff90a17eb497352108e95
Instruction ID: 81c19a575d4fb43ee6c79c39a045c2c14b77d2d9a697b79aee6103cbaa1ccf12
Opcode Fuzzy Hash: d7547f16ec792b612e0beca86559e9864c08247c018ff90a17eb497352108e95
Instruction Fuzzy Hash: C101E835A0050ABFEF229FA4CC04DDEBFBAEF49350F0041A5A545A40A0D7328A61EF60

Function 0101A0E3 Relevance: 1.3, APIs: 1, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00001000,00001000,00000004,?,?,0101A0DF,?,?,01019DE5,?,?,01019DE5,?,?,01019DE5), ref: 0101A103

Memory Dump Source

Source File: 00000000.00000002.1913477781.0000000001016000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1913050716.0000000000E30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913067242.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913081499.0000000000E36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913098176.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913119374.0000000000E46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913258578.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913273749.0000000000F9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913298210.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913298210.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913332700.0000000000FCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913348020.0000000000FCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913367612.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913382666.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913404334.0000000000FF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913425424.0000000001005000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913443304.0000000001013000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913502158.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913520002.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913586655.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913623507.000000000102E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913778844.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913798565.0000000001038000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913819449.000000000103F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913872882.0000000001041000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913895480.0000000001050000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913912216.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913936580.0000000001052000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913952902.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913968946.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913983998.000000000105B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914001486.0000000001063000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914016050.0000000001064000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914031610.0000000001065000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914047383.000000000106F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914090235.00000000010C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914104568.00000000010C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914121664.00000000010C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914121664.00000000010D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914151114.00000000010DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914166662.00000000010E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1845648b11b1529094823d54f0e9dab91865e826d5c836fd1cb9c684472e9450
Instruction ID: 28deaa7a20d5f87f0917b55b683d4189c53a038c42b593b6c3f6bd4aae06aa46
Opcode Fuzzy Hash: 1845648b11b1529094823d54f0e9dab91865e826d5c836fd1cb9c684472e9450
Instruction Fuzzy Hash: 11F0D1B1A01205EFD7208F08CD05B98BBE0FF59791F1180A5F58AAB6A1E3B594C08B50

Function 01012696 Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 0100F942: GetCurrentThreadId.KERNEL32 ref: 0100F951

CloseHandle.KERNELBASE(01012059,-11495FEC,?,?,01012059,?), ref: 010126D4

Memory Dump Source

Source File: 00000000.00000002.1913425424.0000000001005000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1913050716.0000000000E30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913067242.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913081499.0000000000E36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913098176.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913119374.0000000000E46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913258578.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913273749.0000000000F9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913298210.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913298210.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913332700.0000000000FCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913348020.0000000000FCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913367612.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913382666.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913404334.0000000000FF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913443304.0000000001013000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913477781.0000000001016000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913502158.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913520002.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913586655.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913623507.000000000102E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913778844.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913798565.0000000001038000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913819449.000000000103F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913872882.0000000001041000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913895480.0000000001050000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913912216.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913936580.0000000001052000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913952902.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913968946.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913983998.000000000105B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914001486.0000000001063000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914016050.0000000001064000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914031610.0000000001065000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914047383.000000000106F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914090235.00000000010C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914104568.00000000010C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914121664.00000000010C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914121664.00000000010D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914151114.00000000010DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914166662.00000000010E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_file.jbxd

Similarity

API ID: CloseCurrentHandleThread
String ID:
API String ID: 3305057742-0
Opcode ID: 6ada03d935a55eaf94fc0a5f2b01c2f560151b1c6756105924f6e80fe9e6d9df
Instruction ID: d0da97e1d8098b27e1841b6d4857c76a458a9bd6092face6dc2c31f42e348d8a
Opcode Fuzzy Hash: 6ada03d935a55eaf94fc0a5f2b01c2f560151b1c6756105924f6e80fe9e6d9df
Instruction Fuzzy Hash: 6CE04F76204147B7EE22BBB9D908D8E2F6CAFB4284B004522A18695098DA28C592DA61

Function 00E3F4FD Relevance: 1.3, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 00E3F844

Memory Dump Source

Source File: 00000000.00000002.1913098176.0000000000E3A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1913050716.0000000000E30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913067242.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913081499.0000000000E36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913119374.0000000000E46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913258578.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913273749.0000000000F9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913298210.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913298210.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913332700.0000000000FCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913348020.0000000000FCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913367612.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913382666.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913404334.0000000000FF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913425424.0000000001005000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913443304.0000000001013000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913477781.0000000001016000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913502158.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913520002.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913586655.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913623507.000000000102E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913778844.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913798565.0000000001038000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913819449.000000000103F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913872882.0000000001041000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913895480.0000000001050000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913912216.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913936580.0000000001052000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913952902.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913968946.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913983998.000000000105B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914001486.0000000001063000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914016050.0000000001064000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914031610.0000000001065000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914047383.000000000106F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914090235.00000000010C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914104568.00000000010C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914121664.00000000010C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914121664.00000000010D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914151114.00000000010DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914166662.00000000010E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_file.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 38c59ce789bd1dfcb793fbc1f2089eb958cef2b9eda42d4a76853e0214639bf2
Instruction ID: 8af92be34aae59a104be5c75d0f0380ab4c41317dce44244b0398e7eb65edf0a
Opcode Fuzzy Hash: 38c59ce789bd1dfcb793fbc1f2089eb958cef2b9eda42d4a76853e0214639bf2
Instruction Fuzzy Hash: 4EE04F75918500DFE305BF39C8097BE7BA1EB94310F505638DEC5A7254D2311825CA56

Function 0101175B Relevance: 1.3, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?,?,0100F7E1,?,?), ref: 01011761

Memory Dump Source

Source File: 00000000.00000002.1913425424.0000000001005000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1913050716.0000000000E30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913067242.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913081499.0000000000E36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913098176.0000000000E3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913119374.0000000000E46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913258578.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913273749.0000000000F9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913298210.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913298210.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913332700.0000000000FCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913348020.0000000000FCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913367612.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913382666.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913404334.0000000000FF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913443304.0000000001013000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913477781.0000000001016000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913502158.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913520002.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913586655.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913623507.000000000102E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913778844.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913798565.0000000001038000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913819449.000000000103F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913872882.0000000001041000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913895480.0000000001050000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913912216.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913936580.0000000001052000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913952902.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913968946.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913983998.000000000105B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914001486.0000000001063000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914016050.0000000001064000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914031610.0000000001065000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914047383.000000000106F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914090235.00000000010C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914104568.00000000010C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914121664.00000000010C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914121664.00000000010D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914151114.00000000010DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914166662.00000000010E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_file.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 171cc5901095bc0a96cab95c652d08b75be2d0f1426fa1532ff9bd436bbfc83c
Instruction ID: 5ffeab0fe990da83e81967f198f8b78f179ffc1e7270c005188919ec44b4c031
Opcode Fuzzy Hash: 171cc5901095bc0a96cab95c652d08b75be2d0f1426fa1532ff9bd436bbfc83c
Instruction Fuzzy Hash: E4B09B3500510977CB41BF55DC0584D7F69FF752947008111F54544430C776D561D790

Non-executed Functions

Function 00E45D46 Relevance: 2.7, Strings: 2, Instructions: 156COMMON

Download Yara Rule

Strings

pD-7, xrefs: 00E45E2D
j, xrefs: 00E45DF9

Memory Dump Source

Source File: 00000000.00000002.1913098176.0000000000E3A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1913050716.0000000000E30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913067242.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913081499.0000000000E36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913119374.0000000000E46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913258578.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913273749.0000000000F9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913298210.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913298210.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913332700.0000000000FCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913348020.0000000000FCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913367612.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913382666.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913404334.0000000000FF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913425424.0000000001005000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913443304.0000000001013000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913477781.0000000001016000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913502158.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913520002.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913586655.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913623507.000000000102E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913778844.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913798565.0000000001038000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913819449.000000000103F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913872882.0000000001041000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913895480.0000000001050000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913912216.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913936580.0000000001052000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913952902.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913968946.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913983998.000000000105B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914001486.0000000001063000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914016050.0000000001064000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914031610.0000000001065000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914047383.000000000106F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914090235.00000000010C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914104568.00000000010C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914121664.00000000010C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914121664.00000000010D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914151114.00000000010DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914166662.00000000010E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_file.jbxd

Similarity

API ID:
String ID: j$pD-7
API String ID: 0-2832694843
Opcode ID: 4b9b382d94855f5e4d16a1bff9b240b152f2d0055c4f0b7f5083452d9b2e59e4
Instruction ID: 4e7384d6b86b63faf88dc35a34a6ed1fc66af8c454f6ab85ace43c89183efbfe
Opcode Fuzzy Hash: 4b9b382d94855f5e4d16a1bff9b240b152f2d0055c4f0b7f5083452d9b2e59e4
Instruction Fuzzy Hash: 6D51BEB3F1122547F3504D29CC983A27293DBE5321F2F42788E586B7C9E87E9D4A5384

Function 00E458E2 Relevance: .3, Instructions: 320COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1913098176.0000000000E3A000.00000040.00000001.01000000.00000003.sdmp, Offset: 00E30000, based on PE: true

Associated: 00000000.00000002.1913050716.0000000000E30000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913067242.0000000000E32000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913081499.0000000000E36000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913119374.0000000000E46000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913258578.0000000000F9C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913273749.0000000000F9E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913298210.0000000000FB7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913298210.0000000000FC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913332700.0000000000FCB000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913348020.0000000000FCE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913367612.0000000000FDE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913382666.0000000000FDF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913404334.0000000000FF3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913425424.0000000001005000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913443304.0000000001013000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913477781.0000000001016000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913502158.0000000001027000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913520002.0000000001029000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913586655.000000000102A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913623507.000000000102E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913778844.0000000001036000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913798565.0000000001038000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913819449.000000000103F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913872882.0000000001041000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913895480.0000000001050000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913912216.0000000001051000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913936580.0000000001052000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913952902.0000000001056000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913968946.0000000001057000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1913983998.000000000105B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914001486.0000000001063000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914016050.0000000001064000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914031610.0000000001065000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914047383.000000000106F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914090235.00000000010C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914104568.00000000010C7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914121664.00000000010C8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914121664.00000000010D0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914151114.00000000010DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1914166662.00000000010E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e30000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d257262ce536dc420e63862e389c72fc5d42ad4523e4a2fd750c87f8e66434d4
Instruction ID: d79871493f3699341463627d4da690658d4a0934c4d0a3145512d5125f094cff
Opcode Fuzzy Hash: d257262ce536dc420e63862e389c72fc5d42ad4523e4a2fd750c87f8e66434d4
Instruction Fuzzy Hash: 23B17DB3E192A04FF3160A25DC243917B629B92314F1F41BACD88EB3D6D87E5C4A8395

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: file.exePID: 7056, Parent PID: 2580

General

Chronological Activities

Disassembly

Analysis Process: file.exePID: 7056, Parent PID: 2580COMMON

Execution Graph

Graph

Executed Functions

Function 01019D40 Relevance: 3.1, APIs: 2, Instructions: 107memoryCOMMON

Windows Analysis Report
file.exe

Function 01019D40 Relevance: 3.1, APIs: 2, Instructions: 107
memoryCOMMON

Function 00FBA94B Relevance: 1.6, APIs: 1, Instructions: 115
libraryCOMMON

Function 01011015 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83
libraryCOMMON

Function 0101151B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47
COMMON

Function 0100FEF5 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 90
COMMON

Function 01011604 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32
COMMON

Function 0101A76C Relevance: 1.6, APIs: 1, Instructions: 112
COMMON

Function 0101207C Relevance: 1.6, APIs: 1, Instructions: 103
fileCOMMON

Function 00FBA80D Relevance: 1.6, APIs: 1, Instructions: 92
libraryCOMMON

Function 01011898 Relevance: 1.6, APIs: 1, Instructions: 92
fileCOMMON

Function 0101A4B9 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 05480D43 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Function 05480D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Function 05481510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Function 05481509 Relevance: 1.6, APIs: 1, Instructions: 53
serviceCOMMON